41–50 of 97 posts
Earlier quoted context omitted.
Why don't you get an ad blocker - e.g. Ad Muncher is a great one.
I prefer to allow sites to monetise their visits within reason. If they go insane like Forbes then I just avoid them.
Right now, you are just leeching other people's time.
Earlier quoted context omitted.
I prefer to allow sites to monetise their visits within reason. If they go insane like Forbes then I just avoid them.
You can do that easily with any decent adblocker. You could disable it for all sites but Forbes if you like. Right now, you are just leeching other people's time.
I'm not leeching other people's time more than any other comment. If you're not interested proceed with the next post.
What I'm curious about is what Nohl meant when he said that it would take six months from the time of his presentation at Black Hat for crackers to develop working exploits based on his findings. And if he is (as the article suggests) working with the phone companies, why not simply wait until they've implemented their patches (if they in fact need them)? If indeed it is as simple to force a sim to run these maliciou…
Maybe creating the rainbow tables? [I'm not familiar with any of the details here FWIW, just guessing as that seems the most likely thing that could be estimated to take 6 months].
Earlier quoted context omitted.
Here's the primary bit the article says about implications: "The two-part flaw, based on an old security standard and badly configured code, could allow hackers to remotely infect a SIM with a virus that sends premium text messages (draining a mobile phone bill), surreptitiously re-direct and record calls, and —with the right combination of bugs —carry out payment system fraud."
Any SIM? Remotely how? through a call or a message? Just trying to figure out the scope of this problem. Journos seem to care more about sensation than facts.
Earlier quoted context omitted.
Why don't you get an ad blocker - e.g. Ad Muncher is a great one.
Why should we be forced to download third party applications/plugins in order to read a news post without any unnecessary interruptions?
Earlier quoted context omitted.
But you can already upload your software to phones. You don't need the simcard for that.
I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buyi…
Earlier quoted context omitted.
But you can already upload your software to phones. You don't need the simcard for that.
I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buyi…
FYI: the main Javacard applet on a SIM card is the GSM applet, the one you use to authenticate against your network. Other applets are useful for network operators: IMEI tracking sends them your phone ID to help them configure it correctly -- it is also used to track stolen phones. Another useful one updates your preferred foreign network list when you change countries, connecting you automatically to a cheaper network when available.
Uploading your own software will not do you much good. As mentioned above, CPU and memory are very limited on SIM cards, and Javacard is basically a glorified assembler you do not want to touch. SIM cards are mostly there to perform some simple crypto operations for network authentication and that's it.
Earlier quoted context omitted.
Any SIM? Remotely how? through a call or a message? Just trying to figure out the scope of this problem. Journos seem to care more about sensation than facts.
Figs summarised, if you want the details can't you read up on it (eg via the article posted)?
I'm asking just in case someone has a better source.
This is basically all the detail about the actual flaw in the article:
"In his study, Nohl says just under a quarter of all the SIM cards he tested could be hacked, but given that encryption standards vary widely between countries, he estimates an eighth of the world’s SIM cards could be vulnerable, or about half a billion mobile devices."
"his team tested close to 1,000 SIM cards for vulnerabilities, exploited by simply sending a hidden SMS. The two-part flaw, based on an old security standard and badly configured code, could allow hackers to remotely infect a SIM with a virus that sends premium text messages (draining a mobile phone bill), surreptitiously re-direct and record calls, and — with the right combination of bugs — carry out payment system fraud."
Seems like it would only affect a very specific subset of mobile phones.
I don't understand the article's description of the sandbox vulnerability. On the iPhone app sandboxing is done by iOS, not in the SIM. Does the reporter just not understand, or is there another layer I'm not aware of?
Most SIM cards are actually micro computers that communicate with the host system for certificates, encryption and some provider specific information, besides the common address stuff.
Usually the software is done in Assembly, C or JavaCard, with JavaCard use getting increased in the last years.
The JavaCard exploits are related to the VMs running the system, which are usually coded in a mix of Assembly and C. JavaCard VMs don't have a JIT due to memory constraints.
Earlier quoted context omitted.
I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buyi…
Do you program your PC BIOS or firmware?