AdaptiveMobile Security experts have published a list of countries where mobile operators provide users with SIM cards that are threatened by a Simjacker attack.
Recall that researchers described the Simjacker attack, which uses SMS messages to transmit SIM Toolkit (STK) and S @ T Browser instructions on a SIM card in September this year.“The essence of the attack is that using a smartphone or a simple GSM modem, an attacker sends a special SMS message containing hidden instructions for the SIM Toolkit to the victim’s device. The S @ T Browser application running on the device’s SIM card supports these instructions”, – write Security experts.
Simjacker allows attackers to track user devices, and other commands supported by S @ T Browser, including the ability to make calls, send messages, disconnect a SIM card, run AT-modem commands, open browsers (with phishing links or opening malicious sites), and many more other actions. Therefore, using Simjacker attacks, you can not only monitor users, but also carry out financial fraud (calls to premium numbers), spying (make a call and listen to conversations near the device), sabotage (disabling the victim’s SIM card), and organize misinformation campaigns ( sending SMS / MMS with fake content) and so on.
Interestingly, this attack is not just a concept, as over the past two years an unnamed private company that works with governments to monitor individuals has regularly used it in reality.
Now, AdaptiveMobile Security experts have revealed little more details about the carriers that are vulnerable to Simjacker. The list includes 29 countries on 5 continents, although researchers do not specify which telecom service providers are vulnerable in each country:
Italy, Saudi Arabia, Côte d’Ivoire, Brazil, Mexico, Bulgaria, Iraq, Ghana, Peru, Guatemala, Cyprus, Lebanon, Benin, Colombia, Belize, Palestine, Nigeria, Ecuador, Dominican Republic, Cameroon, Chile, El Salvador, Argentina, Honduras, Uruguay, Panama, Paraguay, Nicaragua, Costa Rica.
Read also: SAP Service Pack fixes three critical vulnerabilities
In addition, experts reported that live Simjacker attacks were detected in Mexico, Colombia and Peru. Although, as noted above, Simjacker is applicable for a wide range of operations, researchers write that in these countries, attacks were used solely to track the location of users.
Adaptive Mobile analysts also studied the WIBattack problem, the details of which were announced by Ginno Security Labs in early October. This attack is very similar to Simjacker and works in a similar way, however, it assumes the operation of Wireless Internet Browser (WIB), and not S @ T Browser.
After conducting their own tests, Adaptive Mobile reported that the number of countries and mobile operators vulnerable to WIBattack is much smaller compared to Simjacker: only 8 carriers in 7 countries of the world are vulnerable (against 61 operators in 29 countries
Unfortunately, there is very little that users can do to protect themselves. Firstly, there are available tools which you can download to determine whether your SIM card is vulnerable (with special equipment), or potentially tell if you are being targeted (but requires a rooted device), however these applications do not ensure protect. The only entities that can put in protection for targeted subscribers are the Mobile Operators. Their options include change of the security settings on the SIM Cards, and/or putting special filtering in place to prevent the SMS exploiting of the Simjacker vulnerability, which was received by targeted mobile subscribers.
