3 ms·

Speaking solely from a position of outside naive curiosity, how does SIM card applet development work, why/where is custom development needed, and what sort of

Speaking solely from a position of outside naive curiosity, how does SIM card applet development work, why/where is custom development needed, and what sort of security considerations (are|need to be) taken into account? For example, I can settle doctor's appointments etc with what looks like a perfectly ordinary card terminal; I swipe my healthcare card and after a long sequence of button-presses by the (very patient) receptionist I get a receipt with the Medicare logo etc on it (this is in Australia). I've always wondered if all the logic to do this is hiding in the SIM card or if the card terminal is also running specialized firmware. The only bit of related anecdata I can remember was... wait, I don't believe it but I found it, probably one of the more interesting bits of applet development out there: https://news.ycombinator.com/item?id=18140208 https://news.ycombinator.com/item?id=18140208 (the entire thread is a bit of a rabbithole too: https://news.ycombinator.com/item?id=18138328 https://news.ycombinator.com/item?id=18138328)

jfim 7y ago
You can think of SIM cards (and other chip cards, like bank cards) as a low power computer; they run their own embedded OS and can install applets. The applets basically run on a tiny restricted JVM (no GC!) that follows the JavaCard profile. SIM card applications can talk with the handset through messages, asking the handset to display menus, send SMS messages, open a browser, and more [0]. The handset also forwards certain messages to the SIM card, such as certain special SMS messages. The SIM card can actually be reprogrammed over the air (slowly) using signed SMS messages. The applications that run on the SIM card can include certain banking applications (those were popular in countries with less robust banking infrastructure and wide deployments of feature phones) or multi-carrier SIMs. With regards to your card, if it gets swiped, it probably doesn't use a chip. For the chip to work, it has to be powered, which entails either being physically inserted in a slot or being powered through induction. I should probably write a blog post about all of this stuff, it's pretty interesting. Thanks for reminding me of it! [0] https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08.17.00_60/ts_101267v081700p.pdf https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08...
- exikyut 7y ago
  I would definitely be very interested in a generalized inside view of how everything works! I stumbled on some PCMCIA-slot card readers at one point, which led me on a fun adventure discovering that I can list recent transactions out of my bank card. (Then after losing my wallet (annoying but not tragic) I discovered (to my initial confusion) that the latest model doesn't include this nice "feature". Hmph.) Learning how bankcards worked was very interesting. And - facepalm - of course the terminals I referred to are running their own firmware: Medicare cards do indeed use magnetic stripes. I'm currently headscratching over how authentication/access cards work, and the associated various industry thrashings (standardization, PGP crypto, cloneability, etc).

jfim 7y ago

You can think of SIM cards (and other chip cards, like bank cards) as a low power computer; they run their own embedded OS and can install applets. The applets basically run on a tiny restricted JVM (no GC!) that follows the JavaCard profile. SIM card applications can talk with the handset through messages, asking the handset to display menus, send SMS messages, open a browser, and more [0]. The handset also forwards certain messages to the SIM card, such as certain special SMS messages. The SIM card can actually be reprogrammed over the air (slowly) using signed SMS messages. The applications that run on the SIM card can include certain banking applications (those were popular in countries with less robust banking infrastructure and wide deployments of feature phones) or multi-carrier SIMs. With regards to your card, if it gets swiped, it probably doesn't use a chip. For the chip to work, it has to be powered, which entails either being physically inserted in a slot or being powered through induction. I should probably write a blog post about all of this stuff, it's pretty interesting. Thanks for reminding me of it! [0] https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08.17.00_60/ts_101267v081700p.pdf https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08...

exikyut 7y ago
I would definitely be very interested in a generalized inside view of how everything works! I stumbled on some PCMCIA-slot card readers at one point, which led me on a fun adventure discovering that I can list recent transactions out of my bank card. (Then after losing my wallet (annoying but not tragic) I discovered (to my initial confusion) that the latest model doesn't include this nice "feature". Hmph.) Learning how bankcards worked was very interesting. And - facepalm - of course the terminals I referred to are running their own firmware: Medicare cards do indeed use magnetic stripes. I'm currently headscratching over how authentication/access cards work, and the associated various industry thrashings (standardization, PGP crypto, cloneability, etc).