Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Mobile Tech
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
SIM Card Flaw Leaves 750 Million Phones at Risk

SIM Card Flaw Leaves 750 Million Phones at Risk
By Seth Fitzgerald

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

Even though a large portion of the phones tested did not accept an SMS message pretending to be from the phone's wireless carrier, many of them did, and in doing so the phone frequently provided the SIM card's cryptographic signature. Because they used weak encryption, the signatures were quickly cracked. That then provided a way to download a virus.
 


A German security researcher has found a major flaw in the type of encryption that many cell phone SIM cards use.

According to researcher Karsten Nohl, the DES (data encryption standard) protocol which has been around since the 1970s is weak against attacks, despite it still being used on half of all SIM cards.

Nohl, who will be presenting his findings at the Black Hat security conference in Las Vegas next week, tested 1,000 SIM cards over a two-year period and has come to the conclusion that as many as 750 million cell phones globally could be vulnerable to these relatively easy attacks.

The two largest carriers in the U.S., Verizon and AT&T, both reportedly have said they have moved away from DES encryption and their SIM cards are not vulnerable to the flaw.

The Attack

By looking at the security features present on the test phones, he discovered that in a quarter of them that use the older encryption standard, a hacker could exploit carrier text messages. Cell phone carriers frequently send out text messages to phones, and Nohl was able to trick devices into seeing him as a carrier. After doing so, the phone accepted a text message and replied with the SIM card's 56-digit key.

Once hackers have access to a SIM card's unique key, they are able to take over the device. Nohl said hackers with a SIM key are able to do practically anything they want with the phone.

"We can remotely install software on a handset that operates completely independently from your phone," Nohl said. "We can spy on you. We know your encryption keys for calls. We can read your SMS's. More than just spying, we can steal data from the SIM card, your mobile identity, and charge to your account."

Even though a large portion of the phones that Nohl tested did not accept the message pretending to be from the carrier, many of them did, and in doing so the phone frequently provided a cryptographic signature. The issue with the signatures used by the SIM cards is that Nohl was able to crack them in under a minute.

Breaking the encryption key gave Nohl access to the phone, allowing him to download a virus onto the SIM card that would eavesdrop on calls, collect data, and send messages or calls.

Fixing the Vulnerability

Nohl has yet to release the specifics of his research to the public but he has already notified the GSM Association about his findings. The International Telecommunications Union, a sub-group of the United Nations, said the research was "hugely significant."

Wireless telecom analyst Jeff Kagan said most people do not add virus protection to their cell phones, and when combined with weak encryption security, phones are vulnerable devices.

When it comes to fixing the problem, which potentially affects more than 750 million devices, Kagan said there were a few things that must be done.

"The solution has to come from many areas," Kagan told us. "One is to continually upgrade SIM cards. Two is to have security protection on the networks, which we do have. Three is to personally protect our devices with protection software like we do on our computers."
 

Tell Us What You Think
Comment:

Name:

Andreas:

Posted: 2013-07-23 @ 6:30am PT
Can you say fear mongering?



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Mobile Tech
1.   HTC One M8 Windows Phone Unveiled
2.   Verizon Tops in Mobile Networks
3.   Sprint Out with Data Guns Blazing
4.   Best Buy Leaks Moto 360 Watch Info
5.   Google Buys Contextual Image Startup


advertisement
Android 'Fake ID' Puts Millions at Risk
Users: stick to apps from Google Play.
Average Rating:
Researchers Tout Battery Breakthrough
Lithium anode could triple capacity.
Average Rating:
HTC One M8 Windows Phone Unveiled
Can be POS device for small business.
Average Rating:


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Chinese Hackers Nab Info on Millions of U.S. Patients
A group of Chinese hackers has stolen the personal information, including names and Social Security numbers, of about 4.5 million patients at hospitals operated by Community Health Systems.
 
Premier FBI Cybersquad in U.S. To Add Agents
After helping prosecutors charge Chinese army officials with stealing trade secrets from major companies and by snaring a Russian-led hacking ring, the premier FBI cyber-squad is getting a boost.
 
Apple Opens iCloud Data Center in China
Treading lightly, Apple acknowledged it has started to store encrypted iCloud personal data of some Chinese users on servers in mainland China, operated by the state-owned China Telecom.
 

Enterprise Hardware Spotlight
Compression, Deduplication Come to Violin Concerto 2200
Violin Memory has announced that data deduplication and compression capabilities are now available on its Concerto 2200 solution. Typically, users will experience deduplication rates between 6:1 and 10:1.
 
Cisco Axes 6,000 Employees in Restructuring Plan
Faced with declining profits, Cisco is laying off up to 6,000 employees in the months ahead -- a whopping 8 percent of its global workforce. That's in addition to the 4,000 jobs Cisco cut last year.
 
Web Slows, Have Internet Routers Reached The Limit?
If you encountered problems connecting to the Internet on August 12, you weren't alone. Networking experts blame the wide-scale slowdown on outdated routing systems that are reaching their limits.
 

Mobile Technology Spotlight
HTC Debuts Windows Phone Version of One M8 Smartphone
HTC is bringing the Windows Phone mobile OS to its flagship One M8 device -- the first time any mainstream flagship smartphone has been offered with a choice of operating systems.
 
Verizon Earns Top Rating in Mobile Network Comparison
A new report says Verizon Wireless was the top-performing U.S. cellphone service provider in the first half of 2014, on a nationwide and state-by-state basis, as well as in metro areas.
 
Sprint Comes Out with Data Guns Blazing
As its new CEO promised, Sprint has rolled out a new aggressively competitive price plan. The shared data plans promise twice the high-speed data and at lower prices than AT&T and Verizon Wireless.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.