4 ms·

I thought SIM was just memory (RAM/ROM). What CPU architecture does it use?!

helsinkiandrew 5y ago
These defcon slides give a good overview of one Atmel AT90SC25672RU, 8-bit AVR, 256KB ROM, 72 KB EEPROM, 6 KB RAM, Between 20 & 30 MHz https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20presentations/DEF%20CON%2021%20-%20Koscher-Butler-The-Secret-Life-of-SIM-Cards-Updated.pdf https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20pre...
- neop1x 5y ago
  Also applies to other SmartCards, they sometimes even run Java applets https://www.researchgate.net/figure/The-basic-architecture-of-Java-smart-card_fig1_287996361 https://www.researchgate.net/figure/The-basic-architecture-o...
- userbinator 5y ago
  That's one example, but they are usually an 8-bit architecture with special tamper-resistance features, similar to what's found on payment cards.
  - barrenko 5y ago
    So next question, is a credit card chip also a computer?
    - monocasa 5y ago
      Yeah, most of this applies there too.
    - PeterisP 5y ago
      Yes, a very limited one but you can put a bunch of interesting things there, the EMV standard documents how other apps should be put there so that the customer can have a card that works both as a credit card in CC terminals and also have additional features that are accessible either in specialized terminals or custom CC terminals with explicit support enabled e.g. some loyalty card or discount scheme. Here's a list (IMHO not exhaustive) of some apps put on EMV cards https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/ https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/ - there are various identity card solutions both from governments and companies like Microsoft, there's https://en.wikipedia.org/wiki/OpenPGP_card https://en.wikipedia.org/wiki/OpenPGP_card , there's various solutions for store loyalty cards. However, I don't consider this aspect as any risk to the user, since when using the standard payment card functionality your card payments already have no privacy or security whatsoever from the issuer of your card, from a technical perspective the issuer will (by design) see and manage (authorize, revoke, etc) all the transactions and the card + terminal is just one of the channels for sending cardholder-initiated transactions to them. It would be technically appropriate to treat it not as "your card" but "issuer's card" that the cardholder uses as a token to use when the merchant communicates with the issuer about the bill.
    - fulafel 5y ago
      A good rule of thumb is that nothing is just memory wothout a processor. Including stuff that is sold as jyst memory (eg SD cards).
  - lxgr 5y ago
    That‘s definitely still true for many existing cards, but newer ones are switching to ARM-M based architectures, as far as I know.
- kreeben 5y ago
  My SIM card has 30x more horsepower than my C64. Mind blown.
  - sydthrowaway 5y ago
    Thats a joke..

These defcon slides give a good overview of one Atmel AT90SC25672RU, 8-bit AVR, 256KB ROM, 72 KB EEPROM, 6 KB RAM, Between 20 & 30 MHz https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20presentations/DEF%20CON%2021%20-%20Koscher-Butler-The-Secret-Life-of-SIM-Cards-Updated.pdf https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20pre...

neop1x 5y ago
Also applies to other SmartCards, they sometimes even run Java applets https://www.researchgate.net/figure/The-basic-architecture-of-Java-smart-card_fig1_287996361 https://www.researchgate.net/figure/The-basic-architecture-o...
userbinator 5y ago
That's one example, but they are usually an 8-bit architecture with special tamper-resistance features, similar to what's found on payment cards.
- barrenko 5y ago
  So next question, is a credit card chip also a computer?
  - monocasa 5y ago
    Yeah, most of this applies there too.
  - PeterisP 5y ago
    Yes, a very limited one but you can put a bunch of interesting things there, the EMV standard documents how other apps should be put there so that the customer can have a card that works both as a credit card in CC terminals and also have additional features that are accessible either in specialized terminals or custom CC terminals with explicit support enabled e.g. some loyalty card or discount scheme. Here's a list (IMHO not exhaustive) of some apps put on EMV cards https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/ https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/ - there are various identity card solutions both from governments and companies like Microsoft, there's https://en.wikipedia.org/wiki/OpenPGP_card https://en.wikipedia.org/wiki/OpenPGP_card , there's various solutions for store loyalty cards. However, I don't consider this aspect as any risk to the user, since when using the standard payment card functionality your card payments already have no privacy or security whatsoever from the issuer of your card, from a technical perspective the issuer will (by design) see and manage (authorize, revoke, etc) all the transactions and the card + terminal is just one of the channels for sending cardholder-initiated transactions to them. It would be technically appropriate to treat it not as "your card" but "issuer's card" that the cardholder uses as a token to use when the merchant communicates with the issuer about the bill.
  - fulafel 5y ago
    A good rule of thumb is that nothing is just memory wothout a processor. Including stuff that is sold as jyst memory (eg SD cards).
- lxgr 5y ago
  That‘s definitely still true for many existing cards, but newer ones are switching to ARM-M based architectures, as far as I know.
kreeben 5y ago
My SIM card has 30x more horsepower than my C64. Mind blown.
- sydthrowaway 5y ago
  Thats a joke..