Meta News

SIM cards are usually treated as passive components of mobile devices: small chips responsible for identifying subscribers and connecting smartphones, routers and Internet of Things equipment to cellular networks. New security research shows that assumption is dangerously incomplete.

Researchers have demonstrated that a malicious or compromised SIM can abuse legitimate functionality built into cellular standards to issue commands directly to a device’s modem. Depending on the hardware, those commands can shut down phones, steal files, execute arbitrary code or force modern 5G devices onto significantly weaker 2G networks.

What makes the findings particularly important is that the underlying mechanism is not necessarily an implementation mistake. Much of the functionality being abused exists by design within telecommunications standards.

The research, presented at the USENIX Workshop on Offensive Technologies (WOOT), examined so-called proactive SIM functionality, which allows SIM cards to instruct the devices hosting them to perform specific operations. (⁠theregister)

The findings challenge a fundamental assumption in mobile security: that the SIM should automatically be trusted by the device containing it.

Modern SIM cards are effectively small computers.

They contain processors, memory and software capable of executing applications and communicating with the phone’s baseband processor. Telecommunications standards intentionally provide mechanisms allowing SIMs to request actions from their host devices.

These capabilities exist for legitimate reasons.

Mobile operators may need to configure services, interact with network functionality or remotely manage aspects of subscriber connectivity.

One particularly important capability is known as RUN AT.

It allows the SIM to request execution of AT commands—the command language historically used to control modems.

AT commands date back decades, but they remain deeply embedded within modern telecommunications equipment. They can query device information, configure connectivity, manipulate network behavior and perform numerous modem-management functions.

Giving a trusted SIM access to those commands can be useful.

Giving a hostile SIM the same capability creates an entirely different security problem.

Researchers Tomasz Piotr Lisowski and Marius Muench from the University of Birmingham, working with Kristian Covic of Fuzzware, developed a research toolkit called CATANA to investigate how much control a malicious SIM could obtain.

They tested 26 devices, consisting of 18 smartphones and eight IoT modems.

Nine exposed an AT command interface accessible from the SIM.

The results were particularly concerning for IoT hardware:seven of the eight tested IoT modems exposed the interface. Researchers ultimately identified four vulnerabilities and demonstrated attacks involving arbitrary file access, denial of service, network downgrades and code execution. (⁠theregister)

The difference between smartphones and IoT equipment is significant.

Modern smartphones have benefited from years of intensive security research, hardened operating systems, sandboxing and frequent updates.

Cellular IoT equipment can remain deployed for many years with considerably less security scrutiny.

Industrial sensors, vehicle chargers, routers, payment terminals and other connected equipment may therefore expose capabilities that smartphone manufacturers have already learned to restrict.

One of the most serious demonstrations involved an Autel electric vehicle charger equipped with a Quectel EC25-AFX cellular module.

Researchers used SIM-originating commands to exploit a command injection vulnerability affecting the modem’s Linux-based application processor.

The result was code execution.

That demonstrates how the issue can move beyond manipulating cellular connectivity.

A malicious SIM can potentially become an entry point into the computing environment surrounding the modem itself. (⁠theregister)

For IoT and industrial environments, the implications are significant.

Cellular modems are frequently installed specifically because they provide remote connectivity to equipment deployed outside conventional corporate networks.

They may be found in energy infrastructure, transportation systems, industrial machinery, smart-city technology, payment equipment and remote monitoring systems.

If the modem itself becomes an attack surface controlled through the SIM, the security boundary surrounding those devices changes considerably.

Researchers discovered another striking example while examining an Oppo Reno14 F 5G smartphone.

The device exposed 198 AT commands and variants through the SIM-accessible interface.

Some could shut down the smartphone.

Others could terminate the modem.

One could force the device to abandon modern cellular connectivity and fall back to 2G. (⁠theregister)

The downgrade proved unusually persistent.

According to the researchers, enabling airplane mode, disabling the SIM and modifying network settings did not reverse the forced downgrade.

This matters because 2G networks were designed during a radically different security era.

Modern 4G and 5G protocols contain considerably stronger protections against interception and network impersonation. Legacy 2G connectivity lacks many of those safeguards and has historically been associated with attacks involving rogue cellular base stations and interception equipment.

Forcing a modern device onto an older network can therefore weaken the security assumptions surrounding its communications.

It represents a particularly interesting form of downgrade attack: instead of manipulating the radio network externally, the attacker can potentially instruct the device from inside through the SIM itself.

The attacks were not limited to availability or network configuration.

Researchers also demonstrated data exfiltration against a Quectel EG25-G modem.

By combining SIM-originating commands with a malicious symbolic link, they were able to cause a targeted file to be sent by email to infrastructure controlled by the attacker. (⁠theregister)

This is an important escalation.

A malicious SIM is no longer simply interfering with connectivity.

It can potentially become a mechanism for extracting information from the device hosting it.

For organizations deploying cellular-connected equipment, that means SIM security needs to be considered part of endpoint security rather than merely telecommunications administration.

The researchers also identified dangerous behavior involving Android’s implementation of another standardized SIM capability known as LAUNCH BROWSER.

On vulnerable Android versions, a hostile SIM could instruct the device to open an attacker-controlled website automatically.

No user interaction was required.

The attack could even occur while the smartphone was locked.

Google tracked the vulnerability as CVE-2025-48618 and patched affected Android 13 through Android 16 devices in December 2025. (⁠theregister)

The vulnerability demonstrates the broader challenge created by proactive SIM functionality.

The SIM is not merely presenting authentication information to the modem.

It can request actions from the operating environment around it.

Every supported action therefore becomes part of the security boundary between the SIM and the device.

There is an important limitation.

An attacker cannot normally exploit these techniques remotely against any random smartphone simply by knowing its telephone number.

The attacker needs control over the SIM.

That substantially raises the barrier to exploitation.

However, researchers identified several scenarios in which such control could potentially occur, including compromised SIM software, physical manipulation, supply chain attacks or abuse of remote administration capabilities belonging to a malicious or compromised telecommunications operator. (⁠theregister)

This changes how the risk should be interpreted.

For ordinary consumers, widespread exploitation is considerably less likely than conventional phishing or malicious applications.

For high-value targets, telecommunications infrastructure and large IoT deployments, however, the threat model becomes more interesting.

SIM cards are often remotely manageable.

Enterprises may deploy thousands of them.

Industrial devices can remain operational for a decade or longer.

And telecommunications supply chains involve multiple parties with varying degrees of control over subscriber infrastructure.

A malicious SIM therefore represents a relatively specialized threat—but potentially an extremely powerful one.

Perhaps the most uncomfortable finding is that attackers are not always circumventing the cellular specification.

They can abuse functionality explicitly described within it.

Muench characterized the resulting attacks as “specification-compliant,” emphasizing that proactive SIM functionality and the associated attack surface are defined by telecommunications standards themselves. (⁠theregister)

That creates a difficult remediation problem.

Fixing a conventional vulnerability might require changing a few lines of software.

Removing risky standardized behavior requires coordination across modem manufacturers, smartphone vendors, telecommunications operators, SIM vendors and standards organizations.

Backward compatibility complicates the problem further.

Functions that appear obsolete on modern smartphones may remain necessary for older telecommunications infrastructure or specialized IoT deployments.

The industry therefore cannot necessarily remove them overnight.

The researchers disclosed their findings to several affected organizations in March, including Google, Oppo, Quectel, Semtech and Qualcomm, before informing the GSMA in May.

Qualcomm subsequently developed a hardened configuration that disables the SIM-accessible AT interface by default.

The GSMA is tracking the broader issue under CVD-2026-0122. (⁠theregister)

The response reflects an increasingly important security principle: capabilities should not remain enabled merely because a standard permits them.

If modern devices no longer require a powerful legacy function, disabling it by default reduces attack surface without necessarily breaking normal operation.

The research suggests that smartphones are only part of the story.

Seven of the eight IoT modems tested exposed an AT command interface to the SIM, compared with only two of the 18 smartphones.

That disparity deserves attention.

Cellular IoT devices are everywhere.

They provide connectivity to industrial equipment, alarm systems, vehicles, environmental sensors, payment terminals, smart meters, surveillance equipment and infrastructure operating in locations where conventional wired networks are unavailable.

Many are expected to function unattended for years.

Security updates may be infrequent.

Replacing hardware may be expensive.

Operators may not even know which modem chipset exists inside a particular device.

These characteristics create ideal conditions for legacy functionality to survive long after the security assumptions surrounding it have changed.

The research ultimately exposes a blind spot in mobile and IoT security architecture.

Security teams routinely model threats originating from malicious applications, compromised networks, rogue base stations, vulnerable firmware and physical attackers.

The SIM itself is often implicitly considered trusted.

That assumption deserves reconsideration.

A SIM is programmable hardware inserted directly into a device, capable of communicating with critical telecommunications components through standardized interfaces.

If compromised, it effectively becomes hostile hardware operating inside the device’s trust boundary.

The researchers argue that the long-term solution should include retiring RUN AT and other dangerous proactive SIM functionality where it is no longer required. (⁠theregister)

Modern smartphones appear to have already reduced much of this exposure.

IoT equipment has considerably further to go.

The findings therefore offer a broader lesson extending beyond SIM cards.

Legacy functionality does not become harmless simply because it has existed for decades.

Sometimes the most dangerous capability inside a modern 5G device is not a sophisticated new feature or an undiscovered vulnerability.

It is an old command interface, designed in another era, still waiting for something trusted enough to tell it what to do.