Skip to content
Hallway
0:00 / 0:00

#simcard#javacard#defcon

Defcon 21 - The Secret Life of SIM Cards

HackersOnBoard

71K subscribers • 11 videos on Hallway

YouTube
  • Recommended by 6 people: 3 on Hacker News, 1 on Lobsters and 2 in engineering communities.
  • A classic. People kept recommending it from 2016 to 2022.
  • Presented by Karl Koscher and Eric Butler

Intermediate. Assumes working knowledge.

707K views12 years ago6 recommendations

SecurityHardwareEmbedded systemsExploits and vulnerabilities

Karl Koscher and Eric Butler explain how SIM cards operate as independent computers running their own operating systems and Java Card applets.

Karl Koscher & Eric Butler August 1st--4th, 2013 Rio Hotel & Casino • Las Vegas, Nevada

Why it's here

6 people recommend this

What people say. Recommended as an excellent introduction to SIM card internals, Java Card, and the security implications of their independent operating systems.

calvinon Lobsters • Recommends

The Secret Life of SIM Cards (2013)
5View on Lobsters

adamnew123456on Hacker News • Recommends

On “This Blog is now hosted on a GPS/LTE modem”

Seeing the ShadySIM project mentioned on that page reminded me of this DEFCON talk, which talks about some of the capabilities of the SIM OS (some of them run Java!) and what power they grant you over phones if you have control over the underlying cell network (legitimately or otherwise). link to this video
View on Hacker News

Silasdevon Hacker News • Recommends

On “What is AT&T doing at 1111340002?”

This video from defcon gives a good overview of what Java Card applets is, the limitations and what it can do: link to this video
View on Hacker News

comboyon Hacker News • Recommends

On “Apple said to be preparing for iPhones without SIM card slot in 2022”

There was one really good talk about from black hat or defcon 1 but there's also this 2 which seems more thorough so I'm gonna watch it too later. I happen to have a friend who writes software for simcards so that's what really was my main source. 1. link 2. link to this video
View on Hacker News

u/archpuddingtonin r/netsec • Recommends

More than just TCP/IP connections, SIM Cards also have RCE on all phones smart and dumb. It is how roving bugs work.
1View on Reddit

u/Hot-Maryin r/netsec • Recommends

More than just TCP/IP connections, SIM Cards also have RCE on all phones smart and dumb. It is how roving bugs work ;
1View on Reddit

e12eon Hacker News • Mentions

On “The Elephant was a Trojan Horse: On the Death of Map-Reduce at Google”

Indeed. And it runs today (on among other things) sim cards. See eg: "Defcon 21 - The Secret Life of SIM Cards" link to this video
View on Hacker News

paulmdon Hacker News • Mentions

On “US cell carriers are selling access to real-time phone location data”

The SIM card is a separate OS that gets underneath the SOC's OS. It can run its own applets without the knowledge or permission of the SOC OS. link to this video The baseband is a completely different RTOS as well. And then there's also TrustZone running in the SOC as well.
View on Hacker News

recoilon Hacker News • Mentions

On “Go Is on a Trajectory to Become the Next Enterprise Programming Language”

> Java is essentially never used for serious embedded work. I don't know whether it counts as "serious" to you, but literally billions of SIM cards and credit cards are running JavaCard: link link to this video
View on Hacker News

garaetjjteon Hacker News • Mentions

On “SIM Vulnerability leads to information disclosure via malicious SMS”

When I recently watched this talk, link to this video , I wondered about that, that is if malicious STK app from network operator could execute AT commands on phone (and compromise device using commands from link ). But from what I gathered from cursory search, RUN AT COMMAND isn't supported by most devices. (ETSI TS 102 223 states "This clause applies if class "b" is supported by the terminal and enabled by the subscriber through the terminal. ")
View on Hacker News

paulmdon Hacker News • Mentions

On “New 'unremovable' xHelper malware has infected 45,000 Android devices”

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever. link to this video There are only so many places it can be hiding if it's surviving a factory reset. --Guy who is undoubtedly vastly underestimating the problem given that it's resisted AV vendors for a while
View on Hacker News

paulmdon Hacker News • Mentions

On “Against SQL”

…bytecode is important and what I am thinking is more of a "pythonesque"/"javaesque" than an actual thing on a python VM / java VM. Limit the allowable syntax, it doesn't need to be full-spectrum python/java where you can recursively declare objects/etc, just what can be mapped into SQL. Give me Javacard+LINQ that compiles to bytecode with cursors. link to this video (OK not real javacard but... a minimal java equivalent that compiles to C bytecode, with LINQ, and with stack allocated variables/etc.) Views as subqueries are a good idea though, we don't hardly ever use them so I mostly don't think about it. It takes more authorization to modify a DB object (view) than program code, so we have a political…
View on Hacker News

paulmdon Hacker News • Mentions

On “Requiring MFA on popular gem maintainers”

This is all very confusing because you're mixing up your definitions of what precisely is "inactive" here. It's like the OSI model, there are multiple layers here representing different things. An IMEI is a representation of piece of equipment. A SIM is a representation of a subscriber (or, to be more precise, it's a cryptographic 2fa token that a subscriber carries), so a piece of equipment may have multiple SIMs and a subscriber may have multiple SIMs each associated with at most 1 piece of equipment (at a time). A SIM may be associated with a phone number, and may be associated with a plan which may be active or inactive. The data model is really: user <-one to many-> SIM token <-many to…
View on Hacker News

paulmdon Hacker News • Mentions

On “I have written a JVM in Rust”

…- the baseband chip is this completely separate processor which the SOC can't see into, and the SIM card can snoop messages, send commands, and generally act like a secure enclave. It is/was? used for a couple banking systems for feature-phones like MPESA, where the app can run as a featurephone app with the menu item toolkits the phone provides. link to this video I think the e-sim idea is probably a net security benefit imo, apple has leveraged the carriers out of a fairly dangerous tool. I was thinking about what a program written to take advantage of Optane's persistent-memory model would have looked like, if you use it like RAM it's forever gonna be slow shitty RAM. Javacard seems to be the close…
View on Hacker News

M95Don Hacker News • Mentions

On “Motorola GrapheneOS devices will be bootloader unlockable/relockable”

None of it matters. If the device has a SIM card (virtual or physical), it will execute commands sent over the network. It's required by the GSM/LTE standards. The best you can hope for is to have separate SoC for the OS and separate SoC for the GSM/LTE connectivity, but that means double the power consumption. See presentation at DEFCON21 about SIM cards: link to this video
View on Hacker News

rsmon Information Security Stack Exchange • Mentions

On “Can virus save to SIM Card?”

Practically - no. The SIM card is a computer. By design, this computer can control the mobile phone. It is possible to install new software on this computer, but if this SIM card wasn't created by you, you can't sign new software properly and it will not work. (Also sorry for my english :) There is interesting Defcon 21 video "The Secret Life of SIM Cards" related to this topic link to this video.
2View the answer