How do SIM Cards work? - SIMtrace 

LiveOverflow also in the early 2000 some SIM cards used some form of weak crypto which allowed to actually extract the key from the card with cryptanalysis. This allowed for multi-sim cards that allowed you to store multiple keys (multiple virtual SIM’s) of one card and then switch between them on the fly. It was some good stuff, but then they upgraded the crypto and the whole thing disappeared.

Nice video

fun fact: the sim can receive new applications over the air. there are certain security vulnerabilities in that area that have not been fixed physically. you need to MITM the GSM network though to make some fun things.

+Jan-Stefan Janetzky could you point to an paper or article or something detailing this? isn't doing an MITM on the GSM network trivial or is that only for mobile internet access?

So whats difference in Esim?

some carriers/sub-carries like VOXI issue SIM cards in the standard credit card size, with cutouts and small plastic tabs to every size under that, so you could "snap" out the size you need. (www.cordbusters.co.uk/wp-content/uploads/2020/09/voxi-sim-card.jpg)

Generally most phones use Nano-SIM today.

wow, now I finally know why the 'normal' was called 'mini' lol, never given it too much thought but now it makes sense.

micro and Nano now both exist as well..

atomic sim when

on iPhones you also have the cryptex and SEP, along with the main SoC and BB.

You usually have storage on your phone. All bulk storages have a separate cpu responsible for actually controlling the storage system.

Baseband almost always is a dedicated core, but I think many SoCs include it on-die. Bluetooth/WiFi usually also have their own "CPUs". They are usually called Radio schedulers. Their timings are very important so they need to run bare-metal without an OS scheduler. Many of today's smart sensor chips also include tiny 8-bit or even 32 bit ARM (e.g. Cortex M0) processor cores, also the main CPU usually has an on-die secure enclave core. They all communicate with the main CPU via SPI,I2C, UART or even DMA access.

Whoa, Thats cool as fuck.

Thanks.....

I can recommend that "secret life of sim cards", just watched it recently.

I immediately thought about one of these videos I had seen a few months ago but couldn't remember where it came from... Thank you so much !

Videos in order ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-31D94QOo2gY.html ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-qKCQ1KL9GEc.html ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-scArc93XXWw.html

Forget Java. Spill some *vodka* into cup in _Java logo_ ...

Wow! I didn’t know you were taking up Java Boris. Good luck on that!!

ayy big boris?

Is that neighbor Vadim?

oopa boris {in slavic accent}

I suppose you could, but these smartcards have no GPU in them...

​@@CoolKoonmaybe a terminal based pc?!

​@@CoolKoonevery CPU can work as GPU and GPU can be connected externally.

@@309electronics5 Heh, good luck trying to change the firmware in it (there's a 99.99% chance that you can't).

@@norbert.kiszka "every CPU can work as GPU" - That's simply not true. CPUs in general are not able to generate a signal necessary for driving a display, obviously the C64 mentioned above has used a dedicated chip for that too. All it can do is to generate the picture stream that would be sent to said graphic chip. And the second part of your comment ("GPU can be connected externally") is even bigger nonsense, unless you have a VERY fast interconnect (in embedded electronics you usually don't) you CANNOT. That's why oftentimes they just slap a GPU next to a GPU and call it a SoC.

There's microcontrollers dedicated to haptic feedback and motion data as well and don't forget the USB c multiplexer

And even many of those systems consist of multiple "independent" processing units. For example, a cellular modem may have up to 5 processors for various tasks (software radio, programmable filters etc.).

yup

The real number would be >15 billion devices once you sum up all mobile phone for example… Unless you meant “daily use”, when even then it is probably more, since NA and Europe alone have 1 billion users. “The first cell phone was produced by Motorola. Since then there have been produced around 17.37 billion mobile phones.” Most of these would’ve supported java in some shape or form.. Probably only the first few 100 million at the 80s early 90s didn’t do java..

I wonder if not all SIM cards run Java. The phone doesn't have to know whether it runs Java or not since it only communicates data back and forth, it never needs to upload Java bytecode to the SIM card.

Siana Gearz I think the operator decides whether they want to implement a java-application or not. Still, nearly all phones produced have had some sort of support for Java on them..

... to be accessible to some power-users.

You mean store the original game data on one? non-possible. Sims only have around 8 bytes on the card

GameMaker 3_5 don't crush my dreams

Wrong. SIM cards can have up to 256KB of memory space.

that means we can actually produce smart cards as a VERY secure way of saving data? very nice

@@AtmelKiller thank 4 correction but I don't think the original doom (or even chex quest) could be stored on a SIM even without storing saves on the card

Do you have more information about tracing the APDU commands using a UART? As far as I know was the SIMTrace build by Osmocom specifically because you can't passively sniff ISO7816 communication (at least not reliably and according to the specs) unless your UART can work in ISO7816-mode. But would be nice if we could passively sniff ISO7816 without special hardware. So please share more information about how to "trace the apdu commands using a uart". Thanks!

Well, nowadays they are on the same SoC so not entirely wrong

Yeah the radio baseband CPU is what talks to the SIM and the cell network. I remeber back in the days of Windows CE phones you sometimes had to make sure you had the correct firmware in the baseband CPU when upgrading OS or it might not be able to connect to the cell network, even seen error messages saying that the radio is not responding when things went wrong with it. But you could take this even further. A lot of otherwise dumb components have hidden CPUs in them, technically making them computers too. A lot of other radios have dedicated CPUs for them like WiFi, bluetooth or GPS. The SD memory card is also hiding a CPU inside as a memory controller and so are eMMC flash chips often used for onboard flash storage. But it does not end there, a lot of chips can act autonomously so that they only bother the main application CPU when needed, for example there is a tiny CPU in the touchscreen controller chip that sits on the glass panel, it scans the matrix of conductors and does math to decide when a touch is detected, calculates the center coordinates and then sends that to the main CPU with an interrupt. So the actual number of computers in a modern phone is probably closer to 10. Some of these can be hacked to carry a virus such as an SD card, but hacking a touchscreen controller is probably not a viable thing as the chip is very underpowered and runs its code from a factory ROM with not even the capability to execute code from RAM.

berni8k You are confusing CPUs and microprocessors.

@gyroninja CPUs are the main building block of a microprocessor, everything else in a microprocessor is just there to help the CPU run, like provide it memory access, clocks, power etc. I think "something containing a CPU" can be reasonably called a computer. Just that some CPUs are really under powered and limited. Ones that run the digital timer on a microwave or play a melody in a greeting card. Really slow 8bit computers that have a total of a few kilobytes of memory, but provided you changed there program they could still do anything else(Within there under powered limitations naturally).

1) Depends on the access level you have, see VVV 2) Yes, you can write and compile them, but for commercial SIM-cards you need to know the secret keys to install your own apps :/ Please see "Hello World": git.osmocom.org/sim/hello-stk/tree/src/org/toorcamp/HelloSTK/HelloSTK.java

It actually not a computer, it still need it's host computer to execute the commands

In india, people have used this sim gui-api to make games. People there have actually produces games on the sim card using an api meant for debugging. The distribute games that are stored on sim-cards

Also the SIM must have a JavaCard Virtual Machine(JCVM) and JavaCard runtime environment(JCRE) loaded.

SIM cards use the Global Platform standard for managing the apps.

Aaron Ramsden IDK what path to choose

RobbenFan Python is what I'm learning at the moment, it's pretty fun, but I'm not sure how to get into hardware stuff yet

*+Aaron Ramsden* then you're wasting your time. If you want to go low level, proceed with C/C++, and if you want to decent further onto the bare metal try assembler, but only once you got the hang of C.

TheDragShot I mean, In my opinion. Python is not bad to learn to start off with. Besides, diving headfirst into low level languages and machine code is obviously very daunting on someone who is just starting out, like me.

TheDragShot noted, But it's never a "waste of time" learning something you're interested in

Thats not a nokia 3310

I've broken a 3310 by just keeping it in my pocket with my house keys... I'm convinced that I have some kind of curse: any time I own an electronic device that isn't broken in some way it finds some way to remedy the situation...

It required over 20 years of brute force but we finally cracked it

Probably dropped another Nokia on it..

Use nokia for brick

And where are you watching this?

Dimon Sq That came to my mind as well.

Disigned in Finland but made in India, you can see the label at 4:10

+Amazon Echo Well, this phone's language is set to Russian.

+Amazon Echo True. I'm not sure why you are saying that Nokia isn't russian. I think it's obvious that by "russian nokia phone" they meant "nokia phone with its language set on russian".

bruh....

How did the oroject go, 2 months kater?

can you send me an email or msg me on twitter? I know that in other areas of the world these SIM applications are used a lot and would love to learn more about it!

The power management and ADC controller is usually not a processor but a simple state machine with minimal flexibility. The whole purpose of it is keeping the analogue domain out of the fully digital SoC. You know what is though? The eMMC disk drive usually is a processor. Samsung uses ARM, others have something else, but they have firmware stored on the same flash as the data.

Yes its usualy the baseband CPU. But depending on where you draw the line you can find a lot more CPUs. Things like SD cards and eMMC flash storage have CPUs doing the job of a memory controller. Other radios like WiFi, Bluetooth, GPS etc tend to have dedicated CPUs to run them. Even dumb looking things like a touchscreen controller has a tiny CPU inside to scan the touch matrix, decide when a touch occurs, calculate the center coordinates and finally send them to the main application CPU. Even something as simple as an accelerometer/gyro chip could have sometimes a CPU inside. But these deeply embedded CPUs usually run code from ROM so are not viable to hack.

@@berni8k while mask ROM microcontrollers usually make for the least interesting targets, the firmware can be susceptible to ROP, basically reusing existing ROM code and invoking it by smashing the stack.

@Siana Gearz Yes technically it is possible, but there is very little code inside so its difficult to find useful snippets, there is very little RAM (Proabobly

Like

Yep you can emulate a SIM card in software. But the cell tower will only accept you on the network is you prove you have the correct secret key by encrypting things correctly, this key is very difficult to extract from the SIM card.

Your service provider can unblock your PIN/PUK with the ADM1. Only they now what this value is.

Sorry for your perfect English?

Thanks!

I don't think so. Flash and EEPROM are usually capacitive, storing data as electrical charge on the gate of a MOSFET. But you can't see electrons with a microscope! You can read Mask ROM with a microscope.

You can't read flash memory using a microscope. But what they do instead is poke the bare die with microprobes while the chip is running so that they can look at the data bus of the internal CPU while its reading the key from memory. Obviously this is very difficult do to so its not practical, but people do this a lot to get the keys for satellite TV out of cards. Once they have the key they can make as many clones as they want and sell them cheap to people who want to watch the good channels.

High End smart cards, like those used in chip based debit or credit cards, actually has protection mechanisms against probing attacks. It can, for example, detect when the NVM is breached and will then stop executing code - a security reset will be triggered.

@Gerhard van Deventer Actually credit cards use the least secure smartcard chips. This might seam counter intuitive at first since there is actual money on the line here, but for the criminals to do this they need to physically steal your card, at that point they might as well just use the stolen card rather than make a copy, besides once you can't find your card for a few days you will report the lost card to the bank so that they deactivate it and make it useless in an instant. As a result these cards are secure enough that you can't simply make a copy in a few minutes, but don't have the more advanced security features because nobody would bother to try that hard. However smartcards used for satelite and cable TV don't have two way communication back to a server so they can't remotely detect suspicious behavior and block the card. This allows someone to hack a card, make 1000s of copies and sell them for profit to people who want to watch the fancy channels on the cheap. This makes a hacked satelite TV smartcard much more valuable than a hacked credit card. As a result the people who buy the card from the manufacturer are willing to pay extra for a more secure smartcard model and these cards have such advanced security methods like hard to etch trough layers, snaking patterns to detect intrusion, hiding important signals on deeper layers etc.

@berni8k This isn't true. I actually develop software for SIMs and debit cards. The security requirements for debit cards are very high. To get certification from MasterCard, for instance, your card has to hold up to all sorts of penetration testing, such as probing attacks or deferential power analysis. You are right in that its easy to block your card if its stolen. The problem is that if some one can obtain the keys necessary to do authentication and to generate or verify certificates that is used during a transaction. These keys aren't unique per chip, just as for satellite or cable TV. So yes these cards must be super secure. SIM cards on the other hand typically uses way less secure chips.

Now you've got me curious about benchmarking a sim card, overclocking it and running Doom on it.

something like super mario bros 😊

Nope. But patience :P

Sultan Mustapha Jallaludin Pasha Han zindabad

Yes

Only if you install a special cardlet for that, I think.

Private messages, what kind? SMS, Email?

Yes if you have the secret key inside to decrypt it again. The cellular service provider has a copy of that key (because they are the ones who sold you the SIM card) so that they can decrypt your calls and messages while someone else listening to your cellphones radio traffic can't decrypt it.

I hope it has not log4j on it tho xP

hahaha

those guys made these stuffs where did they go

You're describing open source...

basically yes but most of the things are not

Because the less people know about the security mechanisms, the more secure they are.

I bet he doesnt kiss ya

Same here

No.

Only in full HD and 50 fps 😒