Defcon 21 - The Secret Life of SIM Cards

Speaker Karl Koscher & Eric ButlerEvent Defcon 21Broadcast 2013-11-16Duration 43m

Preview frame from Defcon 21 - The Secret Life of SIM Cards

SIGNAL LIVE43M

Speed:

A/B Loop:→

Student Briefing Notes

0 / 3 Mastered (0%)

🎯 Core Key Takeaways

Understand core telecom signaling vulnerability mechanisms
Identify protocol weakness patterns in
Analyze real-world SIGINT exploitation vectors and mitigation strategies

🛠️ Practical Lab & Hands-On Guidance

Apply packet filtering in Wireshark for cellular traffic, verify firewall rules at signaling boundaries, and audit protocol parameter bounds.

📖 Briefing Coverage Scope

At DEF CON 21, Karl Koscher and Eric Butler presented an analysis of Universal Integrated Circuit Card (UICC) architecture, exposing how legacy cryptographic primitives and unauthenticated administrative interfaces leave mobile subscribers vulnerable to remote compromise. Their research focused on the Subscriber Identity Module (SIM) application execution environment, specifically Java Card implementations and the SIM Application Toolkit (STK) operating under 3GPP TS 31.115 and GSM 03.48 standards.

STUDY BRIEFING DOSSIER EXPORTER EXPORT COMPLETE LAB NOTES & TIMESTAMPS FOR NOTION / OBSIDIAN

5G SBA NRF Service Discovery & OAuth2 Token Abuse

5G-SBA

Call flow illustrating how an unauthenticated Network Function (Rogue NF Consumer) queries the NRF for discovery and retrieves access tokens without adequate TLS mutual auth or token scoping.

Entity 01Rogue NF Consumer (AMF)

Entity 02NRF (Discovery & Auth)

Entity 03Target NF Producer (UDM)

1

1. GET /nnrf-disc/v1/nf-instances?target-nf-type=UDMREQUEST

Rogue NF Consumer (AMF) ➔ NRF (Discovery & Auth)

2

2. 200 OK (UDM Endpoint URI & Supported Services)RESPONSE

NRF (Discovery & Auth) ➔ Rogue NF Consumer (AMF)

3

3. POST /oauth2/token (grant_type=client_credentials, scope=nudm-sdm)EXPLOIT

Rogue NF Consumer (AMF) ➔ NRF (Discovery & Auth)

4

4. 200 OK (Access Token: Bearer eyJhbGciOi...)RESPONSE

NRF (Discovery & Auth) ➔ Rogue NF Consumer (AMF)

5

5. GET /nudm-sdm/v1/imsi-208950000000001/am-dataEXPLOIT

Rogue NF Consumer (AMF) ➔ Target NF Producer (UDM)

6

6. 200 OK (Subscriber Subscription Data & Keys)RESPONSE

Target NF Producer (UDM) ➔ Rogue NF Consumer (AMF)

🔍 PROTOCOL MESSAGE PARAMETERSStep 1 of 6

Rogue NF queries NRF discovery endpoint to enumerate registered UDM instances in PLMN.

Technical Term & Subtitle Translator

Inspect Technical Acronym:

5G-SBA — 5G Service Based Architecture

5G Core

🇺🇸 English

Core network architecture in 5G Standalone (SA) where Network Functions (AMF, SMF, NRF, UDM) communicate via HTTP/2 REST APIs with OAuth2 authentication.

⚠️ Security Vectors & Exploitation Note:

Vulnerable to NRF token abuse, unauthorized REST discovery, and API gateway parameter tampering.

About this signal

At DEF CON 21, Karl Koscher and Eric Butler presented an analysis of Universal Integrated Circuit Card (UICC) architecture, exposing how legacy cryptographic primitives and unauthenticated administrative interfaces leave mobile subscribers vulnerable to remote compromise. Their research focused on the Subscriber Identity Module (SIM) application execution environment, specifically Java Card implementations and the SIM Application Toolkit (STK) operating under 3GPP TS 31.115 and GSM 03.48 standards.