Not all hackers are bad guys. Germany’s Karsten Nohl is the coder who prompted the wireless industry to improve security for GSM networks after exposing potential security flaws, and now Nohl has demonstrated a way to hack the SIM cards of an estimated 750 million cell phones worldwide by sending text messages to the phones. He says people using SIM cards that are more than three years old should ask their carriers for new cards.
SIM cards of the hacked phones can be used to make purchases using mobile payments, according to Nohl. Hackers can also listen to phone calls and send messages that appear to be from the phone’s owner.
Nohl came up with his estimate of 750 million vulnerable phones based on research he did using 1,000 SIM cards that use data encryption standard, an older encryption methodology used by about three billion phones today. He and his team were able to hack about a quarter of the SIM cards they tested. Nohl shared his findings with The New York Times, and plans to offer more details at the upcoming Black Hat security conference in Las Vegas.
The hack is enabled by identifying the SIM card’s digital key, a 56-digit code that is used by carriers to modify the card. Nohl and his team sent text messages to phones that were using the SIM cards, and disguised them as messages from the carriers. About 250 phones returned error messages that included enough information for the hackers to decipher the digital keys for their SIM cards.
Nohl did not say which carriers’ SIM cards were most vulnerable, nor does he plan to share this information. Since most operators are phasing out D.E.S. encryption in favor of the more secure Triple D.E.S., many consumers can protect themselves by asking their carrier for a new SIM card that uses Triple D.E.S. encryption.
Some smartphones do not use SIM cards at all. Verizon Wireless and Sprint use CDMA networks that do not require SIM cards. Newer LTE phones designed for these networks are likely to have SIM card slots, but older phones will not.
Follow me on Twitter.
