Malicious SIM Cards Exploit “Proactive SIM” Feature to Hijack Phones and IoT Devices
What Happened — Researchers from the University of Birmingham and Fuzzware demonstrated that the “Proactive SIM” function, built into the cellular specification, lets a malicious SIM issue AT‑commands directly to a device’s modem. In tests against 18 smartphones and eight cellular‑IoT devices they achieved code execution, file theft, denial‑of‑service and forced downgrade to insecure 2G networks.
Why It Matters for Compliance & Audit Readiness
- The attack surface originates from a specification‑level capability that most organizations do not include in their threat models, exposing a gap in control mapping and continuous evidence collection.
- SOC 2 CC 6.2 (System Operations) and CC 7.1 (Change Management) require documented controls over hardware‑firmware interfaces; undocumented SIM‑level commands undermine those controls.
- Continuous‑compliance programs must capture evidence that such low‑level interfaces are either disabled, monitored, or mitigated, providing audit‑ready proof that the organization has addressed a known hardware‑level risk.
Who Is Affected — Mobile handset manufacturers, cellular‑IoT OEMs (e.g., EV‑charger vendors), telecom operators, and enterprises that deploy BYOD or corporate‑issued smartphones.
Recommended Actions
- Map the Proactive SIM function to your SOC 2 control inventory – identify which devices expose an AT‑command interface to the SIM.
- Collect continuous evidence (e.g., firmware configuration logs, SIM‑profile audits) that the interface is disabled or restricted.
- Update device hardening policies to include SIM‑originated commands as a prohibited attack vector and incorporate the findings into your change‑management workflow.
- Validate remediation by testing a representative sample of devices with the CATana toolkit or equivalent.
Technical Notes — The vulnerability leverages the “RUN AT” instruction defined in the cellular spec, allowing a malicious SIM to execute arbitrary AT commands. Demonstrated on an OPPO Reno14 5G (power‑off, modem shutdown, forced 2G downgrade) and on Quectel EC25‑AFX/EG25‑G modules (code execution via command injection, file exfiltration via symbolic‑link trick). No CVE has been assigned yet; the issue resides in the specification‑compliant behavior of the modem firmware. Source: Help Net Security