Regarding SIM toolkit..

sanjay

Recently, when I put my carrier's SIM card in, I noticed that a new app had been installed automatically, with the name of my carrier, and in settings referred to as SIM toolkit. I don't know if it's just me, but personally I have less trust in my carrier than basically any other party involved with my phone. It seems pretty insecure that the carrier gets away with running their own code on my phone, and I get no option to disable or uninstall it. Let me say first that it is not just "necessary for the SIM to work", as there is a whole menu full of stuff my carrier thinks (and have done so for the past 20 years) useful to me, such as celebrity news, sports, and other crap delivered to me by SMS. I find it rather amusing that even in this OS, where security is the utmost priority, the carrier can override all the protection in place and install their own untrusted code on my phone. Now, just to be clear, I don't expect Graphene to drop everything to fix my issue, nor do I take the project for granted. At the same time, I do find it relevant to at least ask why this is the way it is, and what was the rationale behind not letting users uninstall carrier apps. Better yet, why are they installed on their own in the first place? Is there actually any assurance that the carrier won't install a RAT? (other than the fact that I am not a person of interest to the state)

flawedworld

Recently, when I put my carrier's SIM card in, I noticed that a new app had been installed automatically

It wasn't installed. The "SIM Toolkit" app is part of AOSP, and is part of GrapheneOS. It is a frontend for STK applications on your SIM card. The app is disabled by default, and only is enabled if your carrier has applications which expose support for STK apps to the OS from your SIM card.

I find it rather amusing that even in this OS, where security is the utmost priority, the carrier can override all the protection in place and install their own untrusted code on my phone.

See my prior comment.

what was the rationale behind not letting users uninstall carrier apps. Better yet, why are they installed on their own in the first place?

See my prior comment.

Is there actually any assurance that the carrier won't install a RAT? (other than the fact that I am not a person of interest to the state)

Carriers cannot install apps into GrapheneOS, We don't ship with any support for OMA-DM apps (device management system which can be used by carriers, it is used on Verizon in the US) and no 3rd party carrier apps (e.g. the Verizon app) at all are built into the OS. unlike the stock OS, which does ship them (this extends to the OMA-DM apps too to be clear).

Now for the highly unlikely (really must stress that part) but interesting part. The carrier (or someone with enough privileges at your carrier) could run arbitrary code on your SIM card (To make it super clear: said code is not running in the Android OS) via JavaCard applets (which is how you implement STK applets). This is how SIM cards work, it is part of the trust you place into your carrier. STK doesn't give any access into the Android OS to the carrier. An adversary could in theory gain access one way or another to run their malicious code on your SIM card, but they would be confined to the SIM card, so they can only "touch" the baseband, and the data/information passing through it. This though is pretty much the same data/information the carrier (or someone with enough privileges at your carrier) could also be able to obtain without needing the ability to run arbitrary code on your SIM card. All of the above applies to eSIMs and iSIMs too.

Hope that is clear. Let me know if you have more questions.

[deleted]

flawedworld hi there, the SIM toolkit app has just appeared in my app drawer after adding a second eSIM. Is there any way to hide or remove this? Thanks.