WIBattack Campaign (2019)
Sophisticated attack campaign exploiting the Wireless Internet Browser application on SIM cards
Overview
The WIBattack campaign was a sophisticated surveillance operation discovered by AdaptiveMobile Security in October 2019, following their earlier SIMjacker research. This attack exploited the Wireless Internet Browser (WIB) application present on certain SIM cards to conduct unauthorized surveillance and data collection.
Similar to SIMjacker but targeting a different SIM application, WIBattack demonstrated that multiple SIM Toolkit applications could be vulnerable to exploitation through binary SMS messages. The campaign affected users across Europe, Asia, and Africa, with an estimated 100,000+ potential victims.
Discovery Process
Discovered by AdaptiveMobile Security as a follow-up to SIMjacker research. The team investigated whether other SIM applications could be exploited using similar techniques, leading to the discovery of WIBattack.
Context
Demonstrated that multiple SIM applications could be exploited for similar attacks, highlighting systemic security issues in SIM Toolkit application design and deployment.
Scope
Affected SIM cards with WIB application across multiple operators in Europe, Asia, and Africa. The attack had been active for approximately 2 years before discovery.
Technical Details
Target Application
Application ID: A0000000871004
Wireless Internet Browser (WIB) - A SIM Toolkit application designed for basic web browsing functionality on feature phones.
Attack Vector
- •Binary SMS containing WIB-specific commands sent to target devices
- •SMS-PP (Point-to-Point) messages with WIB command sequences
- •Commands executed with SIM Toolkit application privileges
- •Silent execution without user awareness or notification
Command Capabilities
Surveillance Functions
- • Location information requests
- • Device information gathering
- • SMS manipulation and interception
Control Functions
- • Call control functions
- • Browser control and manipulation
- • Response data exfiltration
Target Identification
Attacker identifies target phone number (MSISDN)
Binary SMS Crafting
WIB-specific command sequence created and encoded
Message Delivery
SMS-PP message sent to target device via SMS-C
Silent Execution
WIB application processes command without user notification
Data Collection
Requested information gathered from device/network
Response Exfiltration
Data sent back to attacker-controlled number via SMS
Timeline
Estimated Campaign Start
Initial WIB exploitation activities detected in retrospective analysis
Active Exploitation Period
Sustained targeting of specific regions and demographics across Europe, Asia, and Africa
Public Disclosure
AdaptiveMobile Security publishes WIBattack research findings
Industry Response
Mobile operators implement countermeasures and WIB-specific filtering rules
Impact Assessment
Immediate Response
- Implementation of WIB-specific SMS filtering rules
- Enhanced monitoring for WIB-related binary SMS
- Customer advisories and security updates
Medium-Term Response
- Comprehensive audit of all SIM Toolkit applications
- Enhanced OTA security controls for WIB applications
- Development of application-specific security policies
Long-Term Response
- Industry-wide review of SIM application security
- Enhanced security requirements for SIM Toolkit applications
- Improved vulnerability assessment processes
Lessons Learned
Multiple Application Vulnerabilities
Multiple SIM applications can be vulnerable to similar attack techniques, requiring comprehensive security testing of all SIM Toolkit applications.
Comprehensive Security Testing
Need for thorough security testing of all SIM applications, not just commonly used ones, to identify potential vulnerabilities.
Application-Specific Controls
Importance of implementing application-specific security controls and monitoring for each SIM Toolkit application.
Threat Intelligence Sharing
Value of threat intelligence sharing across the industry to identify and respond to similar attack patterns.
Proactive Vulnerability Assessment
Critical need for proactive vulnerability assessment rather than reactive responses to discovered attacks.
Technical Controls
- Disable unnecessary WIB applications on SIM cards
- Implement application-specific OTA filtering
- Enhanced binary SMS monitoring and analysis
Operational Measures
- Regular security audits of all SIM Toolkit applications
- Improved security testing methodologies for SIM applications
- Industry-wide vulnerability disclosure and response processes