Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

forbes.com

Post reply on HN
Print view View original

51–60 of 97 posts

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#51

Post by nitrogen »

nicolas314 wrote: post #47
jingo wrote: post #40

Earlier quoted context omitted.

I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buyi…

You do not own the SIM card, it remains full property of your network operator. As such, they have a right to keep you off-limits. FYI: the main Javacard applet on a SIM card is the GSM applet, the one you use to authenticate against your network. Other applets are useful for network operators: IMEI tracking sends them your phone ID to help them configure it correctly -- it is also used to track stolen phones. Anothe…

Imagine reversing the direction of reporting: allowing the user to learn more about the network, for example. That would be just one reason to put custom firmware on a SIM card. Another might be running a known-secure firmware for security-conscious users (corporations, governments, kidnapping/extortion targets, etc.).

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#52

Post by ChuckMcM »

tptacek wrote: post #3

Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…

I'm guessing its more the latter (send an error an then use the result to deduce the key) That being the case, then someone duplicating the Raspberry Pi micro cell site could passively attack any phone that came within range.

Makes you wonder if the FBI snooping cell tower already does this :-)

Makes me wish I had the burner phone concession at DefCon.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#53

Post by nicolas314 »

I have been working on OTA platforms for years with Mobile Network Operators worldwide, and I have yet to meet one that is only using DES for OTA keys. All the ones I know are using 3DES. Not sure where Nohl is getting his estimations from. Half a billion SIMs? Show me the data.

For this attack to work remotely you need to send a binary SMS and be able to read the SIM answer, which probably requires some privileged access to an operator's SS7 network. Far from obvious. Since Network Operators are in complete control of SMS traffic, blocking anything that has not been issued by their own OTA platform is just a matter of configuring a filter on an SMS-C -- if not already done.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#54

Post by mje__ »

jingo wrote: post #9

Hurray for Java applets. But seriously, there is a sunny side to this story: a user could load her own programs onto her SIM. She could gretaly extend the functionality of her phone... with programs that she trusts. Maybe even ones she wrote herself. Imagine... an open platform. Oh gosh, that would be terrible, wouldn't it? Otherwise this story highlights the concept of "minimum viable product" not in the startup wor…

I don't think this is a reasonable assessment at all. SIM manufacturers use 3DES, not DES, which - while not recommended for new systems - is still pretty damn secure.

I don't think you've really understood the complexity of the SIM - there are literally thousands and thousands of pages of specification, which means that any sim will interoperate with any phone.

A SIM is not an "MVP" by any stretch of the imagination - it costs millions of dollars to enter the market; there are stringent security and compatibility controls, and no-one will consider selling you silicon unless you're ordering millions of units per year.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#55

Post by mje__ »

nicolas314 wrote: post #53

I have been working on OTA platforms for years with Mobile Network Operators worldwide, and I have yet to meet one that is only using DES for OTA keys. All the ones I know are using 3DES. Not sure where Nohl is getting his estimations from. Half a billion SIMs? Show me the data. For this attack to work remotely you need to send a binary SMS and be able to read the SIM answer, which probably requires some privileged a…

+1; I worked on SIMs in the past, and all our customers were using 3DES. They also all required OTA messages to be signed, so I think the chances of half a billion being accurate is crazy talk

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#56

Post by fsck--off »

ScottBurson wrote: post #12
tptacek wrote: post #3

Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…

At one point he says that he thinks it will take the black hats six months or so to figure out the exploit, but then, in the passage you have quoted, he gives what sound (to my non expert ear) like fairly massive clues. Is it possible he has revealed too much?

I wouldn't have revealed that the second bug is a buffer overflow. The knowledge of the existence of a buffer overflow vulnerability on SIM cards is much more dangerous than knowledge of a buffer overflow on, say, a desktop O/S. Six months is a long time for a well funded organization to fuzz such a small piece of software.

On a different note, I find it extremely frustrating that the community still has to deal with buffer overflow bugs in 2013. Hardware bounds checking architectures have existed for half a century, and SIM cards are a perfect example of special use devices that would benefit from this.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#57

Post by revelation »

fsck--off wrote: post #56
ScottBurson wrote: post #12

Earlier quoted context omitted.

At one point he says that he thinks it will take the black hats six months or so to figure out the exploit, but then, in the passage you have quoted, he gives what sound (to my non expert ear) like fairly massive clues. Is it possible he has revealed too much?

I wouldn't have revealed that the second bug is a buffer overflow. The knowledge of the existence of a buffer overflow vulnerability on SIM cards is much more dangerous than knowledge of a buffer overflow on, say, a desktop O/S. Six months is a long time for a well funded organization to fuzz such a small piece of software. On a different note, I find it extremely frustrating that the community still has to deal with…

The buffer overflow is only accessible after you have broken the crypto stuff, no?

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#58

Post by caf »

tptacek wrote: post #3

Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…

I strongly suspect that the attack uses the known plaintext of the error message to solve directly for the DES key (which is only an effective 56 bits). I wouldn't be surprised if it used the old FIPS DES-based MAC.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#59

Post by __david__ »

pjmlp wrote: post #46
jingo wrote: post #40

Earlier quoted context omitted.

I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buyi…

Do you program your PC BIOS or firmware?

I wish! I hate my PC's bios. So many superfluous timeouts, so much waiting around (clearly braindead programming that doesn't do hardware well). A stupid text based config interface. Nothing about the BIOS is good.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#60

Post by Helianthus »

aw3c2 wrote: post #41
muyuu wrote: post #33

Earlier quoted context omitted.

I prefer to allow sites to monetise their visits within reason. If they go insane like Forbes then I just avoid them.

You can do that easily with any decent adblocker. You could disable it for all sites but Forbes if you like. Right now, you are just leeching other people's time.

In general I find it wiser to realize that we only give other people our time; they never take it.

It is very hard to take someone's time without their permission.

Now give me back the time I spent responding to you.

Post reply on HN