Sim cards hacked, could affect Millions

With the NSA leaks going full force it probably won't sound like news at all that a German cryptographer claims to have hacked a SIM card. But that's never been done before (as far as we know . . .) so it's kind of a big deal, and shows that millions of phones are potentially vulnerable.

The founder of Security Research Labs in Berlin, Karsten Nohl, studied the encryption methods in thousands of SIM cards to figure out how a hacker could find the card's unique 56-digit access key. The vulnerability he discovered could impact as many as 750 million phones and would open them to call surveillance, fraudulent purchases and even a type of identity theft. Nohl told Forbes:

Give me any phone number and there is some chance I will, a few minutes later, be able to remotely control this SIM card and even make a copy of it.

In addition to compromising access keys, Nohl discovered a flaw in the "sandboxing" technique that keeps sensitive data separate on SIM cards. By sending a binary SMS to a number of phones, he can collect data that eventually allow him to break through the encryption on some of the phones. Each vulnerability Nohl identified only applies to certain SIM cards, but in the wrong hands they could endanger a large percentage of the SIM cards in use right now.

 The vulnerability would allow attackers to send spoofed text messages to obtain the 56-bit data encryption standard (DES) key used by the targeted phone's SIM cardWith the key in hand, attackers would be able to install malicious software and perform other nefarious operations on the device.Though Nohl isn't officially presenting his findings until the Black Hat security conference in Las Vegas on July 30, he did share them with the GSM Association. A spokeswoman, Claire Cranton, told the New York Times:

Description of Attack
Carriers can send text messages for billing purposes and to confirm mobile transactions. Devices rely on digital signatures to verify the carrier is the one sending the message. Nohl sent out fake messages pretending to be from the mobile carrier containing a false signature. In three-quarters of messages sent to mobile phones using DES, the handset correctly flagged the fake signature and terminated the communication. However, in a quarter of cases, the handset sent an error message back and icluded its encrypted digital signature. Nohl was able to derive the SIM's digital key from that signature, Forbes reported.

"Different shipments of SIM cards either have [the bug] or not," Nohl told Forbes. "It's very random," he said.

With the SIM key in hand, Nohl could send another text message to install software on the targeted phone to perform a wide range of malicious activities, including sending out text messages to premium-rate numbers, eavesdropping on calls, re-directing incoming calls to other numbers, or even carry out payment system fraud, according to Forbes. Nohl claimed the attack itself took him only a few minutes to carry out from a PC.

"We can spy on you. We know your encryption keys for calls. We can read your SMSs. More than just spying, we can steal data from the SIM card, your mobile identity, and charge to your account," Nohl told the New York Times.

We have been able to consider the implications and provide guidance to those network operators and SIM vendors that may be impacted.

Nohl says that cards which are affected vary by country and carrier - since encryption standards vary between countries. According to his estimates about an eighth of the world's SIM cards could be affected, or about half a billion devices.

This marks the first time SIM cards have been compromised, as until now it was thought that SIM cards were unhackable. The Data Encryption Standards (DES) security encryption developed back in the 70's has finally been cracked, though.

The four major German carriers, as well Verizon and AT&T in the US have since commented that their SIM cards are not vulnerable. AT&T has even said that it had moved on to triple DES (3DES) almost 10 years ago.

Nohl claims that the dated security standard and badly implemented Java Card code could allow him to compromise the encryption keys of certain SIM cards in less than a minute. He has since shared his findings to various carriers and the GSMA in an effort to help close the exploit before it becomes widespread amongst cybercriminals.

Nohl is expected to share his findings at the Black Hat security convention in Las Vegas on July 31.

Definitely sounds like they're on it, and totally trust enormous mobile providers like AT&T and Verizon to act quickly and nimbly in resolving this issue.