Simjacker is a vulnerability that allows hackers to exploit SMS commands to gain control of mobile devices. The document discusses: 1. The history of STK and how it allows SMS-based menus and commands to be sent to SIM cards, including sending location data and making calls. 2. How the Simjacker vulnerability works by sending SMS commands from an unauthorized number or platform to exploit the STK functionality. 3. Recommendations for networks to protect against Simjacker like prohibiting direct STK SMS messages and continually monitoring and assessing networks for vulnerabilities.

1. Simjacker:
how to protect your network from
the latest hot vulnerability
Sergey Puzankov
Lead Security Researcher |

2. Ongoing
security research
Responsible disclosure – responsible attitude
2014
Signaling System 7 (SS7)
security report
2014
Vulnerabilities of mobile
Internet (GPRS)
2016
Primary security threats
to SS7 cellular networks
2017
Threats to packet core
security of 4G network
2017
Next-generation networks,
next-level cybersecurity problems
(Diameter vulnerabilities)
2018
SS7 Vulnerabilities and
Attack Exposure Report
2018
Diameter Vulnerabilities
Exposure Report
2019 5G security issues

3. Simjacker publications

4. V
V
V
History
of the technology
VSIM Application Toolkit (STK)
implements an SMS-based menu
STK menus customized by MNOs
SIM card providers try to unify
their solutions: S@T Browser
is just one of the unifications
Typical STK operations:
 Send location data
 Send an SMS to a particular number
 Make a call
 Initiate a packet data session
 Send internal IDs
 Beep loudspeaker

5. History of
the vulnerability
https://www.theregister.co.uk/2013/09/23/white_hat_sim_hacker_disillusioned_and_dismayed_by_operator_response/
https://securityaffairs.co/wordpress/31663/hacking/hacking-4g-usb-modems.html
V
2013
V
2014
V
2019

6. Short message service
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers

7. Simjacker malefactor
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers

8. Mitigation
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers
Prohibit P2P STK SMS
messages
Prohibit STK SMS
messages from
unauthorized platforms
SMS-C
Prohibit STK SMS
messages from
external connections
to home subscribers
SMS router

9. Mitigation
VMT SMS message with SIM STK command VMO SMS message with SIM STK command

10. Advanced hacker
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers

11. Assess your network
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers
?
?

12. Assessment statistics
2017 2018 2019

13. Protect
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers

14. Add monitoring
SMS-CMSC MSC
SS7
STK platformSMS router SMS-CSTP
VAS
providers
TAD
TAD

15. Assess
Monitor
Protect
Auditing provides the essential
visibility to fully understand your
ever changing network risks.
Continual real time monitoring
is essential to measure network
security efficiency and provide
rapid detection and mitigation.
Completely secure
your network by
addressing both
generic vulnerabilities
(GSMA) and the
threats that actually
effect you as an
ongoing process.
Delivering
Signalling
Security
With Positive
Technologies

16. Scheme of the demo
MSC
SS7
STK platformSMS router SMS-CSTP

17. Thank
you