Cybersecurity experts have discovered the existence of a new, previously undetected, critical vulnerability in SIM cards, which allows attackers to remotely hack targeted mobile phones and spy on victims simply by sending an SMS message. This vulnerability, called SimJacker, is located in the S @ T Browser software (dynamic toolkit for SIM cards), built into most SIM cards and widely used by mobile operators in at least 30 countries.

S @ T Browser contains a number of STK instructions — such as sending a short message, setting up a call, launching a browser, providing local data, launching on command, and sending data — all of which can be triggered by simply sending an SMS message to the device. The software offers a runtime environment and automatically launches malicious commands on mobile phones.

At the same time, while running SimJacker, the user does not know that he was attacked, and the information was extracted. The location of thousands of devices was obtained using this attack without the knowledge or consent of mobile phone users, but SimJacker has been expanded to carry out additional types of attacks.

Although technical details and a detailed document describing the attack are planned to be published in October this year, the researchers said they revealed real attacks on phone users from almost all manufacturers, including Apple, ZTE, Motorola, Samsung, Google, Huawei and even various SIM-compatible electronics. kart. One of the identified victims was subjected to 250 attacks in a week. Potentially more than a billion people can be at risk.

3dnews.ru