Researchers at the University of Birmingham have found a SIM card vulnerability that could let attackers gather information about an IoT device, interfere with its connectivity and serve as an entry point for further cyber attacks.

They presented their findings at this week’s Usenix Woot Conference on Offensive Technologies in Baltimore.

A feature known as proactive SIM allows a SIM card to send a limited number of special commands directly to a device’s modem. One of them allows the SIM to request the execution of so-called AT commands, the same type of commands used to control and configure modems since the 1980s.

The university’s Tomasz Piotr Lisowski and Marius Muench worked with Kristian Covic from German IT security company Fuzzware (fuzzware.io) to develop the Catana toolkit to explore the dangers of SIM-originating AT commands across different devices.

The researchers investigated 26 representative devices: 18 smartphones and eight cellular-connected IoT modules, including modules commonly embedded in electric vehicle chargers, industrial equipment and connected cars. Devices studied were not limited to any single manufacturer or operating system.

After identifying that several analysed devices would execute SIM-originating AT commands, the researchers used Catana to demonstrate the threats of the resulting SIM AT interface, leading to the discovery of multiple security vulnerabilities.

Example attacks enabled by the presence of a SIM AT interface include: re-enabling closed-down debug interfaces; exfiltrating sensitive information, such as a device’s unique identifier; sending messages or initiating calls; obtaining arbitrary command execution capabilities on a victim’s communication processor; forcing a device to downgrade from secure 4G connectivity to older and less secure 2G networks; shutting down the victim device; and disabling cellular communications altogether.

“The fascinating part here is that the proactive capabilities of a SIM and the resulting attack surface is explicitly defined in the technical specifications for cellular communication, resulting into specification-compliant attacks,” said Muench, assistant professor in computer science at the University of Birmingham (www.birmingham.ac.uk). “Other researchers, cyber-security experts and leaked intelligence documents have shown some of the dangers of hostile SIMs before us. Yet, the resulting risks have not been fully mitigated. Potentially, this is because hostile SIMs are not included in most threat models, although we slowly see a promising shift here.”

Building on their earlier work, the research team highlights four attacker scenarios leading to malicious or compromised SIMs and eSIMs, supported with precedents from real-world incidents:

• Remote attackers exploiting vulnerabilities in SIM software;
• Physical attackers replacing a victim’s SIM card or installing a hardware implant;
• Compromised operators abusing remote SIM management features; and
• Supply-chain attackers modifying SIMs during manufacturing or distribution.

The researchers point out that the risks of SIM-originating AT commands are especially relevant for IoT devices such as industrial equipment, vehicle systems or routers, as these are often locked down with only a limited number of exposed interfaces. The presence of a SIM AT interface could therefore serve as unforeseen entry vector for further compromising the victim device.

The study also comments on the more general risk of proactive SIMs, which can turn victim devices into surveillance tools. During the work building up to the publication, the researchers discovered that, on recent Android devices, a malicious SIM could force the phone to open an attacker-controlled web site without any user interaction, even when the phone was locked.

The researchers argue that many proactive SIM features are legacy technologies that were built only with benign SIMs in mind. However, as technology and threat surface are evolving, many features are no longer needed and create unnecessary security risks.

“At Fuzzware, we are very happy that we could support this research project,” said Covic. “Hostile SIMs are an overlooked attack vector, and it’s great that we could show this with our work.”

The researchers did not stop at finding the vulnerabilities. They also reached out to the GSMA, as well as affected chip- and device manufacturers to address the found issues.

“It was great working together with the affected companies and the GSMA,” said Muench. “Our reports were treated seriously, and key manufacturers made software updates and hardened configurations available to their customers. This will benefit billions of future SIM-enabled devices operating worldwide, including smartphones, connected vehicles, payment terminals, routers, critical infrastructure and EV charging systems.”

Lisowski added: “The attacks we found only scratch the surface of what is possible with hostile SIM cards. We will keep working on bringing more of the attack surface to the public light and hope to cooperate with vendors and standardisation bodies to remedy the risks in today’s and future devices.”

For more on the research presented this week, visit www.usenix.org/conference/woot26/presentation/lisowski.