750 million phones could be vulnerable in massive SIM security flaw
Karsten Nohl, the founder of German firm Security Research Labs, discovered that sending a fake carrier message to a phone prompted an automated response from 25 percent of DES SIMs that revealed the cards' 56-bit security key. With that key in hand, Nohl was able to send a virus to the SIM with a text message. The virus allowed him to impersonate the phone's owner, intercept text messages, and even make carrier payments. The New York Times cites Nohl as claiming that the entire operation takes "about two minutes" using a regular PC.
Over the past two years, Nohl has tested his method on around 1,000 cards across North America and Europe. DES is used in around three billion mobile SIMs worldwide, of which Nohl estimates 750 million are vulnerable to the attack. Many carriers use SIMs with the stronger triple-DES encryption method, which are not susceptible to Nohl's method, and DES in general has been phased out in favor of AES (Advanced Encryption Standard).
The flaw has been disclosed to the GSMA, an association made up of mobile operators and other companies in the field that oversees the deployment of GSM networks. The GSMA has informed SIM manufacturers and other companies involved of the situation, who are all analyzing how to best deal with the flaw. With the "responsible disclosure" taken care of, Nohl will detail his attack method at the Black Hat security conference on August 1st. He also plans to publish a "comparative list" detailing the SIM card security of each mobile carrier in December. Hopefully by then the at-risk operators will have taken the necessary steps to neutralize the vulnerability.
Posted:
Related Forum: PC General Forum
Source: http://www.theverge.com/2013/7/21/4542782/sim-card-des-security-flaw-security-research-labs
Related Articles
Comments
slapshot101Posted:
That sucks I am on a GSM network phone, I hope I am not one of the ones affected. But this is a serious problem if it can be done with a regular PC. It's not a shock that people found a hack to the phones though.
KatsumiPosted:
Mortar This is horrible news, it was at least somewhat of a relief that remote hackers lurked mainly on computers, but this could be quite dangerous.
Well seeming that 750 million people are effected by this it's a pretty big issue, i could see at least a small percentage of them being effected
TaigaAisakaPosted:
varMortar This is horrible news, it was at least somewhat of a relief that remote hackers lurked mainly on computers, but this could be quite dangerous.
I hope my phone is not vulnerable
What I want to know is if it matters if the SIM card is activated or not. Mine isn't activated(It's still in my phone though) but I connect my iPhone 5 to my WiFi and I'm able to call and text no problem.
DMNDSPosted:
varMortar This is horrible news, it was at least somewhat of a relief that remote hackers lurked mainly on computers, but this could be quite dangerous.
I hope my phone is not vulnerable
I hope mine doesnt either
IlIuminatiPosted:
Mortar This is horrible news, it was at least somewhat of a relief that remote hackers lurked mainly on computers, but this could be quite dangerous.
I hope my phone is not vulnerable
MortarPosted:
This is horrible news, it was at least somewhat of a relief that remote hackers lurked mainly on computers, but this could be quite dangerous.
Latest Downloads
- 01. SnowRunner: SaveGame (all locations are opened) [32.0](1)
- 02. [EU] Resident Evil 6 MainGame+All DLCs [CUSA03840](1)
- 03. Elden Ring SAVE FILE (CUSA18581)(0)
- 04. Dead Island 2 - NG+ Trophies PS4, PS5 - CUSA27043(1)
- 05. Infinite Stratos 2 Love and Purge(0)
- 06. Real Racing 3: SaveGame (perfect start) [12.7.1](0)
- 07. What the Car?: SaveGame (Game completed 83%) [v15692787](0)
- 08. Fallout 2: SaveGame(0)
- 09. Ben and Ed: SaveGame (all levels open, bonus levels, Bencalypse)(0)
- 10. Double Dragon Gaiden: Rise Of The Dragons - SaveGame (100% completion)(2)
- 11. Metro: Last Light - SaveGame (to get the achievement Specialist)(0)
- 12. Frogun Encore: Game Save (The Game done 101%)(0)
- 13. Warhammer 40000 space marine 2 saves(15)
- 14. Lollipop Chainsaw RePOP: SaveGame (100%, everything is open)(0)
- 15. Dead Space 2 - Save Game (The Game done 100% on impossible difficulty) [1.1](1)
Latest Tutorials
- 01. PS3 HEN - Audio via a USB headset.(133)
- 02. Stumble Guys | Social Butterfly Achievement(95)
- 03. Last Days of Lazarus Achievement Walkthrough (Xbox/PS)(1,341)
- 04. EDENGATE: The Edge of Life - 100% Trophy/Achievement Guide(1,649)
- 05. Sherlock Holmes Chapter One | Walkthrough | No Commentary(1,365)
- 06. Morbid: The Seven Acolytes | Full Game Walkthrough(2,120)
- 07. Adam Wolfe | Full Game Walkthrough | No Commentary(1,458)
- 08. ALFRED HITCHCOCK: VERTIGO - 100% Walkthrough(1,695)
- 09. SHERLOCK HOLMES THE AWAKENED | Walkthrough | No Commentary(1,205)
- 10. Space Roguelike Adventure | Guide - Cheat Code!(1,418)
- 11. DETECTIVE Stella Porta Case | Trophy & Achievement Guide(1,113)
- 12. Tunic 100% Platinum Walkthrough | Trophy & Achievement Guide(1,714)
- 13. Outbreak: The Nightmare Chronicles Achievement Walkthrough(1,369)
- 14. Full Void 100% - Trophy & Achievement Guide(1,313)
- 15. Outbreak: Lost Hope #Xbox Achievement Walkthrough(2,082)
"750 million phones could be vulnerable in massive SIM security flaw" :: Login/Create an Account :: 65 comments