SecTor 2025 | Ghost SIM Attack: Hacking Mobile Network Authentication Policies

SIM card swapping attacks have been and are a reality nowadays. Based on social engineering, attackers are able to transfer their victim's phone number into a new SIM card, resulting in fraud. Today, we present to you a new technique that also results in fraud in mobile networks in all technologies, the goim attack. Awesome. The go sim attack extracts essential sim card information to take advantage of weak authentication policies to perform fraud in 2G, 3G, 4G and 5G mobile networks. This short sentence summarizes the key ideas and key aspects of our presentation today. We will see how to perform the attack, what are the steps needed to perform the attack, and why does this attack work. But for you to understand this short sentence, we need to break it down and ask ourselves several questions. In the first place, the goim attack extracts essential sim card information. So one of the questions we need to answer is what's isa sim card and how does it store information and how are we able to extract this information? What are the techniques and methods? Furthermore, after extracting this incred weak authentication policies. So what are authentication policies? What is an authentication procedure in mobile networks? And what exactly do we mean when we say weak authentication policies? And finally, after we extract this SIM card information and take advantage of weak authentication policies, we are able to perform fraud. So we need to answer the question of how and why is this attack capable of performing fraud in all the generation generations of mobile networks. But before we start with the technical details let us present ourselves. Joining me today is Pedro and I'm Miguel. Both of us work at Ethon Shield which is a company based in Madrid, Spain which focuses on telco hacking. Now I I will let you with Pedro with he will start with the technical details of SIM card hacking. >> Okay, let me first take you back to the 90s. Uh Windows 95 was just shining, right? Linux between version one and version two and pay TV satellite hacking groups began to take on great importance. That's when I started playing around with smart cars hacking. They were two main big players. I don't know if you recall big microcontrollers 16F84 and 16F 876. They came up in a smart car form factor. That's the gold waffer and later arrived the silver car. They were the big players in pay satellite hacking and sorry. Yeah, I was just curious. I was starting to reading assembler switching on and off lights was like a new world to me. And suddenly one day searching on the internet what I could done with this hardware I discovered something called CMU standing for SIM card emulator. was like, "What? Really? Why? What? What do I need? Take all my money. I just want to clone my SIM card. Really?" So, I learned that the algorithm that kept some things I going to explain you later secret was broken in the between 97 and 98, the comp 128 algorithm was broken. So if we plug the SIM card into a reader, the same reader that I was using for the pay TV smart cards, I need to take two parameters. First was the identity. I will explain you later this parameter inc. And the big one is a secret key that need eight hours of the attack. We plug the SIM card, we go at night, have some rest, and next in the morning, we extract the secret key. So with those two parameters, I program them in a programmable SIM card and I have just a copy exact copy, a clone of the SIM card. So I started playing around with this new identity because for the network, I was exactly the same subscriber. So I could uh do fun and profit, right? do fraud calls all everything will be charged to the legitimate subscriber. Sometime later collaborative work show a new side channel attack vulnerability that allow these researchers using a very accurate osilloscope. They were measuring the power consumption of the chips and they will again are able to get the secret key. That attack will last between one hour and two hours. But of course that will attack object sorry to 3G and 4G SIM cards. Those are very complex attacks. Fraudsters don't like this complexity right? So they came up with a new idea deception or social engineering. Why standing or necessity of these technical gadgets where we could just ask the operator for a copy of the SIM card or transfer the subscriber, right? That started in 2007 between South Africa and Brazil and became spread over the world. I think FBI report from cyber crime 2024 they study something between a thousand cases and lasted for 26 million of dollars the impact of the swin swap I'm talking about sim car sim cars what's the sim car the sim cars kept first of all the subscriber identity what's called IMC international mobile subscriber identity among others identities temporary identities and I've talking before about the secret key, the KI, right? There are many other keys as the operator code and so on. They could exchange information towards the mobile using these contacts. How they exchange the information be because they are offering file system capabilities. Let me focus on two of them. the INC the identity and the integrated circuit serial number because we are going through some examples using these two files. As you see at the right, the files have permissions, security restrictions. If we want to read the MC, we need the PIN number. If we want to update the INC, we need administrator requirements. So all the SIM cards that they came up without any PIN number, they allow us to read the EMC directly. We don't know to guess the PIN number. That's a security feature. Some countries they offer SIM cards by default without PIN number. So it's well not a good practice. So think that we are have access to the H SIM card. It's just a very quick demonstration. We plug the sim card in our reader. We are going to use pyim shell. It's a very well-known interface because we'll give us human readable way to select the files. You see that we are selecting by name if stands for elementary file just a standard files and we are reading the content. So we are reading the IMC the identity of our victim. We are listing files just like ls and we are selecting now the integrated circuit file because we want also to check uh the content. For obvious reasons we are not going to disclose all the elementarymentarian files involved in the attack but we want to show you that once that we have physical access to your sim card we can just plug in the reader and extract information. That's a question for you guys. How many oss does a terminal have? Make your guess. Random numbers. >> Four. >> Three. >> Three. That's it. We have the pretty brand well-known. Okay. The Android and the iOS. That's for sure. And we have SIM cards. They are based on Java. Java cars from the third generation. And the bassband, the modem, they are running airs. So we have three different oss and they need to be connected right because bassband needs to let us Android know when we have a call or SMS or whatever and the same with the SIM card. So we draw this generic architecture to say okay our objective is the SIM card. We want to take information from the SIM card how we can approach. Let me introduce you the 80 commands from the 80s, the golden years, right? They were developed to handle the first generation of the modms. They are very well known. They all of them start with at acronym for attention plus some characters, four to five characters that is the instruction, the specific instruction. But I don't know if you are aware that we have a specific subset of these commands for the sim cars. Then we started to get on the road. is like hey we are talking now some of you may discover in your Android this option 3GPP8 commands there is not available in all the manufacturers because doesn't came from the Android branch of the OS some manufacturers implement these options if you want to allow these at commands some others don't on 2018 some researchers analyze a huge number of smartphones because there are and documents or let me say more polite proprietary commands analyzing the firmware they discover on the LG G4 for example a nice feature maybe today is a back door is an Android lock screen bypass 80 key lock equals zero and we will bypass the Android lock screen powerful right we were talking we need this 80 commands when we plug the smartphone towards our computer. We will have a new TTY ACM serial device and we will interact in the same way like before with these 80 commands. Let me show you the example. On the right screen, we will cut the results of the 80 commands. On the left, we will we will be typing the 80 commands. This time, we are not referring the files by name. It's pure identifier. We need to translate these identifiers with their decimal number. And you see on the right that the output of the two files that we are consulting reading is exactly the same value. What's the difference? Instead of plugging the SIM card, you see in the bottom right, we just plug the smartphone and the screen is unlock, right? We don't need to lock the screen. Sorry, we don't need to unlock. It's already locked. And the last method I want to introduce you more well known nowadays and more modern is the ADB Android debug bridge right we usually open these ADB shells to interact with the Android 80 commands were designed to interact with the modeling we can do phone calls receive SMS and so on but ADB is for debuggers engineers to interact with the Android that needs to map the modem again as a serial interface right is usually they map this through the radio interface layer the the API the real they map as SMD usually a surface mount device once we have mounted this device we can interact again with the model what do we need in order to interact yeah the USB debugging we need to activate developer options and inside developer options we need to activate USB debugging once we have this feature again on the left we will open ADB shell and we will type the 80 commands on the right. We will output the result of these 80 commands. The mobile the smartphone it's on the bottom right screen again is lock. We are typing copy and paste the 80 command the same two files as the beginning the identity and the integrated circuit serial number. Uh here we are. Come on, Pedro. Yes, that's the same result for the two files. So, we have 80 commands and ADB way to interact with the SIM card, but they require as you see in the bottom left that we interact with the options. Sometimes when we get our big team phone, we don't know if these options will be enabled by default. What do we need to enable the options? The third column we need to interact with the Android by default security requirements could be a ping could be a pattern sometimes is biometrics right it's up to the version of the Android we wanted to summarize all of these with using chat GPT because Android is so heterogeneous all the manufacturers they are introducing features in different time in different versions so yeah we want to enable ADB up to the Android version we have some different security requirements. Same to use ADB. Sometime at some moment they introduce the RSA authentication. So we need to authorize the host in order to interact using ADB. 80 commands they are not on the OM. So usually they are authorized and the biometric. We wanted to focus our investigation not covering all the different branches of Android and manufacturers. We wanted to cover investigation focusing on the authentication policy that I will handle to Miguel to continue. So now we have seen the different methods to extract SIM card information and if you remember in the first sentence after extracting this information we need to take advantage of weak authentication policies. So what are authentic authentication policies? But first we need to start with basis. A mobile network is a network that is has two main components. The radio access network and the core network which are interconnected between each other. The core network provides different services to the clients such as access to the internet calls, SMSs, mobility management. It stores different parameters in the database and the radio access network is connected to the clients over the air interface. So the clients are smartphones, IoT devices, cars, everything that has a physical SIM card or an embedded SIM card. So for the clients to be able to use the different services provided by the network, they need to successfully register. And within this registration procedure, we find the authentication procedure. The authentication is the procedure that ensures that both the client and the network are who they claim to be. In 2G networks at the beginning only the network authenticated the client. The client did not authenticate the network. That is why attacks such as fake base stations also known as stingrays or MC catchers were very common and are very common. But from 3G onwards there started to be mutual authentication which is much more secure. Both the network and the client authenticated each other. So how does this work? Well, both the SIM card and the mobile network have a pre-shared key as we saw at the beginning. The secret key KI this KI is used as the seed value to calculate the different parameters to successfully authenticate each other. So what is the authentication policy? The authentication policy defines how often and under what conditions the authentication procedure is triggered. It can be a timebased authentication policy andor an event-based authentication policy. In a timebased authentication policy, after the user registers successfully in the network, the operator will start a timer and after when the timer expires, it will trigger an authentication on the subscriber. In an event- based policy, the after a set number of events, the which are operator dependent, the network will authenticate the user. Generally these events includes SMSS, phone calls, mobility updates, service requests. It's totally operator dependent. So when we say that we take advantage of weak authentication policies, what do we mean? Well, let me give you an example. Imagine two operators. The fir both of them have a timebased policy and the first operator the timer is of 24 hours and in the second operator the timer is of 30 minutes. If an attacker is cap is um capable of bypassing the authentication, the exploitable period in the operator that has a longer timer will increase. So that means that a longer timer will mean that it has a weaker authentication policy. So for our goim attack, it was very important to analyze and identify the authentication policy of different mobile operators across the globe. So we automated the tests. In this example, you can see at the right a keectel modem which has a legitimate SIM card inserted. It acts as a mobile device, but you can control it much more. And the test here is we were trying to analyze the authentication policy based on events of sending SMSS. So in this with with a script we start sending SMSs to a another mobile device and we are capturing the signaling traffic of the kek modem and then we can understand when does the network authenticate us and how many SMSs can we send without the network authentic triggering an authentication request. So you can see that in the mobile device you're continue sending SMSS with hello hello hello and the result of this test is this wire shark capture you can see at the beginning that there's a successful uh registration with a successful authentication and then we start sending SMSs and after some time after some a number of SMSs we receive an authentication procedure authentication request. So it in this example after 16 SMSs the network authenticators. So it has an eventbased policy of of SMSS of one over 16. In here uh it's a small table that we show the results of different operators um authentication policy in the 2G networks. Apart from the SMS test, we did other tests to analyze different events such as apart from the SMS test, we also start calling another mobile device and see when does the network authenticate us or registering into the circuit switch domain or registering into the package switch domain. So highlighted in red you can see the robust authentication policies. For example in the registration of the package se domain which the registration is the first me message you send to the network the network authenticate us every time. So it has a very robust authentication policy. On the other hand in the automated test of the phone calls the network in average authenticated us one in every 15 times. So it it was a weak authentication policy. So now that we have seen how to extract sim card information and we know we understand what is a weak authentication policy let's see what is the goim attack. So by extracting the sim card information we copy that information into a programmable sim card without needing the ki because it is important to highlight that the ki is not in an elementary file. It's not in an accessible part of the memory of the sim card. So we cannot just retrieve it. So we extract this SIM card information without the KI. We copy to a programmable SIM card and put this programmable SIM card which is now the GO SIM into a mobile device and we successfully connect to the network provided that the network does not authenticate us. That is why it's very important that the network has a weak authentication policy. So what are the steps for the attack? First, we need to have physical access into the victim's phone because we need to interact with the SIM card. Then we extract the SIM card information, copy that information into a programmable SIM card, and finally insert that programmable SIM card into a mobile device. To copy the information into a programmable SIM card, we use the programmable SIM cards of Sysmoc, which you may know when you um buy them, the Sysmo sends you an ADM pin number, the administrator PIN number, so you are able to read, write, and update the different files um of the SIM card. So you have total control of over the SIM card. So once you insert this SIM card into um your fraudulent mobile device, you try to connect to the network. In this example, the network authenticated us. This is a 2G example. So we get rejected by the network with the location updating reject. Why? Because we don't have the KI. So we cannot bypass the authentication. And in this example, we get accepted in the network because the network does not authenticate us as you can see. Location updating accept. So what how does this look in in real life a real design. So we can have a Raspberry Pi which has inside the software to extract the SIM card information. to the Raspberry Pi. You have a SIM card reader connected to it with the programmable SIM card from Sysmo and also a USB cable. So now we try to find the victim. Once we find the victim which is connected to a legitimate uh network, we connect the mobile device into our USB cable and we start extracting the SIM card information. Once we finish extracting this information, we copy it into the programmable SIM card and we have a go sim. We get our fraud mobile device and connect this goim into the fra mobile device and connect to the network. So now let's try >> for glory, right? We are the sector. So this is the Raspberry Pi. Let me introduce you. We don't want to weaponize the attack. We wanted to show you that we it's not computational requirement. We just need very small h microcontroller that could be done even with an Arduino. We are managing serial uh serial communications. We have the programmable with the SIM card, a small power bank and it's waiting for any phone to be connected. Right. On the other hand, let me switch back to the camera. Oh, >> we don't see the camera. [snorts] We have our big thing. >> I need your hands. >> You have to move to another screen. Yeah, there we are. >> Okay. More or less. >> I will put it like this so we can focus. Oh, I will do my my best as a camera. Here we see that this connected to the 4G. This is the victim. Sorry. We can >> so we bought SIM cards from different operators here in Canada and we yesterday we analyzed very quickly the authentication policies and we saw that in of the four of them three of them had a very robust authentication policy which is very impressive compared to our other studies and the last one had a it doesn't it didn't have a weak authentication policy but it didn't have a robust authentic ification policy is that a medium. So ah that's for obvious reason we're we're not going to answer that. Write it down. >> No. >> Okay. So it's on Toronto. We are using SIM cards just both these days. And let's go for the real demo. >> So we connect the victim's phone into the Raspberry Pi. One sec. >> No, one sec. You want me to reboot the Raspberry Pi? >> No. >> Okay. We bought we buy four different SIM cards here in Canada. None of them are using the PIN number, but two of them is the first time that we see that they are authenticating every initial attach. So, the attack won't work for sure. So we have the other two operators that let's cross our fingers. We have some backups but we really would like to show you on uh yeah this is an spoiler how we should end the demonstration. Now it's waiting for the phone. It's a very basic script. the text sorry I'm trying to take yeah now it's been a list of the elementary files we will access them reading they are very standard elementary files as just me introduced there is no file for the secret key obviously if not we will be cloning sim card we are just getting the information could be quicker I mean we could do the attacker really quick but we wanted to show you a normal demonstration not to perform the more efficient or quicker attack just for educational purposes. We are just reading all of them and at the end we will copy to the sysmocom sim file and we will plug we've been testing I forgot to mention on Samsung S22, Samsung A25, Samsung A52 and LG Nexus 5X. We only been playing with four different H smartphones. Now it's copying everything into the SIM card and it's finished. >> So now >> crossing fingers >> we have the go sim here and let's see when it's one by 15 we should have good chances. Let me Yeah, if we remove the airplane. >> No it didn't. >> Oh no good luck. This is why we came prepared with some videos. But you will see that the videos are from Canada. It's really complicated. We should need the complete study of the authentication policy in order to guarantee. But no pain, no gain, right? We wanted to do on live. This is from Singapore. It's the same setup. Instead of the Raspberry Pi, we are using the the laptop, but everything is exactly the same. We will show you we have I forgot him. The left is the victim in the middle is the attacker and the legitimate is just to demonstrate attack with SMS. Okay, we will demonstrate that the go SIM is registered in the network. So we are exactly the same as we are doing here. We are reading thementary files. We are copying all of them into the sysmo sim car. That's the go sim we introduced. This is the Samsung A52. And once we remove the airplane mode to avoid time and we can switch on and off, but this quicker just to remove it's connected to the network. I hope you will. Yes, we are assuming it's on 4G. We will open what's my no Singapore. Sorry, we were using what's my IP address. We wanted to show you that we can browse the internet. And now we are going to send to any phone number. We just take one legitimate phone number. So we will show you that we can send SMSS from one to the other between them. There we are. We received the SMS on the go sim. >> And yeah, that's from Canada. This second video we were hoping that uh we have more chances here. That's I think we recorded yesterday. They're showing that the Canadian SIM card is browsing the internet. Again, we do the the process from the laptop. Yeah, we will accelerate to avoid again and again over the video the time to reading the files here. I think we only take 4G. Yes. So, it's really quicker the attack when we focus on the technology. We are always a balance between success ratio if we copy a lot of information from different technologies or we want to attack only one technology. This is why it gets quicker and yeah it's this operator in Canada is not so weak as we have seen around the world. It's a balance. It's not robust because sometimes we are able to perform the attack to exploit the attack. Not today. We were hoping that we got some information. Best luck. Now we remove the airplane. It's connected to the network. I hope it get focused the screen. And we will open where is [snorts] what is my IP address now? >> Yes. Yes. >> Yeah. The state and what's my IP address to show you that we are in Toronto >> in Montreal. I think it was >> Montreal. Okay, now that we demonstrate and we exploit attack, there is a big question that should get into your minds or at least in my hacker mind. How long will it last? Okay, we did it right. But for how long? This will last for minute, an hour, one day. If it work in my room, will work here. That is already answer right [laughter] so we started in Spain country number one is Spain two different operators we anonymize of course the information we don't want to get any enemies from the operators but all of the operators listed over there they are no one repeated they are all of them different okay so in orange the first two lines in the Spain we successfully managed to exploit the attack on 2G 3G 4G G and 5G. When we are talking about 5G is the real 5G is standalone. You know that 5G non-standalone usually nowadays is using the 4G core. So we will get into the 4G column. So we get a very satisfying reaction from our point of view. We did to we managed to exploit but we wanted more. Where in the world? Michael take me to Netherlands. We travel to Netherlands. We bought again prepaid SIM cards. That's very important. Why? Because I don't know why. I don't get it. But when we want to get 5G SIM cards, we can't. It's not available on prepaid. They ask you contract and they require you a physical address and a bank account. This is why the 5G column is not available outside the Spain. In all the countries when you when we wanted to use what they call 5G ultra or 5G plus or whatever they want to name the real 5G, we couldn't because they are always being requested to sign a contract. But anyway, we travel to the Netherlands and to Germany. Three different operators and they switch off 3G. Yes, it's trending over the world to switch off or 2G or 3G, but we exploit on 2G and we exploited the attack on 4G. We've been in April in Singapore and yeah, why not to test again with another two different operators in Asia, different country, different culture. They switch off 2G and 3G. Of course, we didn't drive the whole country. I'm talking about countries but we do this test in very specific cities right we are not war driving the whole country take this in mind and in Singapore again we could exploit the attack on 4G so yeah when we are analyzing this table is like okay 2G and 3G the older technologies at least in the packet domains they protect because all the authentication the initial authenticators we they are not successful it's not vulnerable attack but 4G is also packet network right there is no circuit domain in the 4G and the same on 5G but they are vulnerable why is not this authentication policy balance or improve it's a very good question that came up with this table and now what okay we did it we exploited the attack what could we do if we are impersonating your IP address if I do any fraud if I commit any crime policy is going to be in your house, right? Not my house because IP belongs to you. And the second factor, authentication, we wanted to check how we can abuse the attack. We pick WhatsApp because we think that this a very popular uh messaging application and you know that when you set up the application for the first time, you're required to prove your identity, your mobile identity. So again another successful exploitation of the attack. This is our big team. We are doing the go sim procedure from the laptop. We will get the information from the elementary files. It's of course accelerated for the presentation purpose not to get waiting over time is just mirrored the the sim card. We get the information we take from the huben the new go sim attack. This phone call, this phone sorry on the laptop is the victim. We will the attacker sorry we will plug the go sim. We remove the airplane mode will be connected for sure. This is why we are using the demo video. It's connected on the 4G and we open WhatsApp assistant. Right. The first things that we'll ask the user is their phone number. as we were using our personal phone numbers. Sorry, we offiscate personal phone numbers. If you want to contact me or Miguel later, we could talk. We're offiscating for standard reasons. Yeah. First method to verify is using a phone call. Okay. I allow the application and we are waiting to receive the call. So that's the And there we are. We received the phone call. We didn't answer on purpose because we wanted to test the second method. You know that usually they provide two different methods or the phone call or the SMS. So our odds are getting interesting in terms of probability of statistics because it is should be authenticated the call right again we accelerated because they were some timer we have to wait for the phone call wait one minute now we are selecting the SMS and we are waiting for the OTP the code from the SMS and you will see in the top of the screen the SMS with the code application immediately the verified identity and now we can restore any backup that the big team has enabled has. So yeah, second factor authentications are also a part. I think at the very beginning talking about some limitations, right? Some requirements. If we want to enable at commands, we need to unlock the screen. We need to get physical access to our victim to our mobile. So yeah, there are some limitations for sure and we need to study the authentication policy. Is not a simple yes or no. They are very complex. They will change from one city to another. You know that the networks they're using usually different network manufacturers. So some regions could use one manufacturer, some regions any other. So security or authentication policies may be not the the same to them. And in the same page that we have limitations, we have some let's call key facilitators. We want to bypass the security the Android security lock. Yeah. If we search on NDS by I think the keywords are lock screen bypass and we found September 2025 different vulnerabilities that will allow us to bypass the Android lock screen. Same with the ADB. ADB should use RSA or the rotation to allow the host. But sometimes ADB by default as you see at the right uh shadow server is the service they are monitoring ADB listening by default on TCP port 5555. This only 7,000 devices in the world. Yeah, it's not the same as the amount of Android devices that spread but quite a number. and some other CBES from 2023 regarding that CBE that sorry ADB could be bypass and my favorite undocumented 80 commands. If you recall I mentioned at the very beginning this 2018 uh research from the investigators but this is brand new 2025 is not something from the past. This is the simcom that has an undocumented command that will provide you with a root permission on the model. So these kind of things will make this attack I mean we wanted to show you that could be weaponized organizations like NSO or things like that when they have a yes resources to weaponize these kind of attacks could be really powerful as users we wanted to let you know some counter measures for me this is just common sense but let's go through all of these activate the PIN number if you are not using PIN number in your SIM card you know what you are exposed. We can remove SIM card from the mobile phone and get into our reader and forget about the Android security measures. We will everything for your SIM card. Never leave your phone unattended. Sure. Paranoid screen lock. Never leave your screen unlock. And if you have these commands options, sorry, 3GPP at commands. If you have USB debugging, enable them because that's the power that can lead to any potential attacker. From the network point of view, operators should review this authentication policy. as I already introduced plus these like these two Canadians operators authenticate or the initial attachment that will make this attack really complicated to be successful because we need to get this initial attach always all these authentication based on counters even if they are chain base or one of n we should review and balance them we usually found in the one of n events the number n it equals 15. If we divide 14 by 15, you will see that the result is very close to 90. A huge success of uh probability, right, for the attack. So we understand that these parameters will require operators maybe some investment, some budget, some changes, but will provide a strong authentication policy. All this work is been two years of work. We wanted to do a short presentation. If you are interested to go through all the details, we just published today on research gate the paper. So you want to take a look and dive into the details. We already mentioned that we wanted to focus on the authentication policies and not on the Android device and all these circumstances. If you want to ask any questions, please you have there the microphone. Get close to the microphones. We will be more than happy to answer any question that you may have. >> Well, thank you first. >> Thank you. >> I had a quick question. So, um, you guys talked a lot about the authentication. I know that that's what the paper is about, but in terms of getting those elementary files off of the SIM card, was that already broken? Was that an easy thing for you guys to do or was there any like difficulty once you have debugger access to Android? I always thought that sim cards were fairly locked down getting those elementary files. Was that piece of cake or >> it's not a piece of cake? We need I mean the how to get information is copy and paste. You select the identifier and you get the the content. Mhm. >> The problem is to map what do you need in order to get through the authentication. I mean to looks like the same legitimate SIM card towards the network. >> It's very complex. There is no documentation. There is nothing towards I mean we didn't find anything. >> Okay, I understand. But the SIM card will just freely give that information because you're the authenticator. You could if you want to increase your probability of success you can select everything copy everything and paste everything on the programmable will take more time this another way. >> So those are the 95. How many files did you need to copy? >> It's up to the operator. >> Who knows? Okay. Thank you. >> There's no uh a number I can give you. >> I understand. Thank you. >> You're welcome. >> Uh I'm just curious what happens with the original SIM card. Would that receive calls SMSS at the same time? Absolutely. We playing again. It's up to the operator. We have been playing all my life. I've been playing with it kind of situations. It's up to them. Usually could be a race condition. I don't know if you are up to these paging messages, how the network let the subscribers know that they have services. It's up to them how often they want to authenticate and uh how close the victim and the attacker are close to the network. Okay, I have another question. So in the 5G they have upgraded the MC to SUP and SUI keys. Does that change anything in this case or still able to do it? >> No, remember in the Spain we were able to success the attack on 5G standalone. >> Okay. >> Once we read the information from the SIM card, we copy because all these identities are available >> stored in the SIM card, right? >> So we get and that's it. As long as we are not getting any authentication procedure, we will manage. >> Gotcha. Thank you. >> You're welcome. >> Just a just a quick question. Very good um meeting by the way um presentations. Um just want to have a quick question that nowadays we are more using more and more eims especially with the new iPhone. Um just wondering if is there any difference between a physical sim and the eim? >> It's in our future work. Yeah, in the paper you will see that it's in the future work. there is a lot of room for future work. We were getting focused because we wanted to to to finish the the work, right? We could play with iOS. We didn't been playing with Apple iOS. We didn't playing with EIM. It's a very nice question. I really would like to give you an answer, but we'll be okay. >> We didn't testing with the EIM. >> Okay. Thank you. >> You're welcome. >> Hi. Uh during your presentation you mentioned is clone the orange sim card to a programmable uh sim card. >> No. >> Yeah. And if uh >> if you both in there to like like two phone and uh you received a phone call like both will receive or only one >> only one. Yeah. I think it's the the first question they will raise. If we have the both SIM cars connected to the network, only one can handle the service, the SMS or the call, it's up to the race condition, but only one will receive the event both of them. >> Uh so when you like do the clone, how you make sure the programmable SIM card receive the phone call like when you do the demonstration? >> Yeah, if we have physical access, we can just switch off or airplane mode, right? because we have to get the the big team phone. >> Okay. >> Okay. So, we can >> we we if at the beginning there are two options. If you turn the airplane mode and then you use the go sim, you will always receive the SMS or the phone calls. But if both of them are connected, it's a race condition. >> Okay. >> Another way could be to switch technology on settings. We can set the preference technology 2G. If one is connected to 4G and the other one is connected to 2G, we can play with this different radio access technology to assure to guarantee that we will receive service from the go. There are many ways to play with this kind of things. >> Okay, thank you. >> You're welcome. >> One last one. I just wanted to know does it leave any trace on the device that was connected to? So there's no way to discover if this happened to to >> I'm thinking I don't think so >> in the ADB maybe. >> I don't know. >> I don't think so. I'm thinking about forensics right now. >> Yes. >> But uh it's not my strongest point >> but I ADB sure will >> maybe in ADB. Yes. But I would guess in the others in the other two methods no I >> Yes. Because the the bassbands usually they are using volatile memory. I mean if they get the device at the same moment of the attack they could take some forensic but once the mobile is switch off everything is gone. And if when they are doing forensic from the operator point of view from the network point of view that this is usually what they are doing we are the subscriber. There is no way to distinguish between us. If we receive an identity request from the go sim and we answer with our with our email, we leave the trace >> but everything needs to be in place. If we didn't receive any identity request from the network, they wouldn't understand the attack. >> Okay. Thank you very much. >> You're welcome. Thank you all of you. Thank you.