AdaptiveMobile Security Simjacker Technical Paper 01


Figure 7: Type of Information being Retrieved



Download 3.33 Mb.
View original pdf
Page11/29
Date20.12.2023
Size3.33 Mb.
#62999
1   ...   7   8   9   10   11   12   13   14   ...   29
SimJacker
SIM-Swapping
Figure 7: Type of Information being Retrieved
4.3
Simjacker Attack Packet Format
4.3.1
High Priority Push v Low Priority Push
The vast majority (99.23%) of Attack messages sent in this period were ST Browser Low Priority Push messages. High Priority Push messages were only used when targeting the same victim in quick succession after a Low Priority Push message, see Section 3.2.2 for more details on how exactly this works.
4.3.2
SMS Packet Header Encoding
Within this specific time period, we observed over 1000 different types of encoding
combinations attempts of the Simjacker Attack Packet Header i.e. the Protocol ID, message class and the user data header. We believe that the varying encoding combinations of the header was done to attempt to avoid Mobile Operators network defences (see sections 5.1.3).
4.3.3
Simjacker Attack Message Variants
Within this specific time period, we observed we detected over > 860 Simjacker Attack
sub-variants in the actual SMS Packet. We identify variants that execute different features, have different values (excluding source/exfiltration addresses) and different Variable IDs.


16
Simjacker Technical Report
©2019 AdaptiveMobile Security We believe the variations in the actual Simjacker Attack packet itself was done to also potentially avoid defences, or potentially to tailor the attack per specific Sim card type. Section 5 explains in more detail the techniques used by the attacker.
4.4
Infrastructure Used by Attacker Network
Sending Attack Message In this period, the Sending Infrastructure comprised of over 70
sending number of devices sending the attack messages. The main sender sent nearly 22% of attacks, but most sending devices sent less than 5% of attacks in this time.
Figure 8: Simjacker Sender % Volumes
Receiving Data Message Within the Simjacker Attack Messages, we identified over 60

Download 3.33 Mb.

Share with your friends:
1   ...   7   8   9   10   11   12   13   14   ...   29




The database is protected by copyright ©ininet.org 2024
send message

    Main page