SIM Cards in 29 Countries Vulnerable to Remote Simjacker Attacks

If you are unaware, the name “SimJacker” has been given to a
class of vulnerabilities that resides due to a lack of
authentication and proprietary security mechanisms implemented by
dynamic SIM toolkits that come embedded in modern SIM cards.

Out of many, two such widely used SIM toolkits — S@T Browser
technology and Wireless Internet
Browser (WIB) — have yet been found vulnerable to SimJacker
attacks, details of which we have provided in our previous articles
published last month.
^[1][2]

At that time, a few experts in the telecom industry confirmed The
Hacker News that the SimJacker related weaknesses were internally
known to many for years, and even researchers also revealed that an
unnamed surveillance company has been exploiting the flaw in the
wild to spy on its targets.

Cybersecurity researchers at Adaptive Mobile Security have now
released a new
report^[3], revealing more details
about the SimJacker attacks and trying to address some important
unanswered questions, like the number of affected operators and
countries, along with details on attacks spotted in the wild.

1 – List of Affected Countries

Though the researchers did not name the affected mobile operators
to prevent attackers from taking advantage of the disclosed
vulnerability, they did reveal the names of countries where the
vulnerable SIMs are still in use.

• North America: Mexico, Guatemala, Honduras, Costa Rica,
  Nicaragua, Belize, El Salvador, Dominican Republic, and
  Panama.
• South America: Peru, Colombia, Brazil, Ecuador, Chile,
  Argentina, Uruguay, and Paraguay.
• Africa: Nigeria, Ghana, Benin, Ivory Coast, and
  Cameroon.
• Europe: Italy, Bulgaria, and Cyprus.
• Asia: Saudi Arabia, Iraq, Palestine and Lebanon.

“The most probable, conservative estimate is that mid to high
hundreds of millions of SIM Cards globally are affected,” the
researchers said.

2- SimJacker Attacks in the Wild

According to the researchers, an unnamed surveillance
company—active from at least 2015 and known for targeting users
from multiple countries over the SS7 network—has been exploiting
the SimJacker vulnerability to gather intelligence on its targets.

It all started when researchers detected unusual and suspicious
SMS events in the last quarter of 2018, and when actively
monitored, they recorded nearly 25,000 Simjacker messages attempted
to be sent to 1500 unique mobile devices in a period of 30
days.

“We believe that prior to the discovery, they would have
successfully tracked the location of many thousands of mobile
subscribers over months and probably years,” the researchers
said^[4].

“We also observed the attacker experiment over time with new
potential forms of attack using the vulnerability. The number,
scale, and sophistication of modifications of the attack are
significantly beyond what we have witnessed from any attacker over
mobile networks.”

Besides this, researchers also observed that the attackers were
attempting to use dedicated SS7 attacks against some users in case
SimJacker attacks failed.

3. How to Prevent Yourself from SimJacker Attacks

Unfortunately, there is no simple way for mobile subscribers to
know whether a vulnerable SIM browser toolkit is deployed on their
SIM card or not.
Though there are apps available, like SnoopSnitch,
that you can download from Google Play Store to detect attacks
based on suspicious binary SMS, it requires your Android device to
be rooted and even knowing that won’t help you much.

That’s because, as a potential victim, there’s very little you
can do to protect yourself, except wait for your mobile operator to
implement security measures or simply migrate your phone number to
a different safe network, if available, which will provide you with
a new SIM card.

Meanwhile, GSM Association (GSMA), a trade body that
represents the interests of mobile operators worldwide, has
provided some of the best ways to prevent and block these attacks
to protect billions of mobile phone users worldwide.

In addition, the SIMalliance has also made some updates to its
S@T browser specifications to improve the security of the SIM
toolkits, and provided recommendations^[6]
for SIM card manufacturers to implement security for S@T push
messages.

^[5]