4 ms·

"They run their own OS and can stay on independent of the rest of the hardware consuming very little power." It's worse - there's a second, independent compute

by rsync 6y ago

"They run their own OS and can stay on independent of the rest of the hardware consuming very little power." It's worse - there's a second, independent computer inside your phone that you have no control over: the SIM card. The SIM is a standalone computer with its own processor and memory which your carrier can communicate with and upload programs to run on it without your knowledge ("OTA updates", etc.) https://osmocom.org/projects/cellular-infrastructure/wiki/SIM_Cards https://osmocom.org/projects/cellular-infrastructure/wiki/SI... ftp://www.3gpp.org/tsg_sa/WG3_Security/TSGS3_30_Povoa/Docs/PDF/S3-030534.pdf

dcposch 6y ago
Do esims fix this problem? Increasingly the norm, no physical sim card at all.
- bmcahren 6y ago
  No https://www.hologram.io/blog/what-is-an-esim-and-how-is-it-used#:~:text=The%20eSIM%20(embedded%20SIM)%20is,a%20board%20inside%20a%20device.&text=The%20eUICC%20is%20an%20embedded,profiles%20to%20their%20devices%20remotely https://www.hologram.io/blog/what-is-an-esim-and-how-is-it-u.... > The eSIM (embedded SIM) is a small chip soldered directly to a board inside a device
  - a1369209993 6y ago
    TBF, eSIM as you describe it is not "no physical sim card at all", so they might be confusing it with something else. (I assumed, based on their phrasing, that they were talking about a virtuallized SIM card running in a (hopefully suitably locked-down) VM.)
de6u99er 6y ago
Yeah, that's nuts and frightening.
adamnew123456 6y ago
Seeing the ShadySIM project mentioned on that page reminded me of this DEFCON talk, which talks about some of the capabilities of the SIM OS (some of them run Java!) and what power they grant you over phones if you have control over the underlying cell network (legitimately or otherwise). https://www.youtube.com/watch?v=31D94QOo2gY https://www.youtube.com/watch?v=31D94QOo2gY
- puzzlingcaptcha 6y ago
  I think they run Java Card, which is not quite the same thing https://en.wikipedia.org/wiki/Java_Card https://en.wikipedia.org/wiki/Java_Card

by rsync 6y ago

dcposch 6y ago

Do esims fix this problem? Increasingly the norm, no physical sim card at all.

bmcahren 6y ago
No https://www.hologram.io/blog/what-is-an-esim-and-how-is-it-used#:~:text=The%20eSIM%20(embedded%20SIM)%20is,a%20board%20inside%20a%20device.&text=The%20eUICC%20is%20an%20embedded,profiles%20to%20their%20devices%20remotely https://www.hologram.io/blog/what-is-an-esim-and-how-is-it-u.... > The eSIM (embedded SIM) is a small chip soldered directly to a board inside a device
- a1369209993 6y ago
  TBF, eSIM as you describe it is not "no physical sim card at all", so they might be confusing it with something else. (I assumed, based on their phrasing, that they were talking about a virtuallized SIM card running in a (hopefully suitably locked-down) VM.)

de6u99er 6y ago

Yeah, that's nuts and frightening.

adamnew123456 6y ago

Seeing the ShadySIM project mentioned on that page reminded me of this DEFCON talk, which talks about some of the capabilities of the SIM OS (some of them run Java!) and what power they grant you over phones if you have control over the underlying cell network (legitimately or otherwise). https://www.youtube.com/watch?v=31D94QOo2gY https://www.youtube.com/watch?v=31D94QOo2gY

puzzlingcaptcha 6y ago
I think they run Java Card, which is not quite the same thing https://en.wikipedia.org/wiki/Java_Card https://en.wikipedia.org/wiki/Java_Card