Sim card hacking/rooting

Millions of
mobile phones may be
vulnerable to spying due to the
use of outdated, 1970s-era
cryptography, according to new
research due to be presented
at the Black Hat security
conference.
Karsten Nohl , an expert
cryptographer with Security
Research Labs, has found a way
to trick mobile phones into
granting access to the device's
location, SMS functions and
allow changes to a person's
voicemail number.
Nohl's research looked at a
mobile phones' SIM (Subscriber
Identification Module), the
small card inserted into a
device that ties it to a phone
number and authenticates
software updates and
commands sent over-the-air
from an operator.
More than 7 billion SIM cards
are in use worldwide. To
ensure privacy and security,
SIM cards use encryption when
communicating with an
operator, but the encryption
standards use vary widely.
A mobile communication trade
group, the GSM Association,
said in a statement that only a
"minority" of SIM cards that
use older encryption standards
would appear to be vulnerable.
"There is no evidence to
suggest that today's more
secure SIMs, which are used to
support a range of advanced
services, will be affected,"
GSMA said.
Nohl's research found that
many SIMs use a weak
encryption standard dating
from the 1970s called DES
(Data Encryption Standard),
according to a preview posted
on his company's blog.
DES has long been considered
a weak form of encryption, and
many mobile operators have
upgraded now to more secure
forms. It is relatively easy to
discover the private key used
to sign content encrypted with
DES.
In its experiment, Security
Research Labs sent a binary
code over SMS to a device
using a SIM with DES. Since
the binary code wasn't
properly cryptographically
signed, it would not run on
the device.
But while rejecting the code,
the phone's SIM makes a
crucial mistake: it sends back
over SMS an error code that
carries its own encrypted 56-bit
private key, according to the
company. Because DES is
considered a very weak form of
encryption, it's possible to
decrypt the private key using
known cracking techniques.
Security Research Labs did it
in about two minutes on a
regular computer with the help
of a rainbow table, a
mathematical chart that helps
convert an encrypted private
key or password hash into its
original form faster.
With the private DES key in
hand, it is then possible to
"sign" malicious software
updates with the key, and send
those updates to the device.
The device believes the
software comes from a
legitimate source and then
grants access to sensitive data.
GSMA said that it has not seen
the full details of Nohl's
research but that use of the
DES algorithm has been
"discontinued in over the air
(OTA) standards for several
years."
Security Research Labs
outlined an attack scenario
against SIM cards that run
some form of Java virtual
machine, a software framework
for Java applications.
Using the SIM's private key, an
attacker could force the SIM to
download Java applets, which
are essentially very small
programs that perform some
function. Those applets would
be "allowed to send SMS,
change voicemail numbers, and
query the phone location,
among many other predefined
functions."
"These capabilities alone
provide plenty of potential for
abuse," the company wrote.
Possible remedies to the
problem including ensuring
SIM cards use state-of-the-art
cryptography and also using
Java virtual machines that
restrict applets' access to
certain information.
GSMA said it has already
provided guidance to network
operators and SIM vendors that
might be affected by Nohl's
findings.
Nohl's presentation, "Rooting
SIM cards," will take place at
the Black Hat security
conference in Las Vegas on July
31.