Deadly Simjacker on prowl: Hackers can hijack any phone

Smartphones, which offer the convenience of getting several services delivered with just click of buttons, has become not just an integral part of our lives, but also the extension of our hands. Already, there are two billion-plus people who own a mobile. But, becoming increasingly depended on the phones, has its drawbacks.

Despite several security measures in place, more and more naive device owners are falling prey to hackers and lose personal data like photos, work-related documents, or in some cases suffer financial loss.

In the latest development, Cybercriminals have developed a sophisticated tool Simjacker that can highjack a phone and steal sensitive information before the device owners can realise what hit them, AdaptiveMobile Security report said.

What's more worrying is that the Simjacker can be used to attack any type of device, be it an iOS-power iPhone or an Android-powered mobile from Huawei, Motorola, Samsung, ZTE and others. Even Internet-of-Things (IoT) with a SIM card can be infected.

Neither Apple nor Google or any mobile-maker for that matter can do anything about it.

Here's how the Simjacker works:

Simjacker can be infected to any mobile with just an SMS (Short Message Service).

It contains a spyware-like code, once, inside the inbox, it then instructs the UICC (SIM Card) within the phone to ‘take over’ the mobile phone, in order to retrieve and perform sensitive commands.

Simjacker flow chart (Picture Credit: AdaptiveMobile Security)

The report says the Simjacker attack exploits the presence of a particular piece of software, dubbed as S@T Browser - that is on the UICC (Universal Integrated Circuit Card).

Once the Simjacker Attack Message is received by the UICC, it uses the S@T Browser library as an execution environment on the UICC, where it can trigger logic on the handset. From there on, it can extract IMEI (International Mobile Equipment Identity) number, GPS location, make calls, illegally install malware and do other nefarious acts.

Must read | Google takes down Joker trojan-laced 24 Android apps

The report says that the onus is on telecom operators to upgrade their interface to plug the loophole in the system SMS message structure and the S@T Browser software being present on the UICC. This vulnerability is said to be found in 30 countries (unnamed), whose total population exceeds one billion.

AdaptiveMobile Security researchers are working on to detect definitive clues on whose behind this and believe, it might be the handiwork of private spy agency with close affinity to a government organisation. They may be using the Simjacker to track a terrorist or the enemy country's national leader or an investigative journalist or any other high-profile individuals.

Also read | Trojan Android PDF converter app found on Google Play

"In general, our recommendations for the mobile community to deal with the immediate threat is for mobile operators to analyse and block suspicious messages that contain S@T Browser commands. Mobile Operators could also try to change the security settings of UICCs in the field remotely, or even uninstall and stop using the S@T Browser technology completely, but this may be slower and considerably more difficult to do. However, this is very much only the first step, due to the greater implications of the Simjacker attacks," Cathal McDaid, AdaptiveMobile Security researcher said in a statement.

AdaptiveMobile Security has joined hands with GSM Association to develop new protocols and block future Simjacker attacks. It will also be detailing more information on Simjackers and its implication at Virus Bulletin Conference on 3 October in London.

Get the latest news on new launches, gadget reviews, apps and more on personal technology only on DH Tech.