Cybersecurity researchers have discovered a crucial vulnerability in SIM cards that can be used by the ‘bad actors’ to compromise mobile phones and spy on their activity by simply sending them an SMS.
Dublin-based firm AdaptiveMobile Security named the flaw ‘SimJacker’ and claimed that a spyware vendor has exploited the same flaw for more than two years. According to their report, the group works with government firms to track individuals. However, they did not reveal the name of the group or the individuals who have been targeted by their tactics.
The report also signifies that the attack works across all platforms and uses advanced protocols to take advantage of network security. AdaptiveMobile Security explains that during the attack, the attackers send an SMS containing a specific spyware-like code to the targeted mobile phone, which then instructs the SIM card to comprise the complete device. As a result, this enables the attackers to extract sensitive information from mobile phones, spy on the user’s activity, and even direct commands to the phone.
The same information has been disclosed to the GSM association (GSMA) and SIMalliance previously who are responsible for the security of mobile services.
AdaptiveMobile also said that the S@T browser technology is active by mobile operators in at least thirty countries. Of course, this doesn’t make them a suspect immediately but there is a good chance of numerous mobile phones being hacked through the attack.
To carry out this type of attack, the hackers leverage a GSM modem that is available for as low as $10 to send malicious messages to handsets that utilize the S@T browser functionality. The SMS is not a regular kind of message, but an advanced mode of communication called the Binary SMS. This is used to deliver rich-content such as ringtones, settings, and WAP push text messages.
The device that receives the message is unaware of the ‘threat’ in the SMS and blindly passes it on to the SIM card. As a result, the attackers are able to execute different commands to the device such as track location of the device and even get hold of its IMEI number.
During the whole scenario, the user of the mobile phone remains unaware of the happenings and continues to use the mobile as a norm.
The research company also declares that besides location tracking, the SIMjacker is capable of performing a lot of damage to the device and its user. This includes fraud, scam calls, denial of services and even spying.
As of writing this news, SIMalliance has shared updated recommendations to cellular companies to enhance their security measures in order to prevent further damage. AdaptiveMobile’s chief technology officer also suspects that the bad actors will exploit the same vulnerability in other areas of the device as well and recommends mobile carriers to take preventive measures as soon as possible.
Read next: Your phone numbers associated with Facebook might make you a victim of spam calls
Dublin-based firm AdaptiveMobile Security named the flaw ‘SimJacker’ and claimed that a spyware vendor has exploited the same flaw for more than two years. According to their report, the group works with government firms to track individuals. However, they did not reveal the name of the group or the individuals who have been targeted by their tactics.
The report also signifies that the attack works across all platforms and uses advanced protocols to take advantage of network security. AdaptiveMobile Security explains that during the attack, the attackers send an SMS containing a specific spyware-like code to the targeted mobile phone, which then instructs the SIM card to comprise the complete device. As a result, this enables the attackers to extract sensitive information from mobile phones, spy on the user’s activity, and even direct commands to the phone.
The same information has been disclosed to the GSM association (GSMA) and SIMalliance previously who are responsible for the security of mobile services.
What is S@T?
As per the report by AdaptiveMobile Security, the vulnerability is present in the S@T browser that is part of most SIM application toolkit (STK). The STK is used by most GSM mobile operators worldwide and is a common practice for accessing the internet since the early 2000s.AdaptiveMobile also said that the S@T browser technology is active by mobile operators in at least thirty countries. Of course, this doesn’t make them a suspect immediately but there is a good chance of numerous mobile phones being hacked through the attack.
How does the high-level attack work?
The security researchers further disclosed that some attacks were conducted over a hundred times during a 7-day period – indicating that they may be of a high-level nature.To carry out this type of attack, the hackers leverage a GSM modem that is available for as low as $10 to send malicious messages to handsets that utilize the S@T browser functionality. The SMS is not a regular kind of message, but an advanced mode of communication called the Binary SMS. This is used to deliver rich-content such as ringtones, settings, and WAP push text messages.
The device that receives the message is unaware of the ‘threat’ in the SMS and blindly passes it on to the SIM card. As a result, the attackers are able to execute different commands to the device such as track location of the device and even get hold of its IMEI number.
During the whole scenario, the user of the mobile phone remains unaware of the happenings and continues to use the mobile as a norm.
The research company also declares that besides location tracking, the SIMjacker is capable of performing a lot of damage to the device and its user. This includes fraud, scam calls, denial of services and even spying.
As of writing this news, SIMalliance has shared updated recommendations to cellular companies to enhance their security measures in order to prevent further damage. AdaptiveMobile’s chief technology officer also suspects that the bad actors will exploit the same vulnerability in other areas of the device as well and recommends mobile carriers to take preventive measures as soon as possible.
Read next: Your phone numbers associated with Facebook might make you a victim of spam calls
