SIM chips exploitable?

K8y

Hello,
Maybe a silly question, but I always heard the physical SIM card doesn't carry any info on it beyond letting you connect with the cell towers, so no big deal if you lose it.

But then recently I hear otherwise... that SIM chips DO have your personal info, contacts, text history etc on them.

Which is true?

If someone's SIM gets taken out and stolen from a Pixel Graphene phone, what will the thief have exactly?

Thank you.

DeletedUser87

K8y can't say anything specific, but contacts and SMS/call logs haven't been stored on SIM cards for years now. I highly doubt there will be any personal data on it due to the very limited storage size of a physical SIM.

LocaLola

K8y

You can get a phone number from an online provider and/or use a data only eSIM if you're more comfortable with that.

K8y

DeletedUser87 I highly doubt there will be any personal data on it due to the very limited storage size of a physical SIM.

The chip size isn't large enough to retain basic info?

Here's one very alarming article I came across that says they do:
https://techwithtech.com/what-can-someone-do-with-your-sim-card/

DeletedUser87

K8y please don't link that garbage here. The article is alarmist and misleading. And especially this paragraph

SIM cards can store pictures.

So can cloud services run or verified by your phone company.

That means that a stolen SIM card can be used to steal pictures that you save on your phone.

is evidence of nonsenical blabbering.

Please show me how to store photos on a SIM card and then tell me how many photos you will fit on 256kb of storage (because that's the maximum). Modern Pixels (and iPhones and various other phones) can't write contacts to SIM (and haven't been able to for years). Call logs are also not stored on SIM cards, same as contacts. I also can't find a way to write SMS to SIM. You would really have to try to get yourself compromised.

K8y

DeletedUser87 I was thinking like you did. But as is the case with many alarming articles, is their ANY truth to it? Do Sim chips hold your contacts information? Do they hold any texts?

Finally does GrapheneOS encourage and allow people to password protect their sim chips?

I would love to get official confirmation on all this, even if most of that article is off, are their some things, like the above, that are still vulnerable?

Thank you

DeletedUser87

K8y as I said, there is nothing really stored on SIM cards anymore. The only angle would be to exploit the physical access to your phone number and whatever that is attached to. But no contacts, call logs, SMS or anything else, unless you stored it there with a legacy phone before. GrapheneOS has no ability to store any of the data mentioned above on a SIM card by itself; everything goes to the phone's internal storage.

NetRunner88

On a similar subject :

Vulnerabilities in the eSIM download protocol
http://i.blackhat.com/EU-24/Presentations/EU-24-Ahmed-VulnerabilitiesIneSIM.pdf

K8y

NetRunner88 Vulnerabilities in the eSIM download protocol
http://i.blackhat.com/EU-24/Presentations/EU-24-Ahmed-VulnerabilitiesIneSIM.pdf

LocaLola You can get a phone number from an online provider and/or use a data only eSIM

Yes, true except for the eSIM vulnerabilities...
Are eSIMs more protected in graphene than stock Google?