Why don't you get an ad blocker - e.g. Ad Muncher is a great one.
I prefer to allow sites to monetise their visits within reason. If they go insane like Forbes then I just avoid them.
I prefer to save advertisers money by blocking ads which I am not clikcing anyway.
Truth to be told, I did not bother to install ad blocker, but would feel no guilt if I did, for the reason above.
vaguely related question ... is it safe to insert an arbitrary sim card in a phone ? i want to try out some of the gsm mvnos in the states (eg airvoice, ptel and h2o). an at&t or comcast or microsoft has a reputation that's worth billions, so i "trust" them to only be semi-evil and at least semi-responsible. i don't know much of these mvno companies, but assume they're living on the margins and don't have too much to…
I can't guarantee there's no risk. But in Europe there are hundreds of virtual network operators - dozens in most countries - and I've never heard of any cases of operators (or anyone working for them) "messing with" sim cards, and people here newer think twice about switching sims.
I don't think this is a reasonable assessment at all. SIM manufacturers use 3DES, not DES, which - while not recommended for new systems - is still pretty damn secure. I don't think you've really understood the complexity of the SIM - there are literally thousands and thousands of pages of specification, which means that any sim will interoperate with any phone. A SIM is not an "MVP" by any stretch of the imagination…
You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP idea. I guess I'm not communicating clearly enough. What I mean is the computer ("phone") itself, of which the smart card subsystem (e.g. SIM card system) is a part, is of inferior quality. This is only my opinion. I understand there are barriers to entry in place.…
Not recommended for new systems: Mostly because it's slow (vs. AES), and 3DES is effectively 112 bits, which is a bit weaker than you'd want for a new system deployed today (which might be in service for...20-30 years?)
I don't know of any attacks on DES better than brute force and on 3DES better than brute force w/ meet-in-the-middle.
I have been working on OTA platforms for years with Mobile Network Operators worldwide, and I have yet to meet one that is only using DES for OTA keys. All the ones I know are using 3DES. Not sure where Nohl is getting his estimations from. Half a billion SIMs? Show me the data. For this attack to work remotely you need to send a binary SMS and be able to read the SIM answer, which probably requires some privileged a…
Would (root) access to a microcell work?
Good question. SMS are transmitted over the NAS layer of the 3GPP stack, which terminates beyond the cell (NB/eNB). There is NAS level security but I don't know if it's end-to-end or only over the air link. Hopefully it's the former but one should dig the specs at 3gpp.org to confirm.
vaguely related question ... is it safe to insert an arbitrary sim card in a phone ? i want to try out some of the gsm mvnos in the states (eg airvoice, ptel and h2o). an at&t or comcast or microsoft has a reputation that's worth billions, so i "trust" them to only be semi-evil and at least semi-responsible. i don't know much of these mvno companies, but assume they're living on the margins and don't have too much to…
It won't harm the phone, but it won't work either. You can find generic SIM card that you can program yourself, but that's not what is used in a phone. Your phone will only work with a SIM card embedding specific applications called SIM for 2G (that's where the name comes from as you see, the physical thingy is named UICC) or USIM for 3G/LTE. And this application embeds security components that will authenticate the card to the operator, either as a direct customer or as a customer of another telco which is a roaming partner. If this authentication fails, you'll have no access. If there's no valid SIM or USIM application your phone modem won't do anything with the card.
You do not own the SIM card, it remains full property of your network operator. As such, they have a right to keep you off-limits. FYI: the main Javacard applet on a SIM card is the GSM applet, the one you use to authenticate against your network. Other applets are useful for network operators: IMEI tracking sends them your phone ID to help them configure it correctly -- it is also used to track stolen phones. Anothe…
Who says there can only be one SIM card? What if the user can have her own SIM card? Who says SIM cards are only useful with cell networks? What if the user has her own network? Is that impossible, now and forever? What if she has her own authentication and encryption needs, apart from some telecom's network? Yes, the telecom owns the card they give you. Indeed, that is their property. But they don't need to own the…
SIM cards are just your average smart cards dedicated to do mobile network stuff. You can buy your own blank smart cards from Gemalto and Oberthur if you so wish.
Javacard is not Java. No OO, no classes, no GC, no floats, no strings, the only data type you can use is int16. Have fun.
You do not own the SIM card, it remains full property of your network operator. As such, they have a right to keep you off-limits. FYI: the main Javacard applet on a SIM card is the GSM applet, the one you use to authenticate against your network. Other applets are useful for network operators: IMEI tracking sends them your phone ID to help them configure it correctly -- it is also used to track stolen phones. Anothe…
Imagine reversing the direction of reporting: allowing the user to learn more about the network, for example. That would be just one reason to put custom firmware on a SIM card. Another might be running a known-secure firmware for security-conscious users (corporations, governments, kidnapping/extortion targets, etc.).
SIM cards don't know anything about the network they are running on, this all happens inside your terminal. They hold an IMSI (=contract #), a set of private keys, and some utility applets. SIM cards don't even know their own phone number.
As for running a known-secure firmware: in the end a SIM card only authenticate you against a Mobile Operator with a pre-shared key. If you believe your SIM is running a non-secure firmware, how can you trust your Mobile Network Operator not to do fancy stuff on their network behind your back?
Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…
In my company I started to issue smart cards instead of simple magnetic cards, because the tech is so hard to implement I started to question if this was a mild case of security through obscurity. I really hope this isn't the case, many banks store passwords in those cards, including us. This password cannot be easily transported back to our servers.
Anyway, there is something missing, as a security measure SIM cards should burn out if you keep calling it.