Malicious SIM Cards Can Shut Down Phones and Steal Files
Researchers found SIM cards can force phones to revert to 2G.
1Proactive Features of SIM Cards
Researchers at the University of Birmingham discovered that SIM cards can send commands to phones. This feature, enabled by the RUN AT command, allows control over modems. The researchers found that malicious SIM cards could exploit this capability, leading to data leaks, downgrades to 2G, or even device shutdowns.
2Testing with CATANA Toolkit
The researchers developed a toolkit called CATANA to test 26 devices, including 18 smartphones and 8 IoT modems. The tests revealed that nine devices exposed their SIM card interface. IoT modems were particularly vulnerable to such attacks.
3Attack Surface of SIM Cards
The researchers noted that the proactive features of SIM cards expand the attack surface. These features are defined in technical specifications, making the attacks 'specification-compliant.' Previous research and leaked intelligence documents had already highlighted these risks.
4Impact on Devices
Researchers found 198 AT commands and variants on devices like the Oppo Reno14 F 5G. These commands could power down the phone, disable the modem, or force it to revert to 2G. The downgrade to 2G was particularly persistent and couldn't be reversed by changing settings.
5Vulnerabilities in IoT Modems
Seven out of eight IoT modems tested exposed their SIM card interface. This makes them susceptible to malicious commands. The researchers emphasized that IoT devices are more vulnerable to such attacks.
6Security Flaw in Android
The researchers discovered that some versions of Android allowed SIM cards to use the LAUNCH BROWSER command to open websites without user interaction. Google tracked this flaw as CVE-2025-48618 and released patches for Android 13 through 16.
7Manufacturers' Responses
The researchers shared their findings with Google, Oppo, Quectel, Semtech, and Qualcomm. Qualcomm developed a configuration that disables the SIM AT interface by default. The GSMA is tracking the issue as CVD-2026-0122.
8Long-Term Solutions
The researchers recommend retiring RUN AT and other risky SIM card features. While modern smartphones are more secure, IoT devices still have significant vulnerabilities.