Malicious SIM Cards Enable Remote Code Execution on Cellular IoT Modems
What Happened — Researchers demonstrated that a specially crafted SIM card can issue AT‑commands that cause the cellular modem in an IoT device to execute arbitrary attacker code. The proof‑of‑concept succeeded on electric‑vehicle chargers, industrial routers, and automotive telematics units.
Why It Matters for Compliance & Audit Readiness
- The attack bypasses traditional network‑perimeter controls, exposing a gap in SOC 2 CC6.1 – System Operations and CC7.1 – Change Management that require documented controls over hardware and firmware updates.
- Continuous evidence of SIM‑card provisioning and firmware integrity is essential to prove due diligence during a SOC 2 audit.
- Mapping this hardware‑supply‑chain risk to a control matrix helps generate defensible audit artifacts and demonstrates a mature risk‑management program.
Who Is Affected — Automotive manufacturers, EV‑charging network operators, industrial equipment vendors, and any organization deploying cellular‑connected IoT devices.
Recommended Actions
- Inventory all cellular‑enabled assets and record the SIM‑card provider, firmware version, and provisioning process.
- Implement cryptographic verification of modem firmware and enforce signed OTA updates.
- Add SIM‑card provisioning controls to your SOC 2 control library and collect continuous evidence of compliance.
Technical Notes — The researchers used malicious SIMs to inject AT‑commands that trigger a buffer overflow in the modem’s baseband processor, achieving code execution without network access. No CVE was assigned; the vulnerability resides in the lack of authentication for SIM‑issued commands. Source: The Hacker News