3 ms·
This appears to be confirmed - from https://srlabs.de/rooting-sim-cards/ https://srlabs.de/rooting-sim-cards/ : A rainbow table resolves this plaintext-signa
by caf 13y ago
This appears to be confirmed - from https://srlabs.de/rooting-sim-cards/ https://srlabs.de/rooting-sim-cards/ :
A rainbow table resolves this plaintext-signature tuple to
a 56-bit DES key within two minutes on a standard computer.
The cracked DES key enables an attacker to send properly
signed binary SMS, which download Java applets onto the SIM.
It's particularly sad that the same key is used for the MAC in both directions (network-to-SIM and SIM-to-network).
- anologwintermut 13y agoAlso sad that it's refereed to as a signature.
- mentat 13y agoI still haven't been able to find the particular documentation around class 2 SMS verification. Most of the things I'm finding talk about IMSI using HMAC-SHA1 for OTA validation. Is this at a lower level? Edit: Found this: http://www.3gpp.org/ftp/tsg_sa/wg3_security/TSGS3_33_Beijing/Docs/PDF/S3-040242.pdf http://www.3gpp.org/ftp/tsg_sa/wg3_security/TSGS3_33_Beijing...