Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM Vulnerability leads to information disclosure via malicious SMS

simjacker.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#51

Post by tinus_hn »

effie wrote: post #50
tinus_hn wrote: post #46

Earlier quoted context omitted.

Which has absolutely nothing to do with isolation. The two processors are not ‘interconnected’, they are separate and can only communicate through defined interfaces. That’s isolation. If there is a backdoor on one processor that grants access to the other the problem is that backdoor and not some nebulous interconnection. If your computer runs a backdoor that grants access to anyone who can access it over the networ…

Well they do not read directly each other's memory, but still the baseband processor is electrically connected and so can exfiltrate data from or manipulate the application processor. On the other hand, if you have two phones glued together, one for voice/sms, one for internet access via independent network without microphone, the first one cannot exfiltrate/manipulate the second one and the second one cannot record…

No, because there is a connection between both of these devices and all other devices on the phone network and the internet. It’s just bullshit and on top of that overcomplicated nonsense no one is going to use.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#52

Post by effie »

tinus_hn wrote: post #51
effie wrote: post #50

Earlier quoted context omitted.

Well they do not read directly each other's memory, but still the baseband processor is electrically connected and so can exfiltrate data from or manipulate the application processor. On the other hand, if you have two phones glued together, one for voice/sms, one for internet access via independent network without microphone, the first one cannot exfiltrate/manipulate the second one and the second one cannot record…

No, because there is a connection between both of these devices and all other devices on the phone network and the internet. It’s just bullshit and on top of that overcomplicated nonsense no one is going to use.

I'm talking about physically isolated computers connected to separate networks, not connected to the same untrusted network. The meaning of the isolation is that while operator of each network has one class of data (voice/sms vs. the internet), neither has both of them.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#53

Post by raintrees »

haydn3 wrote: post #47
raintrees wrote: post #24

I obtained a low-tech phone for SMS and phone calls. I then turned my Samsung Android back into a PDA by removing the SIM chip. I explain to my clients when they express astonishment at my low-tech phone that I am protecting their security, as I have the PDA sync with my Exchange Server, where I keep sensitive info to provide them support and I do not allow the low-tech phone to access my Exchange Server. I also tell…

Isn't connecting to Microsoft being online? Unless you're running exchange on an OFFLINE, LOCAL NETWORK your outgoing traffic to Google will contain metadata and you're not stopping anything by removing the SIM card other than inconveniencing yourself. It still calls home, it's still online. Lock down Microsoft and Google's IPs permanently, outbound, on all networks you use or this won't work.

I run my own servers, so no, no connection to Microsoft except for updates.

Google is not involved, my DNS is my own server with the base servers as their lookups, not Google DNS. My PDA only connects over WiFi, since there is no SIM.

So unless Google is purposely getting involved with a WiFi connection to a local, private server, they are not involved, either.

I stripped off all of the other apps as well.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#54

Post by raintrees »

raintrees wrote: post #53
haydn3 wrote: post #47

Earlier quoted context omitted.

Isn't connecting to Microsoft being online? Unless you're running exchange on an OFFLINE, LOCAL NETWORK your outgoing traffic to Google will contain metadata and you're not stopping anything by removing the SIM card other than inconveniencing yourself. It still calls home, it's still online. Lock down Microsoft and Google's IPs permanently, outbound, on all networks you use or this won't work.

I run my own servers, so no, no connection to Microsoft except for updates. Google is not involved, my DNS is my own server with the base servers as their lookups, not Google DNS. My PDA only connects over WiFi, since there is no SIM. So unless Google is purposely getting involved with a WiFi connection to a local, private server, they are not involved, either. I stripped off all of the other apps as well.

To further clarify, I have been a dev for 30 years, mostly the Microsoft arena, and more recently, Linux. I also run a service business for small business clients, and eat my own dog food. In so doing, I have off and on again been an MSDN member, which included licenses (for development) of the Microsoft technology stack, which until recently included their Small Business Server product. That is how I got my start.

I have run my own Exchange Server(s) since 1995. And DNS, DHCP, etc.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#56

Post by tiborsaas »

johnisgood wrote: post #37
pingec wrote: post #14

Does this break SMS 2FA?

SMS 2FA can bite you in the ass. Since the phone is with you all the time, there is a higher chance of something happening to it that makes it damaged enough for you to not be able to use it. Now, you are in possession of the password, the IP is the same as the one you signed up with, you have access to your e-mail, but you still cannot access your account. You contact support, you tell them the same thing. They will…

> You are now unable to access your account, most likely forever.

Nah, you just have to wait till you order a new SIM from your carrier.

Some companies also offer offline, 1 time passwords. 2FA SMS can be a pain in such cases, but it's not that bad.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#57

Post by johnisgood »

tiborsaas wrote: post #56
johnisgood wrote: post #37

Earlier quoted context omitted.

SMS 2FA can bite you in the ass. Since the phone is with you all the time, there is a higher chance of something happening to it that makes it damaged enough for you to not be able to use it. Now, you are in possession of the password, the IP is the same as the one you signed up with, you have access to your e-mail, but you still cannot access your account. You contact support, you tell them the same thing. They will…

> You are now unable to access your account, most likely forever. Nah, you just have to wait till you order a new SIM from your carrier. Some companies also offer offline, 1 time passwords. 2FA SMS can be a pain in such cases, but it's not that bad.

Oh, I just noticed I typed "SMS 2FA". My bad! In that case, you are correct, but in my particular case I lost all data related to Google Authenticator, including the shared secret. Customer service refused to help, despite having had the same phone number, because it was not SMS-based 2FA. Sorry! I should not get on HN when so mentally exhausted. :(

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#58

Post by tiborsaas »

johnisgood wrote: post #57
tiborsaas wrote: post #56

Earlier quoted context omitted.

> You are now unable to access your account, most likely forever. Nah, you just have to wait till you order a new SIM from your carrier. Some companies also offer offline, 1 time passwords. 2FA SMS can be a pain in such cases, but it's not that bad.

Oh, I just noticed I typed " SMS 2FA". My bad! In that case, you are correct, but in my particular case I lost all data related to Google Authenticator, including the shared secret. Customer service refused to help, despite having had the same phone number, because it was not SMS-based 2FA. Sorry! I should not get on HN when so mentally exhausted. :(

We use Google Authenticator too at work, I had to go to IT in person to get a new one when I got a new phone. It makes sense to refuse to give you based on solely the phone number. However, there should be a process to renew these credentials, phones die too.

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#59

Post by GMLOOKO »

cypres wrote: post #11

Title is misleading. No "hijacking" is taking place, they are obtaining the Cell ID (approximate location) and IMEI info from the phone, by sending it a malicious SMS containing SIM card instructions. Details; https://www.adaptivemobile.com/blog/simjacker-next-generatio... A better title IMHO; SIM Vulnerability leads to information disclosure via malicious SMS.

A

Re: SIM Vulnerability leads to information disclosure via malicious SMS

#60

Post by GMLOOKO »

zenexer wrote: post #27
akersten wrote: post #17

Earlier quoted context omitted.

Why in the world is this API surface even available, and why aren't Google / Apple / handset manufacturers scrambling to patch this?

Google and Apple can't do anything to mitigate this. Edit: The following is incorrect. SIM cards are self-contained computers. Among other things, they're responsible for encrypting and decrypting communications between your phone and your carrier. This means that a SIM card will see the contents of a message before your OS or other hardware in your phone does. These exploits should work just as well against "dumb" p…

A
Post reply on HN