'The attacks we found only scratch the surface of what is possible': Experts say so-called 'Proactive SIM' cards can hijack smartphones, IoT devices and even EV chargers

https://cdn.mos.cms.futurecdn.net/uLTVZ33PJNJAQnchjt5Ngn-2560-80.jpg
  • Researchers find a standardized SIM command is exposed on nine of 26 tested devices and used it to achieve code execution on a commercial EV charger
  • The exposure is concentrated in machine-to-machine hardware rather than phones, affecting six of eight cellular modules but only three of 18 handsets, with no iPhone or Pixel among them
  • Every attack requires the attacker to already control the SIM, and while Qualcomm has produced a hardened configuration disabling the interface by default, no vendor had published a public advisory yet

A malicious SIM card can instruct the device it sits in to run commands of an attacker's choosing, and on the cellular modules embedded in electric vehicle chargers, industrial routers, and car telematics units, essentially allowing it to take the entire device over.

Researchers from the University of Birmingham and the German security firm Fuzzware demonstrated this against a commercial Autel EV charger, achieving...

Copyright of this story solely belongs to techradar.com. To see the full text click HERE