Mobile Users Vulnerable to Ongoing ‘SimJacker’ Surveillance Attack

A report says, more than one billion mobile users are at risk from a SIM card flaw being currently exploited by threat actors, researchers warn. It has also disclosed, an SMS-based attack method being abused in the real world by a surveillance vendor to track and monitor individuals.

A vulnerability discovered in mobile SIM cards is being actively exploited to track phone owners’ locations, intercept calls and more – all merely by sending an SMS message to victims, researchers say.

“SimJacker.” The glitch has been exploited for the past two years by “a specific private company that works with governments to monitor individuals,” and impacts several mobile operators – with the potential to impact over a billion mobile phone users globally, according to by researchers with AdaptiveMobile Security.

“Simjacker has been further exploited to perform many other types of attacks against individuals and mobile operators such as fraud, scam calls, information leakage, denial of service and espionage,” said researchers with AdaptiveMobile Security in a post breaking down the attack, released Thursday.

They said they “observed the hackers vary their attacks, testing many of these further exploits. In theory, all makes and models of mobile phone are open to attack as the vulnerability is linked to a technology embedded on SIM cards.”

The attack stems from a technology in SIM cards called S@T Browser (short for SIMalliance Toolbox Browser). This technology, which is typically used for browsing through the SIM card, can be used for an array of functions such as opening browsers on the phone as well as other functions like setting up calls, playing ring tones and more.

From a high level, threat actors can send messages to victims that use the S@T Browser functionality in order to trigger proactive commands that are sent to the handset. The issue is impacted SIM cards that contain the S@T Browser technology do not check the origin of messages that use the S@T Browser, and also that SIMs allow data download via SMS, researchers said.

These messages contain a series of SIM Toolkit (STK) instructions and is specifically crafted to be passed on to the SIM Card within the device. Once the SMS is received by the SIM card, it uses the S@T Browser library as an execution environment, where it can trigger logic on the handset – mainly for requesting location and specific device information (IMEI).

The responses to these commands are sent back from the handset to the SIM card, where they are stored temporarily. Once the relevant information is retrieved from the handset, another proactive command is sent to the victim’s handset to send an SMS out with the information to the attacker’s handset.

“The location information of thousands of devices was obtained over time without the knowledge or consent of the targeted mobile phone users,” researchers said. “During the attack, the user is completely unaware that they received the attack, that information was retrieved, and that it was successfully exfiltrated. However the Simjacker attack can, and has been extended further to perform additional types of attacks.”

Once they have sent the message, attackers can lunahc an array of attacks utilizing the S@T Browser, including: location tracking, fraud, denial of service, malware spreading and call interception. Using the attack bad actors can also launch commands like playing a ring tone, sending short messages, setting up calls, and more.

Other recommendations include:

Determine whether existing network equipment can be configured to filter binary SMS messages from unauthorised sources.

Consider if current firewalls are simply only GSMA document ‘compliant’. “These GSMA documents should really only be used as a starting point for more effective protection,” according to researchers.

Review the ongoing investigation and research you are doing on what is being encountered in your network.

Researchers said that they have submitted the details of the exploit to the GSMA in terms of vulnerability disclosure, and “will continue to research how the attacks function, look for other variants of the Simjacker exploits and use of the vulnerability.”

While researchers say that the S@T protocol is used by mobile operators in at least 30 countries whose population adds up to over a billion people, in an email to Threatpost, the GSMA that the “potential vulnerability” impacts a “small minority of SIM cards.”

But AdaptiveMobile said the Simjacker attacks it observed abused this mechanism to instruct a victim's phones to hand over location data and IMEI codes, which the SIM card would later send via an SMS message to a third-party device, where an attacker would log the victim's location.

SIMJACKER IS THE RESULT OF IMPROVEMENTS TO MOBILE NETWORKS. The mystery remains about who developed this attack, but AdaptiveMobile said the private company was an expert in the field.

AdaptiveMobile warns that this technology and this attack could be useful for more than just surveillance, and other threat actors could soon abuse it as well. For example, Simjacker could also be used for misinformation campaigns (for sending SMS/MMS messages with fake content), financial fraud (dialing premium numbers), espionage (initiating call and listening on nearby conversations), and sabotage (by disabling a target's SIM card), among many others.