20 ms·
Even in relatively technical circles, like HN, many people are not aware of this and I use every opportunity I have to reiterate: A SIM card is a full blown co
by rsync 5y ago
Even in relatively technical circles, like HN, many people are not aware of this and I use every opportunity I have to reiterate:
A SIM card is a full blown computer with its own CPU and memory.
Your carrier can upload and run arbitrary code without your consent or knowledge. They can do this at any time.
This means that your "phone" is actually three different computers running in concert - the actual phone itself (iOS or Android or Symbian), the baseband processor running the baseband code, and the SIM card.
- throwaway9870 5y agoMany years ago, I worked on a serial link (think SATA, PCIe, USB 3, etc.) that had a small embedded processor to self test the link, perform analog component calibration, link equalizer calibration, and even make an eye diagram for link characterization. We could patch it with a few instructions over the JTAG port. There are way more processors in ICs than you would ever imagine.
- criddell 5y ago> Your carrier can upload and run arbitrary code without your consent or knowledge. They can do this at any time. Is that equally true of SIM cards and eSIMs? I'm in the process of setting up a new T-Mobile phone and they say they support eSIM but they are really pushing me to use a traditional SIM card. I've been wondering why they care.
- matheusmoreira 5y ago> A SIM card is a full blown computer with its own CPU and memory. Yeah. They even run Java, that was the most surprising fact. > Your carrier can upload and run arbitrary code without your consent or knowledge. They can do this at any time. So what can this code do? Can my phone be compromised somehow?
- bitexploder 5y agoMore really. Secure Enclave on iOS is its own computer as well.
- joezydeco 5y agoThe touchscreen controller has one as well. And the NAND flash parts. And the Motion coprocessor on older models.
- cma 5y agoAnd lightning -> AV cables have an arm SoC https://www.engadget.com/2013-03-02-lightning-digital-ac-adapter-arm-soc.html https://www.engadget.com/2013-03-02-lightning-digital-ac-ada...
- bitexploder 5y agoComputers everywhere. Even ikea lamps have emm now :)
- dannyw 5y agoA SIM card generally holds somewhere along 32 to 128 kb, most of which empty and used to store user contacts.
- j16sdiz 5y agoThere is nothing technically stop the carrier putting more memory on the SIM card.
- jschwartzi 5y agoIt’s even a microcontroller that emulates the original SIM, so it can have whatever specs they want.
- lxgr 5y agoWhat do you mean by "original SIM"? As far as I know, SIM cards have always been specified in functional terms, so vendors were always free to implement them whatever hardware and software they choose, as long as the result complies to ISO-7816 and the relevant ETSI/3GPP specifications. Today, it's mostly Java Card implementations, meaning that the ISA and smartphone OS/runtime is abstracted away in any case.
- tapland 5y agoThey are ordered from the manufacturer (idemia,thales/gemalto,oberture) with speficied memory size depending on what capabilities are needed. The big iffy is that manufacturers were compromised (by the US afaik) in 2015 and all cards from then or earlier should be considered compromised. Few carriers encrypted their OTA-keys before then. I know that some carriers did not send encrypted keys to manufacturers still in 2018.
- userbinator 5y agoThis is true. AFAIK SIMs are based on an ISO 7816 smartcard with some additional features, and the former are definitely in that size range.
- lxgr 5y ago
- downrightmike 5y agoDefcon talk on it: https://www.youtube.com/watch?v=31D94QOo2gY https://www.youtube.com/watch?v=31D94QOo2gY
- kevingadd 5y agoWould this mean that hypothetically, your SIM could send SMS messages even if your phone is in airplane mode?
- dboreham 5y agoNo
- striking 5y agoIt doesn't have a radio, so no.
- catlikesshrimp 5y agoUnder normal conditions: no. But a hacked phone may fake going offline and still be connected. The only way to turn off a phone for sure is to remove the battery.
- raldi 5y agoI think that’s the lesson of this article — the SIM can instruct the phone’s radio to send and receive any sort of data (including SMS) without the rest of the phone ever knowing about it.
- judge2020 5y agoMy understanding is that airplane mode does disable the radio entirely - so the SMS card trying to send messages wouldn't work unless the baseband (which, on iOS, is signed by apple and likely not an unknown binary blob to them) turned the radio on, let it connect to the network, sent the message, then turned off the radio, all without informing the OS.
- thrashh 5y agoIt’s probably a lot more than 3. As an EE, plenty of chips you can get are built-in computers. You’re not going to write code that you make your users run (what a support nightmare!). You build your chip and provide an API. And as a user, do you really want to figure how to run someone else’s code? Or do you just want a self contained unit that you slap onto your board that you just control via API? Think of chips as microservices.
- beambot 5y agoEven the microSSD card likely has an ARM core that can be hacked: https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554
- unixbane 5y ago>Think of chips as microservices. This is a good analogy, but not in your favor. This is all part of the disease of modern computing where you program against a giant machine with a giant interface and you set a few config variables and have no idea or control over how it will work and your program winds up full of unintended behavior. See: game engines, gstreamer, web frameworks, browser API, HDMI modules, terminal emulators, shells (bash, etc).
- Kye 5y agoThe flip side is that the more popular an off-the-shelf tool is, the harder it is to sneak something in. Someone somewhere is bound to notice fishy behavior at a certain scale. It lowers the skill level required to understand the choices you make and make better choices. I wouldn't even know where to begin trying to notice, much less explore, what AT&T is doing at 1111340002. The more components with a million eyes watching it, the more attention you can direct toward the rest.
- unixbane 5y agoSo you're saying having giant IP modules inside your electronics is somehow making things more secure? They certainly don't make the product any less buggy.
- mortenjorck 5y ago> A SIM card is a full blown computer with its own CPU and memory. I read something to this effect years ago and mentally filed it away as “huh, that’s interesting.” This article is the first time I’ve understood what it actually means in practice, and it’s an eye-opener.
- deleted 5y ago[deleted]
- jschwartzi 5y agoThis was driven home to me many years ago when I popped a SIM from a Mexican carrier that had an embedded Dominos Pizza app on it. Suddenly the Windows Mobile phone I was testing had a new icon on it.
- deleted 5y ago[deleted]
- eclipxe 5y agoLikely the app was not embedded in the sim. It was likely a carrier profile that the sim activated that triggered the download and install of the app.
- Espressosaurus 5y agoA distinction without difference from the end-user's perspective.
- adolph 5y agoEssentially, the OS has a backdoor to allow commands from the SIM. I wonder what other uses are there for this method?
- b112 5y agoThe more important question is, can the SIM itself be remotely updated. If so, any entity with a court order, can install anything it wants on your phone. Alternatively, any entity it wants can use the sim itself to track beyond the norm...
- lxgr 5y agoNot really updated, but new applications can be remotely installed and then interact with the baseband and (to a limited extent) the smartphone OS. It‘s not "any entity", though – the provider’s keys are needed to do this, and they can already do much of that tracking using other, network-side means. If the signing keys are compromised, though, bad things can happen: https://www.srlabs.de/bites/rooting-sim-cards https://www.srlabs.de/bites/rooting-sim-cards
- Andrex 5y agoHow susceptible is eSim? More? Less?
- kylehotchkiss 5y agoI’d like to know the same thing! Maybe the config files are more observable?
- lxgr 5y agoThey are encrypted and authenticated, since they contain the symmetric keys used to access the network. Without the keys of a legitimate eSim (i.e. those chaining up to a GSMA-approved vendor) you won‘t be able to inspect a profile even if you know the activation code.
- malshe 5y ago+1 I came to ask the same question
- oaiey 5y agoConsidering that sim cards do a lot (think roaming on cheapest partner etc) .. you can bet that eSIM are equally capable and maybe even more capable.
- lxgr 5y agoPretty much the same, I would say. An eSim is essentially a virtualization solution with each eSim profile effectively running in a container which can be set up, deactivated, and deleted only by the profile manager. The profile manager communicates with the provisioning infrastructure in an encrypted and authenticated way, so the profiles being loaded, i.e. their code (if any) and data, are as inaccessible as those on a physical SIM. While active, an eSim profile has all the same capabilities as a physical SIM, including remotely loading Java applications, issuing proactive commands to communicate with the network, registering for event notifications about location changes and incoming/outgoing calls…
- binkHN 5y ago
- StanislavPetrov 5y ago>Your carrier can upload and run arbitrary code without your consent or knowledge. They can do this at any time. Two words: Faraday bag.
- zakki 5y agoAs long as you use the phone they have the chance to access the sim card and be able to upload and run any code.
- yjftsjthsd-h 5y agoYou could also physically remove the SIM card, but there's a practical problem there; people with SIMs usually want to use them.
- pugworthy 5y agoYou'll never get the update then that it's confirming it installed. And you can't make phone calls. And you can't even use it unless you can get inside the cage. I guess it if comes with solitaire you could play that or something.
- StanislavPetrov 5y ago> And you can't even use it unless you can get inside the cage. Bag not cage (though the bag is technically a Faraday cage you aren't actually entering it as it's only big enough to hold your phone). A small faraday bag is available for ~20 on Amazon. >They can do this at any time. You can decide when you get updates and when you want to allow yourself to be tracked by whatever corporations, governments, and other actors that seek to track your movements. It's a false paradigm to suggest (like most people on this thread are doing) that you have no choice but to allow yourself to be tracked 24/7 or to go without a communication device. Keep your phone in a small shielded bag, remove it when you want to make calls, check your messages and are willing to divulge your location - its not rocket science.
- pugworthy 5y ago> Bag not cage Great, get a big bag then.
- sydthrowaway 5y agoI thought SIM was just memory (RAM/ROM). What CPU architecture does it use?!
- helsinkiandrew 5y agoThese defcon slides give a good overview of one Atmel AT90SC25672RU, 8-bit AVR, 256KB ROM, 72 KB EEPROM, 6 KB RAM, Between 20 & 30 MHz https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20presentations/DEF%20CON%2021%20-%20Koscher-Butler-The-Secret-Life-of-SIM-Cards-Updated.pdf https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20pre...
- neop1x 5y agoAlso applies to other SmartCards, they sometimes even run Java applets https://www.researchgate.net/figure/The-basic-architecture-of-Java-smart-card_fig1_287996361 https://www.researchgate.net/figure/The-basic-architecture-o...
- userbinator 5y agoThat's one example, but they are usually an 8-bit architecture with special tamper-resistance features, similar to what's found on payment cards.
- barrenko 5y agoSo next question, is a credit card chip also a computer?
- monocasa 5y agoYeah, most of this applies there too.
- PeterisP 5y agoYes, a very limited one but you can put a bunch of interesting things there, the EMV standard documents how other apps should be put there so that the customer can have a card that works both as a credit card in CC terminals and also have additional features that are accessible either in specialized terminals or custom CC terminals with explicit support enabled e.g. some loyalty card or discount scheme. Here's a list (IMHO not exhaustive) of some apps put on EMV cards https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/ https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/ - there are various identity card solutions both from governments and companies like Microsoft, there's https://en.wikipedia.org/wiki/OpenPGP_card https://en.wikipedia.org/wiki/OpenPGP_card , there's various solutions for store loyalty cards. However, I don't consider this aspect as any risk to the user, since when using the standard payment card functionality your card payments already have no privacy or security whatsoever from the issuer of your card, from a technical perspective the issuer will (by design) see and manage (authorize, revoke, etc) all the transactions and the card + terminal is just one of the channels for sending cardholder-initiated transactions to them. It would be technically appropriate to treat it not as "your card" but "issuer's card" that the cardholder uses as a token to use when the merchant communicates with the issuer about the bill.
- Marqin 5y agoAlso worth noting is that most of SIM cards are Java cards, running Java applets
- mavhc 5y agoJava Card is not very similar to Java, Javascript is more like Java than Java Card is
- Aaargh20318 5y agoTo my understanding it’s an actual subset of Java, a very limited subset, but a subset of the real Java nonetheless. Java Card applets are compiled using a real Java compiler, and then the bytecode is translated into a simplified format for running on the card.
- Silasdev 5y agoThis video from defcon gives a good overview of what Java Card applets is, the limitations and what it can do: https://www.youtube.com/watch?v=31D94QOo2gY https://www.youtube.com/watch?v=31D94QOo2gY
- fulafel 5y agoIt doesn't resemble JS. It's a JVM/Java subset. You can even write apps using the Java Servlet API with JC 3.x
- mavhc 5y agoThat's what I said, it's so limited compared to Java that saying SIM cards run "a thing like Java" is massively overstating it. It doesn't even have floats. It's a UICC not a SIM card anyway.
- lxgr 5y agoThat's only on JavaCard 3 connected, though – which is dead: https://stackoverflow.com/questions/9546812/javacard-3-in-real-world https://stackoverflow.com/questions/9546812/javacard-3-in-re... But I agree – Java to JavaScript is not the best comparison. Maybe a better one would be C programs written for a Unix system vs. C on a microcontroller: Same language; vastly different instruction set, OS and hardware capabilities and APIs available. Unlike C on microcontrollers, Java Card applications are hardware and OS agnostic, though!
- tgsovlerkhgsel 5y agoThe interesting question is: what APIs and data does the SIM card have access to?
- lxgr 5y agoThis spec is a good starting point: http://www.arib.or.jp/english/html/overview/doc/STD-T63v9_50/5_Appendix/Rel5/31/31111-5c0.pdf http://www.arib.or.jp/english/html/overview/doc/STD-T63v9_50... Generally speaking, the SIM interacts using both "proactive commands" (e.g. "send an SMS to this number) and event downloads (think "whenever the base station identifier changes, please let me know").
- lxgr 5y agoSorry, should have linked out the CAT specification instead: https://www.etsi.org/deliver/etsi_ts/102200_102299/102223/14.00.00_60/ts_102223v140000p.pdf https://www.etsi.org/deliver/etsi_ts/102200_102299/102223/14... The former just refers to the latter for event downloading.
- tgsovlerkhgsel 5y agoThanks! Out of these, the following seem most concerning/abusable: * "setting up a voice call to a number held by the UICC" - effectively allows turning the phone into a bug (although not a very stealthy one, since presumably the normal call UI would be shown). * requesting the terminal to launch the browser corresponding to a URL - triggering exploits * providing local information from the terminal to the UICC; -- depends on what exactly the card can request, doesn't look like much except location which is discussed below * running an AT command -- depends on the AT commands available, but I don't expect anything ground breaking * requesting the terminal to start an application on the terminal -- depends on what exactly can be triggered (e.g. if it can trigger an app install it'd be extremely concerning, already installed apps less so), but I think it's only launching or listing already installed carrier apps. * requesting the terminal to report geographical location information to the UICC -- fine grained tracking. This is the most concerning for me, and I wonder how/if Android shows when/if that happens (or if it is allowed). I also wonder if this can be used even when the phone is in airplane mode (to collect data and upload it later).
- Helmut10001 5y agoWhat about eSims?
- HahaReally 5y agoJust an authentication token.
- DeathArrow 5y agoEvery device can do things behind the users back. Intel Management Engine runs even when the computer is turned off, contains a full blown operating system and has access to tcp/ip stack. If privacy is a concern, no device should be trusted. By device I mean anything that contains a chip. What's worse, people might suspect their phone or PC might be leaking data to third parties, but they will be less suspecting about their TV, their fridge or their car. But since anything is becoming smart these days, one can assume that anything that runs out of electricity is a potential privacy problem.
- jiggawatts 5y agoThe NSA specifically orders motherboards without these management components. No one else can typically get them, they’re not available to people like you and me. I think some things are overblown and unjustified paranoia. Other things? Justified paranoia.
- raverbashing 5y agoThe IME is just a "smarter than needed" addition, so it's probably not too hard to take it out But every PC has a SMC which deals with things like power-on, WOL, etc
- _kbh_ 5y agoYou can remove “modules” of the management engine but it’s responsible for booting the x86 cores so you cannot entirely turn it off.
- RalfWausE 5y agoMy approach as an practicing paranoic: Use retro Computers.
- coldacid 5y agoThis is the avenue I've started taking, myself.
- kpetermeni 5y agoBesides operators, individuals can also send OTA settings like APNs, proxies, etc. from a SIM card to SIM cards on another network. To the recipient, the message looks just like the settings you get from local MNOs when you first get connected when roaming in another country.
- lxgr 5y ago> Your carrier can upload and run arbitrary code without your consent or knowledge. Well, arbitrary sandboxed code. I agree that by today‘s standards, the APIs that code has access to seem excessive and are well worth trimming down, but some of them are vital to the network‘s internal operations (like OTA updating the list of preferred roaming partners), while others enable new use cases (like M-Pesa mobile payments). For example, multi-IMSI SIM cards are, in my opinion, an ingenious solution enabling entirely new products and bringing much needed competition to an industry that had been pretty stagnant (international roaming). That would not possible without the SIM application toolkit.
- voltagex_ 5y agoCan a hobbyist mess around with this at all? Edit: yes, but I wonder how much trouble you'd get in putting this into a real phone? https://www.aliexpress.com/item/32900944064.html?spm=a2g0o.detail.1000023.2.14021441rqonZm https://www.aliexpress.com/item/32900944064.html?spm=a2g0o.d...
- lxgr 5y agoProbably none at all – such a SIM wouldn't have the required keys to even connect to any real network. SIM cards are just Java Cards, after all – the secret sauce is the proprietary software running on them (the ones you've linked seem to come with an implementation of that pre-loaded) and of course the keys they hold. Nobody keeps you from implementing all the SIM specifications in an open-source Java Card application, and I would in fact be very intrigued to see it happening ;) As far as I know, experimental/hobbyist GSM networks, like the ones running at some conferences, are still using proprietary SIM cards, and an open source implementation would be very interesting to study.
- myself248 5y agoTFA has links to the tools used. You'll find Osmocom.org an invaluable resource. I've put test SIMs in plenty of real phones, before tossing them into an RF chamber to talk to the network simulator. The real network doesn't seem to care.
- rvz 5y agoPrecisely. Can't wait to see what nefarious use cases that eSIMs can be used for then by our carrier then if your phone has one. Maybe in the future, eSIMs will be the only SIM in your phone and it can't be removed, just reprogrammed by the carrier. No thanks and no deal to eSIMs.
- ctdonath 5y agoI’ve seen that template applied to every technology now considered bog standard (utterly mundane & normal).
- wizzwizz4 5y agoAnd where has that got us? Surveillance states, the whole… *gestures at Facebook* thing, insurance companies having access to your medical records. The oceans are full of plastic!