Simjacker vulnerablity allows hackers to steal mobile phone data through sending SMS
Cybersecurity researchers warned that there is a serious vulnerability in the SIM card that allows remote attackers to send text messages to target phones and monitor victims. Researchers at AdaptiveMobile Security said the vulnerability, known as “Simjacker,” has been exploited by a spyware vendor for at least two years, but the security company did not disclose the name of the exploit and the victim’s information.
The “Simjacker” exploits allegedly included sending a text message to the phone containing a specific type of spyware-like code, which then instructed the SIM card in the phone to control the phone, retrieve and execute sensitive commands. This vulnerability exists in a browser called S@T, which is part of the GSM-used Mobile Application Toolkit (STK) and is embedded in most mobile SIM cards to provide value-added services to customers.
AdaptiveMobile says mobile operators in at least 30 countries are actively using S@T browser technology for a total of more than one billion users. This means that more than one billion mobile phone users worldwide may be affected by SimJacker.
How Does Simjacker Vulnerability Work?
“During the attack, the user is completely unaware that they received the attack, that information was retrieved, and that it was successfully exfiltrated,” researchers explain.
“The location information of thousands of devices was obtained over time without the knowledge or consent of the targeted mobile phone users. However the Simjacker attack can, and has been extended further to perform additional types of attacks.”
“This attack is also unique, in that the Simjacker Attack Message could logically be classified as carrying a complete malware payload, specifically spyware. This is because it contains a list of instructions that the SIM card is to execute.”
Although it has been detected that the main attack involves stealing the location of mobile phone users, the scope of the Simjacker attack has now expanded to fraud, fraudulent calls, information disclosure, denial of service attacks, espionage and so on.
Via: thehackernews
