Defcon 21 - The Secret Life of SIM Cards

Seeing the ShadySIM project mentioned on that page reminded me of this DEFCON talk, which talks about some of the capabilities of the SIM OS (some of them run Java!) and what power they grant you over phones if you have control over the underlying cell network (legitimately or otherwise). [VIDEO]

This video from defcon gives a good overview of what Java Card applets is, the limitations and what it can do: [VIDEO]

There was one really good talk about from black hat or defcon [1] but there's also this [2] which seems more thorough so I'm gonna watch it too later. I happen to have a friend who writes software for simcards so that's what really was my main source. 1. [LINK] 2. [VIDEO]

Indeed. And it runs today (on among other things) sim cards. See eg: "Defcon 21 - The Secret Life of SIM Cards" [VIDEO]

The SIM card is a separate OS that gets underneath the SOC's OS. It can run its own applets without the knowledge or permission of the SOC OS. [VIDEO] The baseband is a completely different RTOS as well. And then there's also TrustZone running in the SOC as well.

> Java is essentially never used for serious embedded work. I don't know whether it counts as "serious" to you, but literally billions of SIM cards and credit cards are running JavaCard: [LINK] [VIDEO]

When I recently watched this talk, [VIDEO] , I wondered about that, that is if malicious STK app from network operator could execute AT commands on phone (and compromise device using commands from [LINK] ). But from what I gathered from cursory search, RUN AT COMMAND isn't supported by most devices. (ETSI TS 102 223 states "This clause applies if class "b" is supported by the terminal and enabled by the subscriber through the terminal. ")

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever. [VIDEO] There are only so many places it can be hiding if it's surviving a factory reset. --Guy who is undoubtedly vastly underestimating the problem given that it's resisted AV vendors for a while