How SIM Cards Can Compromise Your System: Security Analysis, Attack Methods, and Research Tools

Background

Security researchers Tomasz Lisowski and Marius Muench have long observed that a SIM card is an active computing platform that can issue commands to phones, modems, and IoT devices.

One SIM card is essentially a computing platform that can actively send commands to phones, modems, and IoT devices.

Contrary to the common view of a SIM as a passive identity module, it runs its own file system (EFS), can trigger OTA updates, and can send AT commands.

Research Methodology and Tools

To explore the SIM attack surface systematically, the team built a custom SIM simulator and hardware interface, allowing fine‑grained control and monitoring of SIM behavior.

Custom SIM Simulation and Hardware Interface

They developed a bespoke SIM emulator and interface hardware, freeing the work from commercial device constraints.

Test Projects

The investigation covered five major areas:

Hostile SIM Testing : what a maliciously altered or implanted SIM can do.

Baseband Fuzzing : large‑scale random testing of phone baseband firmware to discover vulnerabilities.

Lock‑screen Bypasses : using SIM‑related functions to circumvent lock‑screen protection.

SIM‑originated AT Command Testing : assessing the SIM’s ability to send AT commands to the phone and its impact.

IoT / SCADA Extensions : extending the settings to automotive and industrial control system scenarios.

Findings and Insights

Actual Attack Surface of SIM

The SIM is not harmless; it can:

Trigger OTA pushes to remotely update apps or configurations.

Execute pre‑installed application commands via the SIM Toolkit (STK).

Send AT commands that control modem behavior.

Influence the logic of the entire baseband firmware in certain contexts.

New Tool Recommendations

The researchers released several practical SIM‑security research tools:

SIM Emulator : supports custom scripts and automated testing.

AT Command Analyzer : captures and analyzes communications initiated by the SIM.

OTA Traffic Monitor : detects anomalous over‑the‑air download activity.

Researchers’ Advice

They advise future SIM security researchers to focus on the interaction boundary between SIM cards and baseband firmware, which they consider fertile ground for new vulnerabilities.

Extended Application Scenarios

The findings affect more than just mobile phone security.

Mobile Communications : risks include baseband attacks, SIM cloning, OTA hijacking.

Automotive (Car‑IoT) : vehicle SIM/modem can be attacked.

IoT / SCADA : SIM modules become entry points in industrial equipment.

Privacy : SIM can be used to track users and extract sensitive data.