A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

A malicious SIM card can execute attacker-controlled commands on the device it is inserted into. This capability is sufficient to gain control of entire devices, such as electric-vehicle chargers, industrial routers, and car telematics units, that utilize cellular modules. Researchers from the University of Birmingham and Fuzzware tested this vulnerability on 26 phones and cellular modules. The tests confirmed the presence of this capability, allowing an attacker to potentially take over affected devices. The vulnerability is related to the SIM card's ability to interact with the device's modem. Researchers identified this issue in a range of devices, highlighting a potential security risk.