I have discovered a new vulnerability in the GSM network and I’m going to present it at EUSecWest which is held in Amsterdam, Netherlands on September 19/20. The presentation title is “Using HTTP headers pollution for mobile networks attacks” and basically I’m going to show how you could exploit the operator’s WAP homepage and perform attacks on a specific MSISDN.

There are also some other interesting talks, mostly on mobile security and let’s not forget about Mobile PWN2OWN.

So, if you want to find some new interesting things about mobile security,  then please register for EUSecWest!

See you in Amsterdam!

1. On phones with Android you should remove the STK.apk application – right, but what if your phone is not rooted? Also since I’m not much into software / programming, I really doubt this would work because you will indeed not be able to access the SIM Toolkit application from your phone, but that doesn’t mean that your phone won’t be able to process STK commands issued by your SIM card

2. On phones with Windows Mobile, remove the HKEY_CLASSES_ROOT\SimToolkit.UI from the registry – this was something that I spoke of, but again, like the Android case, your SIM card still initiates commands, even though you can’t access the applications stored

3. Ask your mobile operator to disable premium rate charging – although somehow it’s true as your operator can disable calling to such number, it can’t disable texting If you know such carrier, feel free to post a comment.

What else you should keep in mind is that the method used has to be convenient to everybody: people still want to use mobile banking, they still want to be able to check for the available credit from the Toolkit menu, they don’t want to jailbreak, root or cook their own ROM (this is for smartphones), not everyone holds a smartphone. Pretty tough to find a solution, right?

Well, not quite – I think the following solution is the most convenient as it takes care of most of the mentioned requirements.

So, in order to somehow protect from SIM Toolkit crafted SMS attack, just go to the settings of your messages, select the profile used for SMS and edit the message centre number by removing the last digit from it and save the settings (write down the full number first!). Pretty nice, right? So what have you just done? You have modified the number used by your phone in order to send messages. Yes, you still have access to the toolkit application, but you will not further be able to use any application that requires to send a message and also you will not be able to send any text messages anymore. However, receiving of SMS is not affected. Why to try the hard way – modify the entire software on your own – when there is a better and simpler solution?

Disclamer: I am NOT responsible in any way for any wrong functionality of your phone, so if you have no idea what you’re doing, it’s better to leave it that way.

Even with this solution, be careful of one important thing: some carriers are charging you even if the message was not actually delivered or you used a wrong message centre! Yes, you read that right: you could still be charged! The best way to test if your network operator does this is by using a prepay SIM with no credit on it, modify the message centre number and send a text message – your phone will inform you that it could not deliver the SMS. If you get back a message from the network saying that you don’t have enough funds, that’s bad: you will be charged anyway so you won’t be protected. Maybe you should switch to a different carrier?

I’m not saying that this method is the best, but it’s something it works in most of the cases. Let me know your findings.

I must say it was a real pleasure to attend the DeepSec 2011 edition. I’ve met a lot of interesting people and all the talks were great. Since it was my first time I held an international talk with such large audience, I was a little bit excited, but no matter what, I still consider I did a pretty good job. By now I only got positive feedback

To answer some of the frequently asked questions:

1. The attack I showed has nothing to do with knowing the security keys as the response to the command is being sent even if there’s an error

2. The live demo worked – too bad I didn’t have a webcam to show you the target phone

3. There was no planning on who should volunteer for the live demo

4. The number you’ve seen during the demo is not the real number (only the first 3 digits were) and also wasn’t charged with 5 EUR – all it was just for the fun of it

5. The quickest way to protect is to change your phone to one that asks for your permission before allowing the SIM card to do something, or switch to another operator that doesn’t provide SIM cards with Toolkit Application on them – in Austria it’s at least one, as well in Romania

6. Pay attention to dual-SIM phones: some of them are not showing you the extra-menu belonging to the SIM application, so don’t get comfortable thinking that you’re protected

7. I’m not a hacker / cracker how the media likes to call the security specialists most of the times. My purpose was to make you aware of the danger of just using something like SMS

I was happy that right after the talk I’ve been contacted by RIM in order to send them the details to fix this. It’s good to see that someone pays attention to these details. As long as they agree, I’ll keep you up to date with how the things are going.

Thank you Lynx, MiKa, Manuela for this opportunity! I’m pretty sure I’ll see you next year also I also hope that next year there will be more people from Romania in the audience.

Below it’s a recording of my talk SMS fuzzing, SIM Toolkit Attack – I hope you’ll ignore my excitement

The slides from the talk can be found here (click me).

I wait for your feedback!