SIM Vulnerability leads to information disclosure via malicious SMS • Hacker News Board

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#31

Post by 0b0001 » Thu, Sep 12, 2019, 6:48 PM UTC

zenexer wrote: post #27

akersten wrote: post #17

Earlier quoted context omitted.

Why in the world is this API surface even available, and why aren't Google / Apple / handset manufacturers scrambling to patch this?

Google and Apple can't do anything to mitigate this. Edit: The following is incorrect. SIM cards are self-contained computers. Among other things, they're responsible for encrypting and decrypting communications between your phone and your carrier. This means that a SIM card will see the contents of a message before your OS or other hardware in your phone does. These exploits should work just as well against "dumb" p…

That's not the case. SIM cards hold the permanent key for authentication and perform key derivation. Mobile data doesn't pass the SIM card; it does not perform the encryption and decryption.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#32

Post by archi42 » Thu, Sep 12, 2019, 6:52 PM UTC

That SIMs are expoitable was to be expected, and is another nail in the coffin of SMS 2FA. I'm just worried about the isolation between SIM and CPU - delivering a crypto locker via SMS would be an impressive feat, but wreak absolute havoc.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#33

Post by LinuxBender » Thu, Sep 12, 2019, 7:19 PM UTC

johnisgood wrote: post #25

So how do I know if someone sent me a malicious message? Does this affect GSM only, or WCDMA, too, or does it even matter?

Unless firmware has changed dramatically, then unless you have the engineering firmware and if they have an SS7 link, you won't even know you received anything until they choose to do something intrusive.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#34

Post by zenexer » Thu, Sep 12, 2019, 7:42 PM UTC

0b0001 wrote: post #31

zenexer wrote: post #27

Earlier quoted context omitted.

Google and Apple can't do anything to mitigate this. Edit: The following is incorrect. SIM cards are self-contained computers. Among other things, they're responsible for encrypting and decrypting communications between your phone and your carrier. This means that a SIM card will see the contents of a message before your OS or other hardware in your phone does. These exploits should work just as well against "dumb" p…

That's not the case. SIM cards hold the permanent key for authentication and perform key derivation. Mobile data doesn't pass the SIM card; it does not perform the encryption and decryption.

Good point--I tend to forget that. The rather vague article seems to indicate the actual SMS content is being sent to the SIM, though. Why is that?

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#35

Post by mkr-hn » Thu, Sep 12, 2019, 8:21 PM UTC

raintrees wrote: post #24

I obtained a low-tech phone for SMS and phone calls. I then turned my Samsung Android back into a PDA by removing the SIM chip. I explain to my clients when they express astonishment at my low-tech phone that I am protecting their security, as I have the PDA sync with my Exchange Server, where I keep sensitive info to provide them support and I do not allow the low-tech phone to access my Exchange Server. I also tell…

You're still at risk of baseband exploits, but those are less common.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#36

Post by eternalny1 » Thu, Sep 12, 2019, 8:28 PM UTC

This whole site reeks of a security company trying to cash in on a previously reported issue.

The scarier they can make it, the more $$ ... they even have the domain name.

2011 ... http://blog.m-sec.net/2011/sim-toolkit-attack/

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#37

Post by johnisgood » Thu, Sep 12, 2019, 8:34 PM UTC

pingec wrote: post #14

Does this break SMS 2FA?

SMS 2FA can bite you in the ass. Since the phone is with you all the time, there is a higher chance of something happening to it that makes it damaged enough for you to not be able to use it. Now, you are in possession of the password, the IP is the same as the one you signed up with, you have access to your e-mail, but you still cannot access your account. You contact support, you tell them the same thing. They will tell you they cannot help you because "security", and do nothing. You are now unable to access your account, most likely forever.

This happened to me. Any experiences or thoughts? Is it worth the risk? How do you prevent this scenario besides not using 2FA from happening? Personally I would choose to not use it though.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#38

Post by garaetjjte » Thu, Sep 12, 2019, 9:05 PM UTC

mercora wrote: post #26

farisjarrah wrote: post #19

Earlier quoted context omitted.

Seems like a highjack may be possible actually... Here is a list of other things they listed they can do with the simjacker exploit that goes beyond simple data exfiltration: > PLAY TONE > SEND SHORT MESSAGE > SET UP CALL > SEND USSD > SEND SS > PROVIDE LOCAL INFORMATION > Location Information, IMEI, Battery, Network, Language, etc > POWER OFF CARD > RUN AT COMMAND > SEND DTMF COMMAND > LAUNCH BROWSER > OPEN CHANNEL…

running arbitrary AT commands gives lots of potential... i wish they would provide (a lot) more details about their claims :(

When I recently watched this talk, https://www.youtube.com/watch?v=31D94QOo2gY, I wondered about that, that is if malicious STK app from network operator could execute AT commands on phone (and compromise device using commands from https://www.usenix.org/node/217625).

But from what I gathered from cursory search, RUN AT COMMAND isn't supported by most devices. (ETSI TS 102 223 states "This clause applies if class "b" is supported by the terminal and enabled by the subscriber through the terminal. ")

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#39

Post by [deleted] » Thu, Sep 12, 2019, 9:37 PM UTC

johnisgood wrote: post #37

pingec wrote: post #14

Does this break SMS 2FA?

SMS 2FA can bite you in the ass. Since the phone is with you all the time, there is a higher chance of something happening to it that makes it damaged enough for you to not be able to use it. Now, you are in possession of the password, the IP is the same as the one you signed up with, you have access to your e-mail, but you still cannot access your account. You contact support, you tell them the same thing. They will…

[deleted]

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#40

Post by tinus_hn » Thu, Sep 12, 2019, 9:55 PM UTC

segfaultbuserr wrote: post #12

Unsurprising, and I don't think it's a backdoor like ME, but just plain incompetence (or malpractice). It's only a matter of time and location when a exploit like this is discovered. I highly recommend this hilarious paper, Fuzzing the GSM Protocol ( https://www.ru.nl/publish/pages/769526/scriptie-brinio-final... ). By feeding the phones with random GSM data with a Software-Defined Radio, it showed most dumb and smar…

> no isolation between the baseband processor and the main system.

There’s barely any connection between the baseband processor and the application processor on a smartphone.

Notice for all your examples, it’s denial of service for the functions of the baseband processor by a bug in the code run by the baseband processor. It doesn’t get access to the data available to the application processor. Except for the oldschool feature phones, where there is no separate application processor so a bug in the software run by its processor can cause the phone to reboot or reveal the memory accessible by that processor.