{"id":29360,"date":"2019-09-27T21:15:39","date_gmt":"2019-09-27T21:15:39","guid":{"rendered":"http:\/\/d6d7f6d1-67c7-4de0-bdba-7fe9b085e3ab"},"modified":"2019-09-27T21:15:39","modified_gmt":"2019-09-27T21:15:39","slug":"new-sim-card-attack-disclosed-similar-to-simjacker","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/new-sim-card-attack-disclosed-similar-to-simjacker\/","title":{"rendered":"New SIM card attack disclosed, similar to Simjacker"},"content":{"rendered":"

\"SIM<\/span><\/p>\n

A team of security researchers has detailed a second SMS-based attack that can allow malicious actors to track users’ devices by abusing little-known apps that are running on SIM cards.<\/p>\n

This new attack, named WIBattack, is identical to Simjacker<\/a>, an attack disclosed at the start of the month by mobile security firm AdaptiveMobile.<\/p>\n

Both attacks work in the same way, and they grant access to similar commands, with the exception that they target different apps running on the SIM cards.<\/p>\n

Mainly, Simjacker runs commands against the S@T Browser app, while WIBattack sends commands to the Wireless Internet Browser (WIB) app.<\/p>\n

Both are Java applets that mobile telcos install on SIM cards they provide to their customers. The purpose of these apps is to allow remote management for customer devices and their mobile subscriptions.<\/p>\n

WIBattack<\/h3>\n

In a report released earlier this month, AdaptiveMobile said it discovered that a “private company that works with governments” was using rogue commands sent to S@T Browser apps running on SIM cards to track individuals.<\/p>\n

In a report published last weekend<\/a>, security researchers from Ginno Security Labs said that the WIB app was also vulnerable to similar attacks, although they were not aware of any attacks.<\/p>\n

\n<\/section>\n

In the case of both S@T and WIB apps, attackers can send a specially formatted binary SMS (called an OTA SMS) that will execute STK (SIM Toolkit) instructions on SIM cards on which telcos did not enable special security features.<\/p>\n

The commands supported on the WIB app are about the same ones supported by the S@T Browser, which are:<\/p>\n

    \n
  • Get location data<\/li>\n
  • Start call<\/li>\n
  • Send SMS<\/li>\n
  • Send SS requests<\/li>\n
  • Send USSD requests<\/li>\n
  • Launch internet browser with a specific URL<\/li>\n
  • Display text on the device<\/li>\n
  • Play a tone<\/li>\n<\/ul>\n
    \n