AdaptiveMobile Security Simjacker Technical Paper 01
EXECUTE STK COMMAND Provide Local Information – Location Information
Download 3.33 Mb. View original pdf
|
SIM-Swapping
| 3. EXECUTE STK COMMAND Provide Local Information – Location Information according to current NAA This is a PROVIDE_LOCAL_INFORMATION that has a Command Qualifier of type Location Information. This is sent to the Handset. The response information from the Handset is the current serving Cell of the Handset, and is stored in Variable 2. 4. EXECUTE STK COMMAND Provide Local Information – IMEI of the terminal This is a PROVIDE_LOCAL_INFORMATION that has a Command Qualifier of type Terminal Identity. This is sent to the Handset. The response information from the Handset is normally the device IMEI, and is stored in Variable 3 5. S@T Create INIT Variable This is normally a set of repeated values, such ass or other values. We term this the Filler Bytes. This is generated as a form of pseudo-randomization in both the structure of the Attack Message and the subsequent Data Message. It can also be used as a form of lengthening of the Data Message. Multiple Filler bytes can be present, indifferent locations. In this example there is only one Filler. This is stored in Variable 4. Further use of this field is discussed in Section 5.1. 6. S@T Concatenate By using this ST Browser command, the preceding Output Variables are concatenated into a single string. In this example the concatenation sequence is SMS-SUBMIT Header+Cell- ID+IMEI+Filler. It is important that the SMS-SUBMIT Header specified earlier is the first element concatenated in the sequence, in order for the subsequent text message being sent to be deliverable. The order of the others can and does vary. The output of this is stored in Variable 5. 7. EXECUTE STK COMMAND Send Short Message This is a SEND SHORT MESSAGE Command, which calls the value saved in Variable 5. This string is then sent to the Handset, which then transmits it to the mobile network to the destination number controlled by the Attacker. As stated earlier, there is no interaction with the mobile user during any of this. There is also nothing stored in the target’s SMS inbox or Outbox, nor in their SIM card message store. 11 Simjacker Technical Report ©2019 AdaptiveMobile Security 3.2.2 Download 3.33 Mb. Share with your friends:
|