Encryption Flaw In SIM Cards Can Make Your Phone A Possible Accomplice In Crime

Karsten Nohl, founder of Security Research Labs in Berlin, has discovered a flaw in the encryption technology used in some SIM cards that may allow cyber criminals to take control of a person’s phone. The security expert says that the encryption hole allows outsiders to obtain a SIM card’s digital key that opens the chip up to modification (via The New York Times).

With a SIM card’s 56-digit sequence in hand, Nohl was successfully able to send a virus to the SIM card through a text message, which let him make purchases through mobile payment systems and even impersonate the phone’s owner. According to the German researcher, he managed the whole operation ‘in about two minutes, using a simple personal computer’. He further claims that as many as 750 million phones worldwide may be vulnerable to such attacks.

“We can remotely install software on a handset that operates completely independently from your phone,” Mr. Nohl said. “We can spy on you. We know your encryption keys for calls. We can read your S.M.S.’s. More than just spying, we can steal data from the SIM card, your mobile identity, and charge to your account.”

Mr. Nohl said the flaw he had discovered was the result of an encryption method developed in the 1970s called data encryption standard, or D.E.S. After uncovering the breach, he researched the pervasiveness of the problem by testing about 1,000 SIM cards on cellphones running on mobile networks in Europe and North America over a two-year period.

Currently, D.E.S. encryption is used on about half of the about six billion cellphones in use daily. While most carriers have adopted a stronger encryption method, called Triple D.E.S., majority of SIM cards are still running the old standard.