Experts first talked about WIBattack, a critical vulnerability in SIM cards

AdaptiveMobile Security’s mobile cybersecurity experts have announced a new method of hacking cell phones using SIM card functionality, which they called WIBattack. WIBattack is a critical vulnerability in SIM cards, in many ways similar to Simjacker.

This attack is similar to the Simjacker technique that experts demonstrated less than a month ago. The only difference is that the new exploit uses another browser on the SIM card to penetrate the device and execute commands – not S @ T, but WIB.

“Vulnerability does not depend on the phone model or operating system. It is connected directly to the SIM-card and a browser embedded in it, which can be controlled “over the air” using office SMS sent directly to the radio interface. This is necessary, for example, to remotely update software on a mobile device”, – said AdaptiveMobile Security.

Like Simjacker, the new attack method uses a binary SMS message aimed executing a specific command by the WIB browser on those cards that do not have protection against such interference.

If successful, the attacker will be able to make any calls from the victim’s phone, determine its location, send SMS or SS and USSD requests, launch an Internet browser and play a ringtone.

“Researchers discovered this vulnerability back in 2015, but did not begin to tell the general public about a flaw that is difficult to fix. Experts feared that in this case criminals could take advantage of them”, – said Lakatos, senior fellow at Ginno Security Lab.

However, in contrast to the Simjacker method, which the attackers have already used for espionage, there have been no cases of using WIBattack in practice.

Read also: Scammers found a new way to make money on Google Play

It’s hard to say how many SIM cards are at risk. According to Lakatos, the number of vulnerable devices is “hundreds of millions.” The SRLabs team specializing in the security of mobile gadgets has conducted its own verification and shared the results with the ZDNet publication.

Experts studied about 800 SIM-cards and found out that only 9.1% of devices are subject to attacks via S @ T or WIB. In addition, it turned out that only a few mobile providers currently supply SIM cards with these utilities – mainly in the Middle East, North Africa, Eastern Europe and Latin America.