5 ms·
You're not sending the message to the phone, you're sending it to the sim, in the clear. Si I pop this some in my flip phone and receive the code.
by jethro_tell 10y ago
You're not sending the message to the phone, you're sending it to the sim, in the clear. Si I pop this some in my flip phone and receive the code.
- Throwaway23412 10y agoTo really make things a hassle for thieves, you could lock your SIM card through Settings, no?
- metafunctor 10y agoHmm, but you do need to know the PIN code for the SIM card in order to register on the GSM network and receive the SMS? Or am I missing something? I've changed my PIN to something quite long, so hopefully an attacker cannot just pop the SIM card out of my iPhone and use it on another device.
- lorenzhs 10y agoSIM PIN codes seem to have gone out of fashion. Neither my UK SIM nor my US SIM, both bought within the last two years, had a PIN code out of the box. Of course it's possible to set one but that's buried somewhere deep in the phone's settings, so most people probably don't set one.
- metafunctor 10y agoI didn't even know it's possible to have no PIN code on a SIM card! Operators in Finland always give you PIN cards with a preset code like 0000 or 1234, and tell you to switch it in their quick start instructions. I'm sure many people leave it as it is, though. Almost no-one seems to know you can actually set it to be more than 4 digits. This looks like an area that phone operating systems could fix – by making it easy to change your PIN, and encourage using more than 4 digits for it.
- pbhjpbhj 10y agoIs there anything to stop one from brute-forcing the PIN? It's just numbers, what's the upper limit for length. Ah, http://www.techrepublic.com/article/pro-tip-protect-your-android-sim-card-with-sim-pin-lock/ http://www.techrepublic.com/article/pro-tip-protect-your-and... suggests that you have 3 attempts, then there's a separate system (PIN Unlock Key, PUK) which a comment notes gives 10 attempts. I'm wondering if you can read the data straight off the card via some physical means, attack that to get the PIN?
- metafunctor 10y agoI'm guessing in most cases it's much easier to socially engineer the service provider customer support, rather than attack the SIM hardware.
- pbhjpbhj 10y agoYou're probably right depending on the scale you're trying to crack the cards at - went digging and found http://www.theregister.co.uk/2015/08/06/researchers_crack_sim_card_aes128_encryption_in_10_minutes_for_cloning/ http://www.theregister.co.uk/2015/08/06/researchers_crack_si... which was pertinent and interesting to me.
- 7Z7 10y agoDon't they (Apple at least) give you an option to send the code to your phone number, or to your iCloud/iMessage ID?