More SIM Cards Vulnerable to Simjacker Attack Than Previously Disclosed

Earlier this month, we reported about a critical unpatched
weakness in a wide range of SIM cards, which an unnamed
surveillance company has actively been exploiting in the wild to
remotely compromise targeted mobile phones just by sending a
specially crafted SMS to their phone numbers.

If you can recall, the Simjacker
vulnerability resides in a dynamic SIM toolkit, called the
S@T Browser, which comes installed on a variety of SIM
cards, including eSIM, provided by mobile operators in at least 30
countries.
^[1]

Now, it turns out that the S@T Browser is not the only dynamic SIM
toolkit that contains the Simjacker issue which can be exploited
remotely from any part of the world without any
authorization—regardless of which handsets or mobile operating
systems victims are using.

WIB SIM ToolKit Also Leads To SimJacker Attacks

Following the Simjacker revelation, Lakatos, a researcher at Ginno
Security Lab, reached out to The Hacker News earlier this week and
revealed that another dynamic SIM toolkit, called Wireless
Internet Browser (WIB), can also be exploited in the same way,
exposing another set of hundreds of millions of mobile phones users
to remote hackers.
Lakatos told The Hacker News that he discovered this vulnerability
back in 2015 but decided not to disclose it publicly until now
because the process to patch such a flaw is complex and most
importantly, can be abused by “bad guys to control phones running
vulnerable SIMs remotely.”

Besides this, Lakatos also claimed that he independently
discovered S@T Browser as well and also provided a video
demonstration of the Simjacker vulnerability with more
details that have not yet been published by AdaptiveMobile
Security researchers who initially disclosed the issue earlier this
month.
^[2]

WIB toolkit is created and maintained by SmartTrust, one of the
leading companies that offer SIM toolkit-based browsing solutions
to more than 200 mobile operators worldwide, and, according to some
press releases, the list includes AT&T, Claro, Etisalat, KPN,
TMobile, Telenor, and Vodafone.

WIB and S@T Browsers Flaw Could Lets Attackers Target Mass
Users

Just like the S@T Browser, WIB toolkit has also been designed to
allow mobile carriers to provide some essential services,
subscriptions, and value-added services over-the-air to their
customers or change core network settings on their devices.

Instead of a pre-fixed installed menu, having a dynamic toolkit
on the SIMs allows mobile operators to generate new features and
options on the fly based on information provided by a central
server.

• Retrieving targeted device’ location and IMEI information,
• Sending fake messages on behalf of victims,
• Distributing malware by launching victim’s phone browser and
  forcing it to open a malicious web page,
• Performing premium-rate scams by dialing premium-rate
  numbers,
• Spying on victims’ surroundings by instructing the device to
  call the attacker’s phone number,
• Performing denial of service attacks by disabling the SIM card,
  and
• Retrieving other information like language, radio type, battery
  level, etc.

How Does SimJacker Attack Work Against WIB or S@T Enabled
SIMs?

• Step 1 — Attackers send a malicious OTA SMS to the
  victim’s phone number containing an S@T or WIB command such as
  SETUP CALL, SEND SMS, or PROVIDE LOCATION INFO.
• Step 2 — Once received, the victim’s mobile operating
  system forwards this command to the S@T or WIB browser installed on
  the SIM card, without raising an alert or indicating the user about
  the incoming message.
• Step 3 — The targeted browser then instructs the
  victim’s mobile operating system to follow the command.
• Step 4 — The victim’s mobile OS then performs the
  corresponding actions.

Lakatos says he also reported his findings to the GSM Association
(GSMA), a trade body that represents the interests of mobile
operators worldwide.
The telecom industry needs urgent countermeasures to prevent
Simjacker, WIBattack, and other evolving threats to protect
billions of mobile phone users worldwide.

How to Detect Simjacker Attacks?

Developed by researchers at SRLabs^[8], there’s another Android
app, called SnoopSnitch, which can detect attacks based on
suspicious binary SMS including Simjacker and alert users of
it.

You can download
SnoopSnitch^[9] from Google Play Store,
but you need to have a rooted Android smartphone with a Qualcomm
chipset for the SMS attack alerting feature to work.

We also reached out to AdaptiveMobile Security firm for a
comment but have not heard back from them yet.