Malicious SIM Cards Can Execute Code on Cellular IoT Devices and Some Phones

Vulnerability Discovered in Cellular Devices

Security researchers from the University of Birmingham and Fuzzware found that a malicious SIM card can instruct certain cellular devices to execute attacker-chosen commands. This capability could allow for a complete takeover of devices such as electric-vehicle chargers, industrial routers, and car telematics units.

Affected Hardware and Scope

Out of 26 phones and cellular modules tested, nine were found to be vulnerable. This included six of eight cellular modules and three of 18 phones (OPPO Find X5, OPPO Reno 14 F 5G, and ASUS Zenfone 9). The exposure is primarily in machine-to-machine hardware, with five of the six vulnerable modules being Quectel parts, often found in unattended IoT gear with accessible SIM trays. All nine vulnerable devices utilize Qualcomm communication processors.

Attack Vector and Mitigation Efforts

An attack requires physical access to insert a hostile SIM card. Qualcomm has developed a hardened configuration that disables the vulnerable interface by default for future devices. Quectel has mitigated a file-access flaw and is working on the interface itself. Neither company has published a public advisory, and the module maker's vulnerability portal requires a login to view information. Researchers recommend hardening, deprecating, or disabling the interface entirely.

Recommendations for IoT Fleet Operators

For operators of cellular IoT fleets, the immediate step is to inquire with module suppliers whether the 'RUN AT' command is enabled in their firmware and if it can be disabled. While fixes are expected to reach affected modules via updates, it is unclear if the code paths will be removed or merely switched off. No attacks exploiting this interface have been reported to date.