Attacks Against GSMA's M2M Remote Provisioning
summary
Analyzes GSMA eUICC remote-provisioning and shows a protocol flaw where a single-message drop during profile-container creation leaves an orphaned profile container allocated on the eUICC with no AID recorded, so only the data-prep role can delete it; an attacker who jams or drops that response can repeatedly fill device memory until the eUICC is unusable. Attack requires no malware, only network disruption. GSMA accepts disclosure and issues a spec patch adding a garbage-collector delayed deletion mitigation.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:45Agenda
- 2:47How SIM Cards Work
- 4:01Problems With SIM Cards
- 5:38Embedded UICC
- 7:05Evolution
- 8:36Subscription Manager
- 13:07Technical Details
- 13:22How It Works
- 15:09Creating a Profile Container
- 17:26Error Unlink Protocol
- 18:45Error Unlink Protocol Simplified
- 24:47Other Attacks
- 26:04GSMA Response
- 27:02Summary
- 28:14What would prevent SMS
related talks
55mHidden Agendas: Bypassing GSMA Recommendations On SS7 Networks
44mExposing Critical Threats In Millions Of Connected Devices
48mMobile Device Mismanagement
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
25mAttacking Mobile Broadband Modems Like a Criminal Would
44mNew Vulnerabilities in 5G Networks
44mLTE And IMSI Catchers: Then And Now
40mWeaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?