How are SIM cards hacked?

Question

Burglary protection

There are suspicions of hacking and remote control of SIM cards, I want to consult with people who understand the operation of cellular communications.
Briefly, the situation looks like this:
For several years there was a number of one operator, in the 2G network, a push-button phone, without the Internet. It worked fine, but at some point, incoming calls and SMS dropped sharply, and people began to say that they could not get through, the sent SMS did not reach. Then some guys and girls with smartphones were seen in the visibility zone, stubbornly picking something at them. There were cars with tinted windows, with drivers sitting inside all day. The phone began to receive calls from unknown numbers, when answering they did not say anything, when trying to call back - "the number is not registered on the network", or the connection was dropped. He suspected that someone had hacked the phone, bought a new SIM card from the same operator and a new phone.
I carried the phone with me, at some point I noticed that some "students" were following me, with backpacks, picking their smartphones on the go. I saw the same one in different places several times. First thought - outdoor. Apparently, they grazed at the signal of the phone. I gave the number to different people, the calls seemed to go through, but there was no SMS. I sent test sms from the operator's website - they did not reach. I decided to change the number and phone again, to another operator and switched to the 3G network.
With the third phone, it became completely strange - he gave a new number to only a few people, he didn’t shine anywhere, he turned it off at night just in case. When I turned it on in the morning, several times I received SMS messages about missed calls from the numbers of people I knew who did not know this number. He asked - did you call me? They say no. Then the calls from unknown numbers started again with silence on the other end, I call back - "the number is not registered on the network." Incoming calls and SMS, even with the notification of missed calls, stopped, again tried to send SMS to myself through the operator's website - they do not reach. I turned on the SIM card lock with a pin, but when I turned it on in the morning, the phone did not ask for a pin, but immediately connected to the network for some reason. I took out the SIM card, inserted it back, only then the phone demanded to enter a pin code to unlock the SIM card. Guys and girls with backpacks and smartphones continue to rub around and follow on their heels. Recently I decided to check - I went to a bar with a phone, turned it off there, I sit, I look who will appear. A "student" comes in (by the way, a bar with prices not for "students"), sits down next to him, orders a shot and starts digging into his smartphone. After some time, one of those "students" whom I have already seen appears, throws a backpack right behind my chair, sits nearby and also starts digging into the smartphone. As he appeared, the girl nearby looked up from her smartphone. I watch the guy - he is clearly upset, something does not work out there. Rummaged about ten minutes, drank coffee and left. I leave the bar - at the entrance there is a car with numbers not in the Moscow region, in it the driver and that guy nearby, poking around in smartphones.
Question to the experts: is it possible that the SIM cards were hacked and controlled through some application in the smartphones of these "students"? Or how can they do it? There was a suspicion that a false base station was hung up, so in one place the phone did not receive incoming calls and did not receive SMS. But people from the authorities checked, they said that they did not find a false bs. Already the third phone is clearly hacked, different operators, in different networks, what to do? What do you think?

Answer 1

Sounds like you have a paranoid psychosis. This happens to me too. If you are not a successful businessman or political activist, not a terrorist, not a superhacker, not a spy or a fugitive who is being hunted by the authorities of all countries and Interpol, but an ordinary employee of some company, get up in the morning, have breakfast, go to work, come back, drink , watch movies and then sleep - then who the hell needs you. Well, or Morpheus and Trinity are chasing you and rushing to announce that you are the Chosen One and you need to make an important decision for yourself: to be him or to stay in the daily routine.
About sim cards: hacking sims is real, if the above paragraph does not apply to you, you have something to hide on the left and right sides, and the facts about surveillance continue to make themselves known, then most likely they just made a duplicate on your sims and are trying to break through in this way your personality. What to do in this situation? Just turn off the smart, or throw out all the sims from it, communicate only via Wi-Fi via WhatsApp, Skype, Telegram (the latter will help in your case). Limit your contact list. Use VPN services, since it can be configured in modern smartphones.
These tips apply only to your phone. If your "agents" turn out to be quite persistent, then seeing that it doesn't work on this side, they will start hitting from the other side.
But in general, it seems to me that these "students" are ordinary students of the Faculty of Information Security and write a thesis on information security in cellular networks, but you were simply chosen as a test subject, quite possibly through your own social circle :)

Answer 2

1. Buy a fake flip phone and wait for the same situation in the bar. Leave it on the counter / table (ask a friend to be in the same bar beforehand), go to the toilet and let a friend see what the pursuers will do with the phone.
2. When you see the car again, come up and ask something ("don't tell me where street N / won't take you", "won't you smoke?"), and see for yourself what's what in the cabin and what kind of people.
3. Proofs with photos / videos and ready to help with the calculation of agents (if you are from Moscow).

Answer 3

Обратись к компетентным конторам

Answer 4

Потом в зоне видимости были замечены какие-то парни и девушки со смартфонами, что-то упорно ковыряющие в них.

Взлом SIM-карты осуществляется путём подключения к сети SS7 через интернет.
При этом можно находиться на другой стороне земного шара.
На Хабре с месяц назад была подробная статья как это делается.
Второй вариант: троян/вирус и т.п.
Решение: используй примитивный телефон, который умеет только звонить. В него невозможно ничего подсадить.

Answer 5

Может коллекторы пытаются долг из тебя выбить? Вот и давят на тебя таким образом.
Вообще вопрос ты неправильно поставил. Надо ставить так: почему мною интересуются? И тогда всё прояснится. Может реально на тебя кто-нить кредит оформил и там долг приличный накопился. Вот и пытаются выбить таким образом из тебя.
А на твой вопрос возможно ли? Конечно возможно. Все таки 21 век. Глобальная компьютеризация по всему свету.

Answer 6

To be honest, after carefully reading all the facts you describe, I don't get the impression that you are being followed, or that your phone has been hacked. Most of the things described happen every day, with different people, without any surveillance.
Guys and girls really want to with smartphones and tinker with them. The phone can indeed receive calls from an unknown number, when called back, the answering machine says "number not registered" - this is how spam bots massively collect numbers for mailing lists. People really sit in cars with tinted windows for a long time, including picking at their phones. Students do indeed walk around with backpacks, and it is not at all necessary that they have to follow someone at the same time. Sending sms from the site of the operators and in fact sometimes does not work - you are not the first person from whom I hear such a complaint. The phone, when turned on with the same SIM card, does not really ask for a pin code - it should be so. Mobile communications may not work even without any hacking - for example, due to interference.
The alleged hacking scheme is more like a movie about hackers - when in a bar an evil hacker sits next to the victim and activates something on his smartphone, while "wedging" into the conversation of the person sitting next to him, or taking control of his phone. In reality, the telephone and the station are two radio transmitters and a radio receiver that send encryption to each other on the air. They can indeed be deciphered, and thus eavesdrop on the conversation, but this does not require visual contact with the victim, and nothing indicates wiretapping - you did not cite any facts (or at least possible motives) in any way indicating that at least one of your conversations was overheard. In any case, the cracker does not need to follow you, the presence of a hacker in the immediate vicinity is only necessary when attacking via bluetooth, but if I understand correctly, in the described phone it is not. And vice versa - you can "track down" a person through the phone with an accuracy of up to a cell, at best, to a few nearest ones - but this requires the help of an operator, and so you still can't get an accuracy of more than a dozen meters.
I would have a high chance of believing that the students you mentioned are involved in some kind of smartphone game. For example, the same Ingress - participation in it involves physical movement around the city between certain points. If your daily route intersects with them, you may get the complete impression that such students follow you (and yes, if you look at their phones, you will see something strange there). To exclude the outdoor version, try to choose an unusual and illogical route for yourself - most likely, you will not see familiar faces on it.
The biggest (in my opinion) oddities you described are communication problems. It is not very normal when a person cannot get through, and even more abnormal when calls allegedly from him are registered, which he did not make. But from your description, it is not yet possible to understand how systematic these problems were. Was the "fake" call one-time, or was it repeated regularly? How many times? Did it only appear in the presence of SMS messages about a missed call? Has anyone else seen this SMS? How did the caller himself comment on it? Was there an outgoing call in his call log (maybe accidentally clicked)? It is likely that these anomalies will turn out to be an ordinary technical malfunction, without any crime.
You can try an experiment - buy a cheap "control" phone with a SIM card from the same operator, leave it at home and never take it with you. Then compare the quality of communication with your old phone - let a friend call you first on one, then on the other. Then send SMS. If everything works with one, but not with the other (and moreover, this inoperability will be inherited when the SIM is rearranged) - a reason to suspect something was wrong. At least that way you will have undeniable facts.
А пока что собранные "доказательства" напоминают известную шутку о том, что огурцы смертельно ядовиты - ведь подавляющее большинство умерших в прошлом году людей употребляли в пищу огурцы. Это одностороннее псевдо-доказательство, без проверки опровергающих гипотез. У вас начались какие-то неполадки со связью - вы начали замечать другие странности вокруг, это понятно. Это вовсе не значит, что этих странностей не было вокруг вас ранее.

Answer 7

SIM cards and phone. Yes, it is possible to intercept calls and SMS of another person. To do this, they usually make a copy of the SIM, the location of the original and the fake does not matter, from the options why the fake can follow the original, so that it is not noticeable that these are different people (For example, I have several devices with the same number for calls + for the Internet + spare copy, so technically there is no problem to make a copy of the same number).
Further, I didn’t hear anything about the existence of viruses on SIM cards (there is little sense in them). You can put an application for surveillance on your phone (it doesn’t matter how, install it or infect it with a virus). For this, access by strangers is not always needed, it can also be done via Wi-Fi and Bluetooth (this is so for reference). But again, as for me, if a person has access to copying SIM cards, viruses and tracking applications will be nonsense.
Now about how you can find out SIM cards and new phones of a person. This requires access to only one of the three SIMs (among the comments there was a mention of the third SIM). If the phone has 2+ SIM cards, having gained access to one of the SIM cards, you can find out all the remaining cards that will be inserted into the phone (operators and the police (or whatever they are now), so stolen phones are searched for by IMEI, to put it simply, once inserted a SIM card into the phone, the phone has already lit up, all the other SIM cards that you put will, if desired (access to resources), be associated with the first one). The same thing with SIM cards, if you decide to change the phone, but leave the SIM card, the result will be the same as I wrote above. In other words, if you want to start from scratch, you need a new phone + a new SIM card.
The idea with a new phone + card is good, but there are also disadvantages here. If, after buying a new phone + SIM card, you continue to use the old phone, it will not be too difficult to link them, both devices will be in the same place, so it’s not difficult to guess that these are the phones of the same person.
Also, if you throw away all the old phones and SIM cards (throw it out too much, leave it at home and not fool yourself, then you can not sell it in the trash). In a spherical situation, you can also find a person with a new phone, trite along the routes that he walks every day (in most of them they are not so complicated) + by where the phone spends the night and where it works (in other words, take all the data from the place of residence and check with what will be at the place of work).
The option of how this can happen is quite banal, you need access to a service store that makes copies of SIM cards, for example, there are two or three such stores in my city (population about 35k.), in big cities you yourself understand this number is much more. The second thing you need is access to the operator’s network itself, I don’t even know what is simpler or a fake station that will pick up signals or just fit in as an engineer. True, when accessing a mobile network, the meaning disappears in creating copies of SIM cards, since it will be possible to listen to the user himself, being, as someone wrote above, at least on the other side of the planet.
Z.Y. In truth, everything looks like nonsense, because if a person does not work in a secret factory or something like that, such options are too expensive for most. In principle, not only special services can get access to them (the same work in the service center of a boy or girl that connects SIM cards + engineers of operators' offices), but in any case, such a scheme will be expensive. So the option to go to a psychiatrist, alas, sounds more real. Although, "just because you're paranoid doesn't mean you're not being followed" (c)
Z.Y.S. As mentioned above, you can turn to specialists who will be interested in this. The cost of this can be equal to zero, for example, look for advice on the Dr.Web forums, on the technical side there can be a lot of ideas, but they won’t help with cars and “students”. So just try to spend some time without a phone + radically change your travel routes (take a vacation, rent an apartment in another city for a vacation, after a vacation or during a vacation, find a couple of students / female students in your apartment, rent out housing to them, and rent another place for yourself at this time, take other routes, do not tell your friends/acquaintances where you live.. In general, there are many options).

Answer 8

I will explain on the toes of the left foot.
There is the same bladeRF , and without any problems you can raise your base station on the same OpenBTS'e, for example like this . If 6-8 years ago it was just mysticism, and such equipment cost ridiculous money, now it costs only $500-700 per copy.
If you assemble it yourself on FPGAs, it will certainly be cheaper, in retail the same AD9364 costs $ 130, and AD9361 with two RX / TX modules - about $ 180 plus a Spartan6 / Cyclone4 FPGA $ 30 and a $ 50-60 ceiling kit ..
There are and will be holes in GSM, fixing them is not profitable, even for the same authorities .
detail why, but the same "Department K" is not particularly "non-staining" and all their "checks" can be bypassed without much difficulty ...
Yes, purely from a technical point of view, such pampering, with the ability to record calls / SMS when connected to a fake base station is now very real, and has been seen more than once in the post-soviet space, I don’t know how it is in the Russian Federation, but in Ukraine it’s completely gloomy.
I would not say that this is paranoia because I myself tried to turn this around a couple of years ago - it is quite real and depends on the curvature of the hands and the carelessness of mobile operators.

Answer 9

A tinfoil hat?

Answer 10

не страдайте ерундой. обратитесь в органы. если они действительно проводят манипуляции с вашими сим картами и телефонами это забота ФСБ

Answer 11

Технически это реализуемо, а на сегодняшний день — в два счета за неск. сотен баксов.
Это в Москве?

Answer 12

Если рассматривать вашу проблему от обратного. Результат к которому вы пришли возможен только в двух случаях. Первый в вас заинтересованы гос.органы, а это только по линии МВД но это маловероятно поскольку мне хочется верить в то, что вы ничего не совершили и второй вы интересны некой коммерческой организации для получения какой-либо прибыли.
Что в первом что во втором варианте следить за вами, записывать и прослушивать разговоры, читать и писать от вашего имени смс, блокировать звонки, узнавать ваши новые номера, выявлять номера знакомых все это делается удаленно одним человеком сидя за компьютером, причём делать это так, что никто об этом не догадается ни вы, ни ваш телефон, ни ваша сим карта, будь она даже с ии . Но возможность такую могут предоставить только операторы сотовой связи. Стоимость же подобного мероприятия я бы оценил около 50 миллионов рублей на подкупы высокопоставленных руководителей. А с постоянной слежкой "агентами" эта сумма выросла бы в два раза, ведь нужна координация, план, связь, контроль, оперативность, поддержка, агенты-студенты, проф.оборудование все это не к чему это только увеличит и риски и стоимость операции. Общая сумма такой операции составит около 100 млн.р. Теперь необходимо подсчитать сумму прибыли которую необходимо по результату получить. Получается что вы должны быть очень богатым человеком.

Answer 13

Возможно, вас с кем-то перепутали, как в какой'-нибудь комедии, где простой смертный оказывается близнецом супершпиона. А может вам "посчастливилось" стать жертвой социального эксперимента или участником передачи "скрытая камера".

Answer 14

Надо учесть следующий момент:
Операторы после определенного времени неиспользования сим (отсутствие платных услуг и. т.д.), закрывают номер и через некоторое время запускают эти номера в продажу.
Т.е. у номера может быть много старых хозяев.
Отсюда возможно и звонки с непонятных номеров (как вариант)

Answer 15

In the late 2000s, when there was a boom of all these "short numbers", then there was a massive fraud with them, especially cunning "service" hackers found vulnerabilities in some bodies (in particular [push-button] Samsung, etc.), which allowed access to the Sim Toolkit (STK) "unofficially", remotely, by sending some non-standard SMS. Engaged in this, almost certainly, the insiders of the opsos. Always look for "who benefits." The sharags themselves with these "short numbers" were also probably opened by affiliated persons, and half of the "earned" money from the "content" services still goes to ops, despite the fact that responsibility remains with small "content providers". And vulnerabilities were needed, rather, for disguise.
Very few people know anything about the topic, have practical experience, have access to maps, except for ops specialists. By default, any operator has access to STK applications on their cards, can update them remotely, replace them, etc. Opsos reliably do this periodically, as their representatives themselves talked about in articles. SIM menu is organized by means of STK. Applications written in Java CE are executed on the phone and have the status of trusted "100%", while having certain (full?) rights to access the SIM card itself. That is why it is possible to make calls, send requests, send messages from the SIM menu. Nothing prevents (those with access) from putting malicious code into the STK and making the phone do some pretty amazing things. Read/write access to STK applications is limited to operator keys.
Nevertheless, the presence of vulnerabilities in the STK code and its applications cannot be ruled out, especially since no one really knows anything about them, the broad masses do not pick them up. I suspect that the holes are there, like mushrooms after rain. Where "no one climbs" "Hindu code" always prevails by "a little more than 95%". The presence of a certain Trojan in STK (however, as in the body, but the bodies are all different, and for Java ME access to "telephone functions" is severely limited and they do not have autoload) can easily explain the lack of a Pin code request from the author. If the STK application has intercepted the Pin and disables it, then the request will not work, or a fake one may come out ... I doubt that STK works before entering the Pin (the card is closed according to the standard and I don’t know if it is possible to read / execute what or, for example, the STK code before entering Pin, was not studied in this part).
On the other hand, when you turn off (more precisely, fall asleep, now "nothing" turns off for us) the body, the power is removed from the SIM card, both to save energy and to be able to safely change it. Not all bodies require you to remove the battery, while installing a powered SIM is fraught with burning it or the body itself, such cases do happen, although not often. Perhaps the author's power is completely removed only when the battery is removed.
In addition, a certain part of the bodies (if not all), produced even under the king of peas, can be remotely turned on in order to locate the subscriber by registering in the opsos network using the so-called. "triangulation" (previously had an accuracy of hundreds of meters, now it is almost as good as GPS). Remote activation of a sleeping phone is apparently possible by sending broadcast requests from the switch (cell) containing some code sequences associated with a specific model and instance of the device. Specific information on this topic is unlikely to be found anywhere. They can only be known to the manufacturer of the chipset (perhaps the device) and those to whom he deemed it necessary to inform (it is clear that the services are interested in this in order to conduct legal ORM, but which countries, who has, who does not have on which devices - no one simply knows as well as it is not known if something leaked from somewhere). It is quite possible that by the time of "turning on" the bodies had long been turned on (or "not turned off"), and therefore Pin did not ask. The sudden loss of charge by a "turned off" body can lead to appropriate reflections.
Inter-operator networks SS7 also provide ample opportunities to interfere in the affairs of other people's subscribers. This was vividly described on Habré in specific experiments with access to SS7. Now they covered a lot, apparently, just because of the resonance, and even in the first half of the 10s there was a complete mess and any, incl. some small or foreign telecom operator could track subscribers on the other side of the Earth.
Persons capable of installing a fake cell, which, as you know, have long learned to do for, in general, ridiculous money, are quite capable of manipulating all this instead of an ops, if they know how, have the keys or ways to bypass them. It is clear that those who are involved in such areas are most likely current or former employees of opsos and other telecom operators. The closeness of communication networks, network equipment from a wide range of researchers gives rise to this whole mess, and weak security, and not the availability of some fake cells. Even a dense teapot knows well that it is enough to put a "password" and the children will not get to the computer, which means games or porn. But even such simple methods were neglected quite recently.
Delivered a number of "doubting" amateurs, lovers of hanging labels like "paranoia" or even "if not paranoia." The person quite clearly described the facts to you, of which there are more than enough for correct conclusions ... By the time the article was published, it had already been 2 years since Snow openly said everything, showed and told, and even proved it with thousands of published documents. But to this day, people who "know for sure" "all the subtleties" go around, talk about paranoia, continuing, without even thinking, to personally merge all their personal data into foreign "warm lamp" and "very convenient" clouds of their own free will and consent , while others "competently" advise to run to the "competent authorities". In your, who sits in these competent bodies? Mutant Ninja Turtle Robots? What will you tell them? The phone does not work well, SMS do not reach, suspicious students with backpacks sit next to them, and there are cars with people on the street ... And everyone has phones in their hands! Indeed, a very "suspicious picture" if you yourself do not observe and reveal subtle nuances. The authorities have a headache to solve all serious crimes. In the country, "every second" strives to steal something almost in broad daylight. How, on what grounds and by what means, by what forces will they catch these obscure hacker trackers? It is unlikely that F was interested in the author, since they have full access through SO ... and not only. If they put up outdoor advertising, then certainly not for "breaking the body", but for something more serious ... Since the bodies are broken, being nearby, this is some kind of "