{"id":11733,"date":"2019-10-03T09:19:14","date_gmt":"2019-10-03T16:19:14","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=11733"},"modified":"2021-07-22T09:23:32","modified_gmt":"2021-07-22T16:23:32","slug":"millions-of-smartphones-vulnerable-to-simjacker-mobile-phone-exploit","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/millions-of-smartphones-vulnerable-to-simjacker-mobile-phone-exploit\/","title":{"rendered":"Millions of smartphones vulnerable to SimJacker mobile phone exploit"},"content":{"rendered":"

Earlier this month, Adaptive Mobile Security released a report on a vulnerability and set of exploits which have since been named SimJacker. Adaptive Mobile Security<\/a> showed that this attack vector has been used for at least the last two years to hack into target mobile phones. The security firm was able to identify that the SimJacker exploit had been used across multiple countries by a \u201chighly sophisticated threat actor,\u201d and represents a huge leap in complexity over previous mobile phone exploits. Adaptive Mobile emphasized that the discovery of this actively used vulnerability in the wild is absolutely a sign of raised stakes in the arms race between hackers and users. They wrote in their report:<\/p>\n

\u201cThe Simjacker exploit represent a huge, nearly Stuxnet-like, leap in complexity from previous SMS or SS7\/Diameter attacks, and show us that the range and possibility of attacks on core networks are more complex than we could have imagined in the past. Now is the time to make sure that we stay ahead of these attacks in the future.\u201d<\/p><\/blockquote>\n

On October 3rd, Adaptive Mobile will go more in depth on this topic at the Virus Bulletin Conference in London<\/a>. The firm has also worked with the GSM and SIM Alliance to get these attack vectors fixed at the Sim card level. Additionally, Adaptive Mobile gave tips to mobile network operators on how to block these attacks \u2013 but there\u2019s no guarantee that all of them have implemented these stopgaps while the S&T Browser receives a long overdue security update. That is to say \u2013 like with many other discovered vulnerabilities -many people are still vulnerable.<\/p>\n

How does SimJacker work?<\/h2>\n

At its core, SimJacker works by an attacker sending an SMS message to the target containing special code that is then automatically processed by the SIM card which then allows the attacker to take over the phone through the SIM card\u2019s S@T Browser. After the attacker has control of the S&T Browser, they\u2019re able to execute all sorts of actions with simple commands. Adaptive Mobile laid out potential ways that SimJacker could be used against the SIMjacked phone, or other phones:<\/p>\n