SIM card exploit could be spying on over 1 billion mobile phone users globally

Researchers at a security firm named AdaptiveMobile Security have issued a report (via TNW) about a new vulnerability nicknamed Simjacker that uses your phone's SIM card to spy on you. Because all makes and models of mobile phones can be used with Simjacker, over 1 billion handsets might be affected globally. The research firm says that it believes the vulnerability was developed by a private company that works with governments to monitor the locations of individuals around the world. The exploit also can help the attackers obtain the unique IMEI number belonging to each phone.

Some SIM cards supplied by GSM carriers contain what is known as the S@T browser found in the SIM Application Toolkit. Once used to launch browsers (like the WAP browsers found on feature phones back in the day), Simjacker sends a binary SMS message to the browser with instructions for it to obtain the location data and IMEI numbers and send the information to an "accomplice device" also using binary SMS. Since smartphones can use HTML browsers, the S@T browser has become obsolete. Despite this fact, AdaptiveMobileSecurity discovered that carriers in 30 countries representing over 1 billion mobile phone users have S@T technology active. That might overstate the actual number of those affected by the exploit since many carriers are no longer using SIM cards equipped with the S@T browser technology.