Mobile phones: new threat discovered
Millions of mobile phone users could be at risk of having their device hacked. The newly discovered flaw leaves users vulnerable to being robbed, and to having criminals eavesdropping on calls.
Karsten Nohl of the Berlin-based company Security Research Labs presented research at the BlackHat 2013 conference in Las Vegas on 31 July which demonstrates that between 500 million and 750 million SIM cards across the world are vulnerable to hacking.
SIM cards are thought to be the most widely-deployed computing platforms in the world, with over seven billion cards in active use. Until recently, little was known about their security beyond manufacturer claims. Nohl’s research calls these claims into question, and suggests an eighth of the cards in use today could be hacked.
The vulnerability in SIM cards is based around their use of Java, which leaves some of them open to a particular type of hacking known as rooting.
SIM cards act as an authorising security token which allows a user’s identity to be confirmed by their network operator. They also store data such as text messages, contacts’ telephone numbers, and details used for some applications – including a number of payment and banking services. In some parts of the world, including much of Africa, the SIM card is the only form of security for devices.
Nohl claims to have found a way to discover a card’s authentication code by sending a device a fraudulent text message, containing a false digital signature for the network, disguised as a communication from the user’s mobile operator.
Nohl said most phones cut contact after recognising the signature as being a fake, but in about a quarter of cases the devices sent back an error message which included an encrypted version of the SIM’s authentication code.
The encryption is supposed to prevent the authentication code being discovered, but Nohl said that in about half of the error messages it was based on a 1970s coding system called Digital Encryption Standard (DES), which was once thought secure but could now be cracked “within two minutes on a standard computer”. Once the attacker has this information they are able to upload malware to the SIM written in the Java programming language.
Nohl explained that this could be used by the hacker to send texts from the device to premium rate numbers, to discover and listen in to the target’s voicemail messages, and to track their location. In combination with other techniques, the device could be used as a surveillance tool.
As Nohl told the UK’s BBC, “SIM cards generate all the keys you use to encrypt your calls, your SMS and your internet traffic. If someone can capture the encrypted data plus have access to your SIM card, they can decrypt it. Operators often argue that it’s not possible to listen in on 3G or 4G calls – now with access to the SIM card, it very much is.”
As Nohl explained at BlackHat, Java is a highly flexible and adaptable language which, in theory, makes SIM cards a very useful tool. Due to this adaptability SIM cards are due to become an easily extensible trust anchor for otherwise un-trusted smartphones, embedded devices, and cars.
This deeper utilisation of SIM cards could leave many more devices vulnerable to abuse than just mobile phones. For the time being, Nohl has published some mitigation strategies on his website.
- Threat mitigation
Karsten Nohl of Security Research Labs has suggested some defence strategies that could help to mitigate the threat from SIM rooting. These include:
- Better SIM cards. Cards need to use state-of-art cryptography with sufficiently long keys, should not disclose signed plaintexts to attackers, and must implement secure Java virtual machines. While some cards already come close to this objective, the years needed to replace vulnerable legacy cards warrant supplementary defences.
- Handset SMS firewall. One additional protection layer could be anchored in handsets: Each user should be allowed to decide which sources of binary SMS to trust and which others to discard. An SMS firewall on the phone would also address other abuse scenarios including “silent SMS.”
- In-network SMS filtering. Remote attackers rely on mobile networks to deliver binary SMS to and from victim phones. Such SMS should only be allowed from a few known sources, but most networks have not implemented such filtering yet. “Home routing” is furthermore needed to increase the protection coverage to customers when roaming. This would also provide long-requested protection from remote tracking.
Industry response?
The GSM Association (GSMA), an association of mobile operators and related companies which represents network operators globally, has acknowledged the new research.
“Karsten [Nohl]’s early disclosure to the GSMA has given us an opportunity for preliminary analysis,” said a spokeswoman for the association. “We have been able to consider the implications and provide guidance to those network operators and SIM vendors that may be impacted. It would appear that a minority of SIMs produced against older standards could be vulnerable.”
However, as can be read between the lines of the spokeswoman’s statement, it is far from clear that action will be taken in time to prevent criminals exploiting this newly discovered vulnerability, especially now that knowledge of it is in the public domain.