4 ms·

Let's assume I have the following philosophy: My phone, my sim or esim, and anything else which I have purchased and is in my possession, belongs to me. Being

Let's assume I have the following philosophy: My phone, my sim or esim, and anything else which I have purchased and is in my possession, belongs to me. Being able to retrieve keys to things I own, and do whatever I want with them, seems fine. If the key to my car says "do not duplicate", I should be nonetheless able to duplicate it, because I own the car and the key. If I want to run my same profile or eSIM on multiple devices, I get that the cell company doesn't like that, but I do, so I wouldn't consider that a harm to me. Given that assumption, this vulnerability/jailbreak/rooting of something I own seems less significant to me. I think, however, that I may be misunderstanding the attack. Is this possible to perform against somebody else for whom I will never have physical possession of the phone? Or for someone else to perform it against me, without ever having physical possession of my phone? It sounded like maybe a test profile was left enabled, which allows anyone to send an SMS-PP message to any phone, telling it to install an applet which compromises the phone/eUICC/eSIM's keys. Did I follow that right?

lxgr 1y ago
> Let's assume I have the philosophy that my phone, my sim or esim, and anything else which I have purchased and is in my possession, belongs to me. Then you can't use eSIMs as specified. eUICCs are an implementation of trusted computing. > I think I may be misunderstanding the attack, though. Is this possible to perform against somebody else for whom I will never have physical possession of the phone? Or for someone else to perform it against me, without ever having physical possession of my phone? In a non-broken eSIM security architecture, eSIM profiles are singletons, i.e. they can only be installed on any given eUICC at one time. At install time, the SM-DP decrements the logical "remaining installs" counter from 1 to 0; at uninstall time, it goes back up to 1. This of course only works if the eUICC's assertion of "I deleted eSIM profile x" is trustworthy, hence it requires trusted computing. A different security architecture not relying on trusted computing is of course possible to imagine, but that's not what current networks assume.
- ImPostingOnHN 1y ago
  > Then you can't use eSIMs as specified. Could you elaborate here, please? I am kind of ignorant on this topic. Using an exploit to root my phone results in not using the phone "as specified", but it still works, and it's okay with me, because I own it. It sounded like the concerns you had were ones the network operator should be concerned with. Suppose I don't care about their concerns unless they result in my stuff being compromised*. Are you saying that it breaks the security in a way that someone who doesn't own my phone and doesn't have physical access to my phone can compromise my phone and/or my eSIM? * - for the purposes of simplifying discussion, I'm dismissing the possibility that the network operator throws up their hands and entirely stops using/allowing eSIMs because they can't control everything
  - lxgr 1y ago
    The eSIM lives in dedicated, tamper-proof hardware inside your phone, separate from the application processor OS (which would be the domain of rooting) or often even the baseband. Under the eSIM security model, it holds keys that the device owner is not supposed to be able to extract, not even when they're willing to physically dismantle the chip holding it. > Are you saying that it breaks the security in a way that someone who doesn't own my phone and doesn't have physical access to my phone can compromise my phone and/or my eSIM? Yes, it does: Currently, providers assume that any eSIM honors the "singleton contract" described above. One that does not, e.g. one simulated in software using keys extracted from a physical trusted eUICC, could be used to mount the following attack: 1. Intercept the eSIM setup QR code (which contains two things: the URL of the SM-DP and a secret profile identifier) 2. Install the eSIM profile on their "software eSIM". 3. Report the eSIM as successfully deleted to the SM-DP, which now considers it available for installs again. 4. You, the legitimate owner of the eSIM, now install it on your unmodified eUICC in your phone and go about your day. 5. One day, ideally when your legitimate SIM is offline, the attacker inserts their eSIM into a phone and intercepts phone calls and SMS to your number, initiates expensive toll calls etc. One solution here would be to never allow re-installs of the same eSIM profile, which some providers already do, but I personally don't like eSIM profiles managed that way, as it requires me to interact with carrier support and often even pay money just to transfer an eSIM to a new device.
miki123211 1y ago
Theoretically, if one of the carriers you were using were to be hacked, the attackers could extract all your keys, including for other carrier profiles. It's an interesting attack vector for intelligence agencies. Imagine you're going to China and install a Chinese eSim profile as secondary to get cheaper data. The Chinese govt, in collaboration with the carrier, could then use that profile to dump your American AT&T keys. In the telecom world, there's no forward secrecy (there can't be with symmetric crypto, which is what it's all based on), so such an attack would let the Chinese intercept all your communications.
- ImPostingOnHN 1y ago
  Thank you, your explanation helped me understand that the profile can itself be an application (and thus can be an exploit), and that different profiles/applications are not isolated from each other. I will be careful installing profiles from untrusted sources on my phone*. Is there a remote attack vector against my phone/eSIM which doesn't require first compromising the network service provider? Not that I'm dismissing other vectors as unimportant, just trying to learn more. * - I do realize that a network operator viewed as "trusted" may be untrusted under the right circumstances, like sufficient pressure from sufficiently official or powerful actors.
- lxgr 1y ago
  That would indeed be catastrophic, but from the attack as demonstrated, I don't think we can conclude that that's possible. As I understand it, the attack as demonstrated is extracting the eUICC provisioning private key from the context of a SAT applet, but what you're describing would be extracting the keys of eSIM profile A from the context of eSIM profile B of an unrelated carrier. It would be great to know whether the researchers have looked into that, as it sounds like a much bigger problem if possible.
  - VogonPoetry 1y ago
    There are three things in the report that make me believe that it would be possible to get the secrets from eSim profile B from a compromised eSIM profile A if they are both installed. Under "Notes" it says... The hack proves no security / isolation for the eSIM profile and Java apps (no security for eUICC memory content). - app isolation is broken Under "The warning call for mobile phone vendors"... Target eUICC chips may run some sensitive applications (digital wallets / payment, digital car keys, transportation cards, access / identification cards, etc.). In case of a successful eSIM compromise, the security / credibility of such apps may be affected. - perhaps code for we already know this is possible, not talking about it yet... And towards the end, under "Some recommendations"... always assume your apps, their logic, associated secrets and/or some eSIM content could be revealed (one compromised eUICC identity can be used to download and peek into eSIM of any MNO) - directly talks about other secret extraction

lxgr 1y ago

> Let's assume I have the philosophy that my phone, my sim or esim, and anything else which I have purchased and is in my possession, belongs to me. Then you can't use eSIMs as specified. eUICCs are an implementation of trusted computing. > I think I may be misunderstanding the attack, though. Is this possible to perform against somebody else for whom I will never have physical possession of the phone? Or for someone else to perform it against me, without ever having physical possession of my phone? In a non-broken eSIM security architecture, eSIM profiles are singletons, i.e. they can only be installed on any given eUICC at one time. At install time, the SM-DP decrements the logical "remaining installs" counter from 1 to 0; at uninstall time, it goes back up to 1. This of course only works if the eUICC's assertion of "I deleted eSIM profile x" is trustworthy, hence it requires trusted computing. A different security architecture not relying on trusted computing is of course possible to imagine, but that's not what current networks assume.

ImPostingOnHN 1y ago
> Then you can't use eSIMs as specified. Could you elaborate here, please? I am kind of ignorant on this topic. Using an exploit to root my phone results in not using the phone "as specified", but it still works, and it's okay with me, because I own it. It sounded like the concerns you had were ones the network operator should be concerned with. Suppose I don't care about their concerns unless they result in my stuff being compromised*. Are you saying that it breaks the security in a way that someone who doesn't own my phone and doesn't have physical access to my phone can compromise my phone and/or my eSIM? * - for the purposes of simplifying discussion, I'm dismissing the possibility that the network operator throws up their hands and entirely stops using/allowing eSIMs because they can't control everything
- lxgr 1y ago
  The eSIM lives in dedicated, tamper-proof hardware inside your phone, separate from the application processor OS (which would be the domain of rooting) or often even the baseband. Under the eSIM security model, it holds keys that the device owner is not supposed to be able to extract, not even when they're willing to physically dismantle the chip holding it. > Are you saying that it breaks the security in a way that someone who doesn't own my phone and doesn't have physical access to my phone can compromise my phone and/or my eSIM? Yes, it does: Currently, providers assume that any eSIM honors the "singleton contract" described above. One that does not, e.g. one simulated in software using keys extracted from a physical trusted eUICC, could be used to mount the following attack: 1. Intercept the eSIM setup QR code (which contains two things: the URL of the SM-DP and a secret profile identifier) 2. Install the eSIM profile on their "software eSIM". 3. Report the eSIM as successfully deleted to the SM-DP, which now considers it available for installs again. 4. You, the legitimate owner of the eSIM, now install it on your unmodified eUICC in your phone and go about your day. 5. One day, ideally when your legitimate SIM is offline, the attacker inserts their eSIM into a phone and intercepts phone calls and SMS to your number, initiates expensive toll calls etc. One solution here would be to never allow re-installs of the same eSIM profile, which some providers already do, but I personally don't like eSIM profiles managed that way, as it requires me to interact with carrier support and often even pay money just to transfer an eSIM to a new device.

miki123211 1y ago

Theoretically, if one of the carriers you were using were to be hacked, the attackers could extract all your keys, including for other carrier profiles. It's an interesting attack vector for intelligence agencies. Imagine you're going to China and install a Chinese eSim profile as secondary to get cheaper data. The Chinese govt, in collaboration with the carrier, could then use that profile to dump your American AT&T keys. In the telecom world, there's no forward secrecy (there can't be with symmetric crypto, which is what it's all based on), so such an attack would let the Chinese intercept all your communications.

ImPostingOnHN 1y ago
Thank you, your explanation helped me understand that the profile can itself be an application (and thus can be an exploit), and that different profiles/applications are not isolated from each other. I will be careful installing profiles from untrusted sources on my phone*. Is there a remote attack vector against my phone/eSIM which doesn't require first compromising the network service provider? Not that I'm dismissing other vectors as unimportant, just trying to learn more. * - I do realize that a network operator viewed as "trusted" may be untrusted under the right circumstances, like sufficient pressure from sufficiently official or powerful actors.
lxgr 1y ago
That would indeed be catastrophic, but from the attack as demonstrated, I don't think we can conclude that that's possible. As I understand it, the attack as demonstrated is extracting the eUICC provisioning private key from the context of a SAT applet, but what you're describing would be extracting the keys of eSIM profile A from the context of eSIM profile B of an unrelated carrier. It would be great to know whether the researchers have looked into that, as it sounds like a much bigger problem if possible.
- VogonPoetry 1y ago
  There are three things in the report that make me believe that it would be possible to get the secrets from eSim profile B from a compromised eSIM profile A if they are both installed. Under "Notes" it says... The hack proves no security / isolation for the eSIM profile and Java apps (no security for eUICC memory content). - app isolation is broken Under "The warning call for mobile phone vendors"... Target eUICC chips may run some sensitive applications (digital wallets / payment, digital car keys, transportation cards, access / identification cards, etc.). In case of a successful eSIM compromise, the security / credibility of such apps may be affected. - perhaps code for we already know this is possible, not talking about it yet... And towards the end, under "Some recommendations"... always assume your apps, their logic, associated secrets and/or some eSIM content could be revealed (one compromised eUICC identity can be used to download and peek into eSIM of any MNO) - directly talks about other secret extraction