13
Simjacker
Technical Report ©2019 AdaptiveMobile Security
Figure 4: Distribution of number of attacks per each subscriber Over
69% of targeted Mobile Subscribers were only targeted on one day, a very small number were targeted almost every single day.
Figure 5: Number of Attacks per Subscriber v Number of Days Subscriber was Targeted 14
Simjacker Technical Report
©2019 AdaptiveMobile Security Overall, we can see that a large amount of targeted subscribers are only queried once. On the other hand, a few subscribers are intensely tracked overlong duration periods. There is also along continuum in between these two extremes.
Generally, the system seems to be used for multiple different tracking models.
4.2
Information Retrieved The primary objective
(89.19%) in these attacks is to obtain both Location Information according to current NAA (Serving Cell ID) and IMEI of the terminal. These are obtained via the Proactive Provide Local Information command. Other Proactive commands are also intermittently
(4.25%) executed.
Figure 6: Types of Proactive Command Executed Other Activity in this case are commands that the attackers execute probably for testing of the functionality and effectiveness of the attacks, i.e.
• Display Text (Test Messages,
• Launch Browser (Test
websites,
• Set Up Call (test recipient number) and
• Send USSD (test PIN change)
15
Simjacker Technical Report
©2019 AdaptiveMobile Security The breakdown of Information retrieved is of the following type
Share with your friends: 
