A specially prepared SIM card can, on some devices, give commands to the phone and trigger actions normally beyond its reach.
To understand why, a SIM card is not only used to identify the subscriber to the mobile network. It can also send the phone certain requests defined by telecommunications standards. Researchers Tomasz Piotr Lisowski, Kristian Covic and Marius Muench studied one of these functions, called “RUN AT”.
Illustrative image from Pixabay
This function allows the SIM card to ask the device to execute a so-called AT command. These instructions have long existed to control modem-related functions. The problem arises when a phone accepts commands from the SIM without sufficient safeguards. A malicious card then has a path to sensitive device functions.
The team developed a tool called CATana to test this mechanism on real hardware. The researchers examined 26 different devices: 18 smartphones and 8 connected devices using a mobile network. Nine of them provided access to this interface from the SIM card. This observation led to the discovery of four security flaws.
The consequences depend on the device involved. In their demonstrations, the researchers notably managed to execute commands and read files without authorization. They were also able to force a connection to use the older 2G network. Reverting to older technology can reduce the protections available for mobile communications.
Another attack could cause a denial of service, making the device unavailable. In other words, the issue is not limited to the content stored on the phone. A discreet SIM card function can also affect how the device communicates or operates.
However, the scenario requires a SIM card capable of sending these malicious instructions, or an equivalent device placed in its communication path. It therefore does not mean that an ordinary SIM card can spontaneously take control of a smartphone. The study primarily highlights the risk created when a device retains a powerful interface whose legitimate use is limited.
The authors recommend strengthening the protections around this interface, or even disabling it when it is not necessary. Their work was presented at the 20th USENIX WOOT Conference on Offensive Technologies. Future analyses may determine how many other phones and cellular devices still retain this capability.