New SIM Card Flaw Lets Hackers Hijack Any Phone Just By Sending SMS, 1 Billion Phones At Risk

It seems as though we can’t escape a single day without hearing about a new widespread security exploit that puts us all at risk. Today, the new attack taking center stage is called Simjacker, and it was revealed by the folks at AdaptiveMobile Security.

Simjacker is a potential cyber threat to all mobile operators and subscribers across the globe

What exactly is Simjacker?

It is a kind of software exploit which helps track down the mobile location of users of mobile networks through malicious SMS messages. This vulnerability is said to be found in 30 countries (unnamed), whose total population exceeds one billion.

Here’s how the Simjacker works:

Although Simjacker is quite an intricately-executed exploit, I’ll try to give you a simple overview of how it claims its victims. First of all, the perpetrator sends an SMS “attack message” to a victim which contains instructions to the SIM card.

These instructions utilise are a specific piece of software called the S@T Browser that’s in every SIM card. From there the S@T Browser can communicate with the target smartphone to return information to the attacker. This information from the target phone is then relayed back to the malicious party in the form of another SMS message.

So what data is being relayed back to the perpetrator? The attack can send back information that includes your phone’s IMEI (International Mobile Equipment Identity) number, your location and it also can make calls and illegally install malware. And here’s where things get incredibly sneaky and downright frightening:

During the attack, the user is completely unaware that they received the SMS with the Simjacker
Attack message, that information was retrieved, and that it was sent outwards in the Data Message SMS – there is no indication in any SMS inbox or outbox

The report says that the onus is on telcos to plug the loophole.

In general, our recommendations for the mobile community to deal with the immediate threat is for mobile operators to analyse and block suspicious messages that contain S@T Browser commands.

Who is behind the Simjack?

AdaptiveMobile Security researchers are working on to detect who is behind this. However, they believe it might be the handiwork of private spy agency which is working with a government organisation.