Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

forbes.com

Post reply on HN
Print view View original

91–97 of 97 posts

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#91

Post by Spooky23 »

Torgo wrote: post #64
Genmutant wrote: post #18

Earlier quoted context omitted.

How would you extend the functionality? Programming in JavaCard is really not fun (my opinion) and the space and processing power are really limited. The biggest use of it is verifying information (like pins or certificates), but what else would you do that your phone can't?

I would like to be able to take an older smartphone and use it as a smartcard-like device but with a full-fledged computer on it. For example, being able to use a Motorola Droid with a USB cable as a password manager. Keep the key secured on the SIM card. Use the touchscreen to enter the unlock password, and choose a password off a list. Send the password to a computer over USB by emulating a keyboard, or a custom dr…

Look at the OpenPGP card. You can get a smartcard reader with a PIN-entry pad for like $50, and boom, you have a secure certificate store with GPG.

GPG isn't pretty, and support lags with OS X releases but you can do alot with it.

I've been using this methodology for securing cloud backups for several years. Using tools like Duplicity, you can safely encrypt data on potentially untrusted devices or networks using a public key, and keep the private key safely stored somewhere on the smartcard.

The downsides to these sorts of approaches is that encrypting data is easy, key management for decrypting it is a pain.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#92

Post by tptacek »

ChuckMcM wrote: post #52
tptacek wrote: post #3

Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…

I'm guessing its more the latter (send an error an then use the result to deduce the key) That being the case, then someone duplicating the Raspberry Pi micro cell site could passively attack any phone that came within range. Makes you wonder if the FBI snooping cell tower already does this :-) Makes me wish I had the burner phone concession at DefCon.

Yep, that appears to be the case:

http://www.theregister.co.uk/2013/07/22/mobile_gsm_sim_card_...

An attack similar in spirit to this breaks RADIUS.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#93

Post by KMag »

rdl wrote: post #84
jingo wrote: post #61

Earlier quoted context omitted.

You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP idea. I guess I'm not communicating clearly enough. What I mean is the computer ("phone") itself, of which the smart card subsystem (e.g. SIM card system) is a part, is of inferior quality. This is only my opinion. I understand there are barriers to entry in place.…

Not recommended for new systems: Mostly because it's slow (vs. AES), and 3DES is effectively 112 bits, which is a bit weaker than you'd want for a new system deployed today (which might be in service for...20-30 years?) I don't know of any attacks on DES better than brute force and on 3DES better than brute force w/ meet-in-the-middle.

The 64-bit block length is more of a problem than the 112-bit key length.

For instance, if 3DES were used in OFB mode, one would expect on average to have a unique 64 GB keystream before entering a repeating 32 GB keystream. If the attacker is able to choose the data being encrypted, CFB could have similar limitations. With CBC mode, you'd expect only 32 GB of encrypted data before you got your first self-collision in ciphertext. CTR mode with perfectly random IVs does much better, at 64 exabytes. Even 64 EB isn't as big as it used to be, especially for a key that can't be changed.

For many uses, you'd much rather have an ideal block cipher with a 128-bit block and 112-bit keys than an ideal block cipher with a 64-bit block and 512-bit keys.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#94

Post by jingo »

nicolas314 wrote: post #87
jingo wrote: post #63

Earlier quoted context omitted.

Who says there can only be one SIM card? What if the user can have her own SIM card? Who says SIM cards are only useful with cell networks? What if the user has her own network? Is that impossible, now and forever? What if she has her own authentication and encryption needs, apart from some telecom's network? Yes, the telecom owns the card they give you. Indeed, that is their property. But they don't need to own the…

SIM cards are just your average smart cards dedicated to do mobile network stuff. You can buy your own blank smart cards from Gemalto and Oberthur if you so wish. Javacard is not Java. No OO, no classes, no GC, no floats, no strings, the only data type you can use is int16. Have fun.

I'm no authority on JavaCard, but I'd guess it's verbose like Java and expects some sort of auto-completion capable "IDE". I took a quick peek at a JavaCard standard and I could swear it said there are classes.

I don't want no stinking Java, whether it's a small subset of the language or the full blown monster. For the task at hand, I'd have more fun with assembly language than anything prefixed with "Java".

The blank smart card possibilities are enticing. If we can use our own crypto.

Doesn't OpenMoko's WikiReader run FORTH?

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#95

Post by nitrogen »

pjmlp wrote: post #65
__david__ wrote: post #59

Earlier quoted context omitted.

I wish! I hate my PC's bios. So many superfluous timeouts, so much waiting around (clearly braindead programming that doesn't do hardware well). A stupid text based config interface. Nothing about the BIOS is good.

You mean, besides providing a standard way to access hardware that ARM systems still don't have to this day?

According to https://news.ycombinator.com/item?id=6083583, Coreboot is being ported to ARM.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#96

Post by fulafel »

nicolas314 wrote: post #53

I have been working on OTA platforms for years with Mobile Network Operators worldwide, and I have yet to meet one that is only using DES for OTA keys. All the ones I know are using 3DES. Not sure where Nohl is getting his estimations from. Half a billion SIMs? Show me the data. For this attack to work remotely you need to send a binary SMS and be able to read the SIM answer, which probably requires some privileged a…

Operators sometimes think they are using the good stuff but aren't. Same thing happened with COMP128, operators were unknowingly using it for years and years after it was broken and thought fixed in new SIMs.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#97

Post by mentat »

caf wrote: post #70
caf wrote: post #58

Earlier quoted context omitted.

I strongly suspect that the attack uses the known plaintext of the error message to solve directly for the DES key (which is only an effective 56 bits). I wouldn't be surprised if it used the old FIPS DES-based MAC.

This appears to be confirmed - from https://srlabs.de/rooting-sim-cards/ : A rainbow table resolves this plaintext-signature tuple to a 56-bit DES key within two minutes on a standard computer. The cracked DES key enables an attacker to send properly signed binary SMS, which download Java applets onto the SIM. It's particularly sad that the same key is used for the MAC in both directions (network-to-SIM and SIM-to-ne…

I still haven't been able to find the particular documentation around class 2 SMS verification. Most of the things I'm finding talk about IMSI using HMAC-SHA1 for OTA validation. Is this at a lower level?

Edit: Found this: http://www.3gpp.org/ftp/tsg_sa/wg3_security/TSGS3_33_Beijing...

Post reply on HN