Dublin, Thursday, 12th September 2019, 08.00am GMT

***New ‘Simjacker’ vulnerability exploited by surveillance companies for espionage operation***

Following extensive research, AdaptiveMobile Security, a world leader in cyber-telecoms security, today announced it has uncovered a new and previously undetected vulnerability. This vulnerability is currently being exploited and is being used for targeted surveillance of mobile phone users. The vulnerability and its associated attacks have been named, ‘Simjacker’ as it involves the hijacking of SIM cards and threatens mobile phone users across the globe.

Simjacker extracts the location information of mobile phone users from vulnerable operators, retrieved using malicious SMS messages. The location information of thousands of devices was obtained over time without the knowledge or consent of the targeted mobile phone users. Based on previous intelligence, it is likely that these attacks originated from a surveillance company which works with governments, to track and monitor individuals; bypassing existing signalling protection.

Cathal Mc Daid, Chief Technology Officer of AdaptiveMobile Security explained, “Simjacker represents a clear danger to the mobile operators and subscribers. This is potentially the most sophisticated attack ever seen over core mobile networks. It’s a major wake-up call that shows hostile actors are investing heavily in increasingly complex and creative ways to undermine network security. This compromises the security and trust of customers, mobile operators and impacts the national security of entire countries.”

While the primary attack detected involved the retrieval of mobile phone locations, Simjacker has been further exploited to perform many other types of attacks against individuals and mobile operators such as fraud, scam calls, information leakage, denial of service and espionage. AdaptiveMobile Security Threat Intelligence analysts observed the hackers vary their attacks, testing many of these further exploits.

In theory, all makes and models of mobile phone are open to attack as the vulnerability is linked to a technology embedded on SIM cards. AdaptiveMobile Security research indicates that the Simjacker vulnerability could extend to over 1 billion mobile phone users globally, potentially impacting countries in North and South America, West Africa, Europe, Middle East and indeed any region of the world where this SIM card technology is in use.

Mc Daid continued, “Simjacker worked so well and was being successfully exploited for years because it took advantage of a combination of complex interfaces and obscure technologies, showing that mobile operators cannot rely on standard established defences. Now that this vulnerability has been revealed, we fully expect the exploit authors and other malicious actors will try to evolve these attacks into other areas”.

AdaptiveMobile Security has been working closely with their customers and the wider industry; including both mobile network operators and SIM card manufacturers to protect mobile phone subscribers. AdaptiveMobile Security are committed to using their global threat intelligence to build defences against these new sophisticated attacks that are circumventing current security measures.

Further details on Simjacker are available on www.simjacker.com and Cathal Mc Daid, Chief Technology Officer of AdaptiveMobile Security will be presenting on Simjacker at the Virus Bulletin Conference, London, 3 October 2019.