> As a potential victim, it appears, there is nothing much a mobile device user can do if they are using a SIM card with S@T Browser technology deployed on it, except requesting for a replacement of their SIM that has proprietary security mechanisms in place.
Sure, proprietary security sounds like an absolute win!
Is this article making stuff up, or is there actually a secret threat actor that can easily take over phones with a well crafted SMS???
> In one country we are seeing roughly 100-150 specific individual phone numbers being targeted per day via Simjacker attacks, although we have witnessed bursts of up to 300 phone numbers attempting to be tracked in a day, the distribution of tracking attempts varies.
> At its simplest, the main Simjacker attack involves a SMS containing a specific type of spyware-like code being sent to a mobile phone, which then instructs the UICC (SIM Card) within the phone to ‘take over’ the mobile phone , in order to retrieve and perform sensitive commands.
The basics of phone security are easy. A phone is an assembly of 3 computers: The "main CPU/GPU", the modem CPU, and the SIM card. All 3 are independent and communicate with each other, trusting each other. Of those 3 computers, the main CPU is the only one with hardened software (Android or iOS). The SIM has hardened hardware, but contains lots of bloatware. Also, The newer main CPUs have a sub unit called TEE, which can be seen as a 4th computer.
The SIM card is the computer that includes the security token and do the computation to identify you to your phone line provider. It can also process commands from the provider to push configurations to your phone (the 2 other computers).
After a submit button is clicked in a previous page , it will execute all of Javascript that you are able to see down here and that is integrated in the same .php file, I call the php function in the JS code and this function executes even though the variable "distance" is greater than 0 , I debu...
Maybe I'm really just a terrible person? This person is obviously very confused about a lot of things, and the code is a complete disaster. I should probably be more sympathetic to someone who is obviously very new to this, but I really don't know where to even start when it comes to helping with something like this.
The answer is fairly simple though: they have a bug in their javascript (they are subtracting a Date object from a number). Does saying that actually help though?
@MechMK1 True, aka I am a terrible person. It's easy to forget that I had to learn how to code once too. I wish I still had my first web application... I didn't want to use MySQL from the command line so I made a full-purpose web app to managed MySQL from PHP. Obviously I could have saved myself a lot of trouble if someone had told me about PhpMyAdmin...
I still remember parts of it - one gigantic file with huge if ($REQUEST['PAGENAME']) { blocks... ah, those were the days
