Defcon 21 - The Secret Life of SIM Cards
Why Hacker News recommends it
HN cites it as the go-to overview of what SIM cards can run and do, usually in threads about Java Card, SIM attacks or phone security.
What it is
A DEF CON 21 talk by Karl Koscher and Eric Butler on how SIM cards work, including Java Card applets, the SIM toolkit and the OS running on the card. It shows how much control the network and the card have independent of the phone.
Recommended by 3 HN commenters across 3 different months, 2014 to 2026.
What Hacker News said
Recommends adamnew123456 · 2021-04 · on “This Blog is now hosted on a GPS/LTE modem”
Seeing the ShadySIM project mentioned on that page reminded me of this DEFCON talk, which talks about some of the capabilities of the SIM OS (some of them run Java!) and what power they grant you over phones if you have control over the underlying cell network (legitimately or otherwise). [this video]
Recommends Silasdev · 2021-11 · on “What is AT&T doing at 1111340002?”
This video from defcon gives a good overview of what Java Card applets is, the limitations and what it can do: [this video]
Recommends comboy · 2021-12 · on “Apple said to be preparing for iPhones without SIM card slot in 2022”
There was one really good talk about from black hat or defcon [1] but there's also this [2] which seems more thorough so I'm gonna watch it too later. I happen to have a friend who writes software for simcards so that's what really was my main source. 1. [LINK] 2. [this video]
Cites e12e · 2014-06 · on “The Elephant was a Trojan Horse: On the Death of Map-Reduce at Google”
Indeed. And it runs today (on among other things) sim cards. See eg: "Defcon 21 - The Secret Life of SIM Cards" [this video]
Cites paulmd · 2018-05 · on “US cell carriers are selling access to real-time phone location data”
The SIM card is a separate OS that gets underneath the SOC's OS. It can run its own applets without the knowledge or permission of the SOC OS. [this video] The baseband is a completely different RTOS as well. And then there's also TrustZone running in the SOC as well.
Cites recoil · 2019-05 · on “Go Is on a Trajectory to Become the Next Enterprise Programming Language”
> Java is essentially never used for serious embedded work. I don't know whether it counts as "serious" to you, but literally billions of SIM cards and credit cards are running JavaCard: [LINK] [this video]
Cites garaetjjte · 2019-09 · on “SIM Vulnerability leads to information disclosure via malicious SMS”
When I recently watched this talk, [this video] , I wondered about that, that is if malicious STK app from network operator could execute AT commands on phone (and compromise device using commands from [LINK] ). But from what I gathered from cursory search, RUN AT COMMAND isn't supported by most devices. (ETSI TS 102 223 states "This clause applies if class "b" is supported by the terminal and enabled by the subscriber through the terminal. ")
Cites paulmd · 2019-10 · on “New 'unremovable' xHelper malware has infected 45,000 Android devices”
Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever. [this video] There are only so many places it can be hiding if it's surviving a factory reset. --Guy who is undoubtedly vastly underestimating the problem given that it's resisted AV vendors for a while