4

I am considering switching my SIM card into a spare Android phone I have, in light of two issues:

1) My issue here: Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?

2) The Android phone I've been using is very old and has problems charging (I think due to battery and a faulty charge port). I haven't replaced this yet. Today, the phone outright won't turn on (maybe due to a virus, but I think more likely it's due to not charging well over night and becoming completely depleted of battery, which has happened before). Worse yet, it isn't taking a charge at all as far as I can tell, even with usually reliable chargers.

My solution to issue #2 is to swap my SIM into a spare Android phone I have, at least until I fix the power supply on the first phone. However, in light of issue #1, is it a bad idea to start moving my SIM into other phones and potentially spreading whatever malicious thing may have texted my friend from my phone? I have more digging to do on issue #1 (checking with other common contacts, reaching out to my carrier somehow) but wonder if there's any useful info on the immediate question: is it safe to switch a SIM card from a potentially infected phone into a fresh spare phone?

Notes:

The spare phone belonged to a family member long ago and is effectively mine now. I can factory reset it before putting my SIM in.

I've looked for info on this (Can virus save to SIM Card? and Can a SIM card propagate malware?) but am finding mixed/uncertain messages about whether my SIM card could propagate a virus. I'm not interested in theory here, but in practice. I realize we can't be certain anyway, since I'm not even sure if my phone has a virus! (See #1 above)

cr0
  • 371
  • 2
  • 4
  • 15
  • The SIM card should be fine moving into another phone. The complexity in embedding malware into a SIM is not worth the payoff so I wouldn't expect it to be infected. – RoraΖ Aug 29 '17 at 13:54
  • This isn't a direct answer to your question, but it may be more prudent to ask your service provider to clone your number onto a new SIM, and live with the fact that you're going to lose your contacts stored on the SIM card. – Monica Apologists Get Out Aug 29 '17 at 16:46
  • Why do you want to save the SIM? – schroeder Aug 29 '17 at 16:50
  • 1
    @RoraΖ if the offending SMS exploits the OS, then the SIM *could* infect the new device, too. Low likelihood, but something to consider. – schroeder Aug 29 '17 at 16:52
  • @RoraΖ Why do you think making a replicating phone virus is not worth the payoff? – deviantfan Aug 30 '17 at 16:31
  • @deviantfan Do you mean cloning a phone or persisting across phones? – RoraΖ Aug 30 '17 at 18:14
  • While a comprehensive answer would still be useful, what I ended up doing is having my service provider clone my # onto a new SIM as @Fistbeard suggested. Only cost $5 and a few minutes – cr0 Aug 30 '17 at 18:27
  • 1
    @cr0 Good that it's solved .. about the answer, I'm still thinking what to answer without repeating your question :) You know that a 100% secure is not possibe - so, yes, it's possible. The reasons why it is not very likely: The majority of malware has goals that include "as much infections as possible with as little work as possible". The browser&apps area is far more beneficial, and far more vulnerable. ... With a sim, the attacker would either need one of the master keys to write to it (while hoping that your phone can write at all), or one of the (harder-to-find) software bugs in the sim – deviantfan Aug 30 '17 at 18:48
  • 1
    (btw., physically helping the sim attack heavily increases the chance of success - like targeted variations of the available electric power, various electric and time measurements, various radiation things, or even carefully disassembling the card - but your phone software can't do such things, so...) – deviantfan Aug 30 '17 at 18:50
  • Right. Since there are two other posts asking essentially the same question already, I'm thinking I'll delete this probably later today or tomorrow giving anyone time to object if they think it's better to keep it. – cr0 Aug 30 '17 at 20:14
  • It seems the answer is pointing to _yes, it can carry over an infection_, due to things like proactive commands. See https://www.defcon.org/images/defcon-21/dc-21-presentations/Koscher-Butler/DEFCON-21-Koscher-Butler-The-Secret-Life-of-SIM-Cards-Updated.pdf. It would be a much more advanced attack than the average mobile virus, though. It wouldn't likely be a major risk. – forest Dec 19 '17 at 04:38

1 Answers1

1

There are a couple of possible issues here -

  • It is technically possible the virus is able to exploit a vulnerability in how android handles the SIM. If this is the case it could be transmitted via the SIM card storage.
  • There is a risk of reinfection. It sounds like you haven't identified the infection vector yet - how do you know you won't retrigger it? It also sounds like the replacement phone is old and likely out of manufacturer support.
  • It also could be a rogue app which may get reinstalled automatically via your google account.

Personally I'd view the risk as low. SIM based transmission would require more effort than its worth for a non-state actor. Reinfection is a risk. I would fully wipe then update the replacement phone before inputting google credentials / installing apps. If possible disable automatic app installation and manually review each one.

Alternatively as suggested in the comments have your provider issue a new SIM and transfer the number over. Again take steps to protect the new phone from non-SIM related reinfection.

Hector
  • 10,893
  • 3
  • 41
  • 44
  • What about SIM proactive commands? Couldn't these be used to compromise the device without exploiting the way Android handles the card? – forest Dec 19 '17 at 11:54
  • @forest - without looking at the full GSM spec and the android code for handling the commands I couldn't say for certain. But it is unlikely. All communication with the SIM is via the OS. Android developers are unlikely to allow a SIM to launch an executable on the users phone without user affirmation. – Hector Dec 19 '17 at 12:00
  • Supposedly, they already can, and it's a legal part of the spec. I haven't looked into it much, but that is what I gather from reading similar questions. After all, the SIM card isn't treated by AOSP as an untrusted device. – forest Dec 19 '17 at 12:03
  • @forest - Even if it is a part of the spec the phone doesn't have to strictly follow the spec. As said - you'd have to read both the spec and android source to fully understand A. what is supposed to happen and B. what actually happens. – Hector Dec 19 '17 at 12:05
  • 1
    Wouldn't it be better to then familiarize yourself with the spec before saying the risk is low? I had considered writing an answer similar to this but reading similar questions made me realize that it is very possible that a SIM card being treated as fundamentally trusted could be standard for mobile devices. An answer that's effectively speculation risks being dangerously wrong (not that I have any reason to think it is, or isn't. It's just a possibility). – forest Dec 19 '17 at 12:08
  • 1
    @forest - The risk is low because of the technical ability required to do this - OPs friend getting a dodgy text doesn't exactly scream state actor. Also usually this behavior would be baked into the SIM / not modifiable by software on a phone (OP doesn't question if he can trust his provider). And whilst the SIM may be trusted in general I'd be surprised if OS writers were willing to allow it arbitrary code execution. – Hector Dec 19 '17 at 12:13
  • Ah yeah that's a good point. I lost sight of the big picture and started thinking too much about whether or not it was possible without a novel exploit, rather than whether or not the run-of-the-mill mobile phone malware would do this. – forest Dec 19 '17 at 12:14