Sim cards hacked: A single text that unlocks millions of mobiles
New vulnerability identified by mobile security experts blamed on 1970s encryption standards
Millions of mobile phones could be at risk from hackers according to new research identifying vulnerabilities in the encryption used by Sim cards. Just by sending a specially designed text, security analysts were able to remotely download malware onto handsets.
Although often thought of as just providing a mobile phone’s number, Sim cards (it stands for subscriber identity module) often store users personal data and are the mark by which carriers authenticate individual users.
“With over seven billion cards in active use, Sims may well be the most widely used security token in the world,” says German security expert Karsten Nohl, the individual responsible for uncovering the flaw.
“The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets.”
Nohl’s research covered the different systems of encryption used to secure Sim cards, with one particular standard named DES (Data Encryption Standard) identified as particularly insecure.
Dating back to the 1970s DES has long been considered insecure, with Nohl’s method allowing the encryption to be cracked “within two minutes on a standard computer”.
By sending a text containing a specially designed binary code Nohl was able to trick phones into authenticating him as their network provider.
Once this protocol had been established Nohl could then remotely download software onto the phone allowing him to send texts, access voicemail and even receive reports on the phone’s physical location.
“These capabilities alone provide plenty of potential for abuse,” said Nohl. “This allows for remote cloning of possibly millions of SIM cards including their mobile identity (IMSI, Ki) as well as payment credentials stored on the card.”
Speaking to the BBC Nohl suggested that about one in eight of all Sim cards are vulnerable to the hack, and that Africa-based users were particularly at risk. He did, however, say that network operators would be quick to secure their software.
Nohl will give full details of his method at a Black Hat security conference on July 31st but has already provided industry body GSMA with all of his research.
"Karsten's early disclosure to the GSMA has given us an opportunity for preliminary analysis,” said a GSMA spokeswoman. "It would appear that a minority of Sims produced against older standards could be vulnerable."
"There is no evidence to suggest that today's more secure Sims, which are used to support a range of advanced services, will be affected".
Life & Style blogs
Astrological signs are almost all wrong, as movement of moon and sun throws out zodiac
PTSD photo series documents what the disorder is really like – as study reveals suicides of 22 US veterans every day
The distress of some Zayn Malik fans is real, and they need support, say experts
Chair-bound workers 'should move around every hour to reduce physical and mental health risks'
The truth about student sex workers: it's far from Belle Du Jour
Ukip supporters are 55 or older, white and socially conservative, finds British Social Attitudes Report
JK Rowling responds to fan tweeting she 'can't see' Dumbledore being gay
Jeremy Clarkson sacked live: Alan Yentob 'wouldn't rule out' ex Top Gear host's BBC return
Revealed: Putin's army of pro-Kremlin bloggers
Germanwings plane crash: Co-pilot Andreas Lubitz wanted to 'do something people would remember him for'
Andreas Lubitz: Knee-jerk reaction to 9/11 enabled mass murder
- 1 The West has it totally wrong on Lee Kuan Yew
- 2 Watch: Man takes selfie every mile of 2,600 mile hike, creates amazing timelapse video
- 3 The day I starred in Only Fools and Horses
- 4 #FreeTheNipple: Women in Iceland bare breasts in solidarity with trolled student
- 5 Scientists have discovered a simple way to cook rice that dramatically cuts the calories
iJobs Gadgets & Tech
£6 per hour: Recruitment Genius: This is an exciting opportunity to join a gro...
Negotiable: Recruitment Genius: A Service Delivery Manager is required to join...
£30000 - £40000 per annum: Recruitment Genius: Our client is looking to find a...
£21000 - £23600 per annum: Recruitment Genius: An exciting opportunity to join...