The secret life of SIM cards (2013) (opens in new tab)

i hate to be that guy, and without actually trying to start a flamewar or "who's better", I find it really interesting that americans are so great at marketing things, the german stuff works, but usually looks crappy. here's a CCC talk from 2011 on the topic [1]

you could observe the same thing when the ccc guys had their first gsm phones. Someone just showed up with a base station in the trunk of his car. compare that with the huge buzz that went around the same thing at defcon a couple of years ago. The defcon truck definitely looked WAY cooler.

but on topic what's actually really scary about this is that even newer smartphones would allow sim exploits to roam free. contrary to what you may think it's not just old phones.

[1] http://events.ccc.de/camp/2011/Fahrplan/events/4427.en.html

EDIT: while technically not exactly the same as opensimkit here's an answer to the why question posed by jacob appelbaum. I suspect the same applies here(and it's not really a bad reason either)

https://mailman.stanford.edu/pipermail/liberationtech/2013-J...

In Kenya, the SIM card application is very important as most Telecommunication companies have important services that they offer thorugh the application. These include Mpesa, Airtel Money, YU Cash and Orange Money among other services.

The iPhone has a menu option within Settings > Phone > Sim Applications where these are displayed. I haven't seen this on other SIM cards

It reminds my good days programming simcards, i was the founded of a startup in Brazil that made a good use of simcard programming to store two numbers in the same simcard, around 2010 it's a cool and profitable, the thing is that i managed to insert a local imsi and an a north american imsi registered in the same card so everyone that travel abroad could be free of expensive roaming charges, them we sold the company and now days they are a reseller for some major carrier in US =)

Wait, what? They're unknown in the U.S? Then what in the world are they using over there?

In the public health space, these SIM applications on programmable SIM cards (pass-through sandwiched with parallel carrier SIM cards) are very useful for data collection: See Medic Mobile and http://vimeo.com/45532467 https://groups.google.com/forum/#!topic/ict4chw/5WKV3c6RfEU

In Norway we can use a SIM application to log into the bank. Don't know how it works, but here's a introduction in English: https://www.bankid.no/Dette-er-BankID/BankID-in-English/Bank...

They did not mention who was their SIM vendor but each SIM vendor is using their own design for the metal contacts. One could find which vendor was trying to sell them the software which they did not own for $600.

We need to get rid of the SIM card and the closed basebands if we ever want to save the internet / PC / FOSS that permitted this open ecosystem... #KeysToTheUsers

These must be pretty small applications -- don't SIM cards have under a megabyte of storage capacity?

It seems it would be a lot of fun to hack on these with some version of Lua. A reference counted variant might be more suitable.

Havent had a chance to watch the presentation, perhaps its already answered there: Are these totally locked down or is it within realms of possibility to take out the SIM card from an average GSM phone and start poking around, adding one's own applications.