view doc/GrcardSIM1-notes @ 99:97ba63d9361a

scripts/fcsim1-sst: turn off STK & OTA services In the initial unprogrammed state of the cards from Grcard, SST has services 25 through 29 set to allocated and activated. However, these cards appear to not actually support OTA, ENVELOPE commands do nothing (just return SW 9000), and they were never observed issuing any proactive SIM commands, even after a feature-generous TERMINAL PROFILE. Therefore, let's list these STK & OTA services as allocated, but not activated in our FCSIM1 SST.
author Mychaela Falconia <falcon@freecalypso.org>
date Wed, 05 May 2021 04:26:07 +0000
parents 9de2d8b8951d
children
line wrap: on
line source

As of A.D. 2021, the GSM-only SIM card model (as opposed to USIM/ISIM for LTE/5G
users) sold by Grcard company is the one which we call GrcardSIM2 - our current
FCSIM1 cards are GrcardSIM2, and this card model goes back to some time around
2013, when it was sold by Sysmocom as sysmoSIM-GR2.  However, if we go back in
time a little further to around 2011, Grcard had an earlier card model which we
call GrcardSIM1 - it was sold by Sysmocom as sysmoSIM-GR1.  In the present day
these original GrcardSIM1 cards are extremely scarce: Mother Mychaela got one
card from Das Signal, there may be one or two other people on the planet who
have one or two cards, but that's it - an extreme rarity.

These GrcardSIM1 cards have one and only one special feature that makes them
interesting: supposedly they are freely reformattable, meaning that any
individual card owner can completely erase the card file system and then
recreate an entirely new one according to her liking: see our
Formatting-thoughts article.  However, I said "supposedly" in the previous
sentence, referring to GrcardSIM1 free reformatting ability, because the extreme
scarcity makes it too difficult to test this ability: I (Mother Mychaela) have
only one card to play with, I am not too keen on the idea of possibly bricking
this card via incorrectly-guessed formatting commands, and there does not seem
to be much point in developing formatting tools for a card model that is no
longer available.

Aside from their unique reformatting feature, GrcardSIM1 cards have two very
notable defects compared to current GrcardSIM2 or FCSIM1:

* GrcardSIM1 cards have a broken security model in that grcard1-set-pin1,
  grcard1-set-pin2, grcard1-set-adm1 and grcard1-set-adm2 commands (or rather
  the actual command APDUs sent by these fc-simtool commands) are completely
  unauthenticated, meaning that all PIN security is trivially bypassable: you
  can take a PIN-locked card for which you don't know the PIN, you can reset
  its PIN with grcard1-set-pin1, and bingo, you have access to all private data
  and the GSM authentication token which the hapless owner sought to protect
  with their PIN.  The same goes for ADM access: if someone set the card's ADM2
  key to some unknown secret, you can reset it back to the pySim default of
  4444444444444444 with grcard1-set-adm2 and give yourself full admin write
  access, without ever knowing the previous key.

* GrcardSIM2 (FCSIM1) cards support F=512 D=8 speed enhancement (the classic
  SIM speed enhancement specified in GSM 11.11 and supported by classic GSM/2G
  phones), but GrcardSIM1 cards don't support it - hence GR1 cards run in the
  slowest F=372 D=1 mode.

The only datum on GrcardSIM1 cards which appears to be secure against reading
is Ki.  grcard1-set-ki command is unauthenticated like the other grcard1-set-*,
thus anyone can overwrite Ki with their own, but it is a write-only datum on
this card model: it does not appear in the file system, and there is no command
for reading Ki.  Contrast with GrcardSIM2, sysmoUSIM-SJS1 and sysmoISIM-SJA2
cards: all of these cards store their Ki in a special file in their file system,
but this file requires ADM access (SUPER ADM on GrcardSIM2, ADM1 on Sysmocom
cards) for both reading and writing.