CAPEC-614
Rooting SIM Cards
2015-11-09
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
SIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets. This attack leverages over-the-air (OTA) updates deployed via cryptographically-secured SMS messages to deliver executable code to the SIM. By cracking the DES key, an attacker can send properly signed binary SMS messages to a device, which are treated as Java applets and are executed on the SIM. These applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse.
Thông tin CAPEC
Điều kiện tiên quyết
A SIM card that relies on the DES cipher.Kỹ năng cần thiết
This is a sophisticated attack, but detailed techniques are published in open literature.Các biện pháp giảm thiểu
Upgrade the SIM card to use the state-of-the-art AES or the somewhat outdated 3DES algorithm for OTA.Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol. |
Tài liệu tham khảo
REF-486
Rooting SIM CardsKarsten Nohl.
https://srlabs.de/rooting-sim-cards/
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Motivation-Consequences | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns |
