On Mar 20, 2019 Security Explorations reported a security vulnerability (Issue 19) to Gemalto [1], that made it possible to achieve read, write and native code execution access on company's card (GemXplore 3G v3.0).
On Mar 30, 2019, Gemalto provided Security Explorations with the results of its analysis of the submitted report.
Gemalto started its message by stating that "the company is committed to provide state of the art security products and solutions to its Customers and is always very attentive to security information that may affect them".
Yet, Gemalto did not ask Security Explorations for:
The company indicated that its "R&D Card teams and Java Card experts have thoroughly studied the report submitted as well as other technical information made public by Security Explorations".
Yet, the company referred to reported issue as potentially impacting Gemalto products and finally concluded it is "not applicable to products used in compliance with their user guidelines" [2]. Gemalto indicated that "today and to the best of its knowledge, there is no vulnerability in the applet loading process".
Security Explorations does not think Gemalto R&D Card teams and Java Card experts have thoroughly studied the received vulnerability report.
The report contained an unintentional mistake in the way that it incorrectly associated GemXplore issue to USimera Prime SIM card. The USimera card could be successfully exploited, however the exploit was due to another vulnerability and Gemalto should have spotted that.
On Apr 15, 2019 Security Explorations provided Gemalto with an updated version of the report, which now treats USimera issue as a separate weakness (Issue 33).
Security Explorations is perfectly aware that Gemalto makes use of its own custom implementation of Java Card VM. This implementation hasn't been investigated in a thorough fashion as there was no need for it. Discovered issues were completely sufficient to achieve unauthorized access to target cards (such as to code and data memory or STK keys) as proven by our accompanying publication [3].
In that context, Gemalto referral to Security Explorations' report in terms of potentially affecting company's products does not reflect the reality. The reported issue has been clearly proven to affect given Gemalto products. The security of Gemalto's Java Card VM implementation has been successfully compromised regardless of some custom security checks implemented by the runtime.
It's worth to note that achieved compromise clearly shows that target Gemalto SIM cards failed to provide secure environment for multiple applications as imposed by Java Card specification [4]. Vulnerable Gemalto SIM cards cannot securely co-host applications from various providers such as telecom and banking due to no security isolation between them.
It's surprising to learn that one of the world's top SIM card vendors dismisses a threat reported with respect to company's products, which are potentially used to safeguard security and privacy of hundreds of millions of people around the globe.
Security Explorations has reasons to believe that Gemalto SIM cards require an in-depth security investigation.
Initial security analysis conducted with respect to GemXplore3G SIM card revealed several instances of preinstalled, proprietary SIM Toolkit applications from Gemalto with a dangerous functionality. At least one of them can be used for unauthenticated, over-the-air loading of arbitrary Java applet code into the SIM. Proper vulnerability report describing this (Issue 34) was also submitted to Gemalto on Apr 15, 2019.
Additionally, SIM Toolkit security settings seem to be relying on the presence of some files (directly affecting STK MSL and signature checking).
Finally, we experienced problems obtaining keys for development purposes with respect to many Gemalto cards (such as NFC UPteq). According to our supplier, the keys were not provided to it by Gemalto partly for security reasons.
In that context and with respect to Gemalto response received, we have reasons to suspect that security of Gemalto cards may rely on secrecy of the implementation (and secrecy of the keys) rather than quality and security of code ("security through obscurity"). Our experience with SAT TV ecosystem and "secure" STMicroelectronics chipsets (broken to pieces in 2012 [5] and 2018 [6], all relying on secrecy for security) make us believe same situation may apply in Gemalto case.
The above makes independent security evaluation of Gemalto products even more important taking into account their wide market share.
At this point, we are however unable to complete the project without external support.
The original idea behind Security Explorations was to make it an independent outfit capable to self-fund its possibly high quality and influential security research that could be contributed to the public.
We always thrived to do our best when it comes to fulfilling the mission aimed at increasing general awareness of users and vendors in the area of computer and Internet security. Thus, so many free researches conducted and released to the public from our end.
Over the last 11 years, we discovered over 200 security issues in products of major vendors such as Apple, Google, IBM, Nokia, Oracle and STMicroelectronics [7].
Our materials contributed to positive changes at some organizations and security improvements of real-life software products used by millions (a billion in case of Java SE) of users around the world. Our publications and Proof of Concept codes have been used by both the industry and academia. This includes renown companies and organizations.
The commercial failure of our a year and a half long security researches targeting SAT TV ecosystem [8][9] has directly jeopardized our funding and Pro Bono mission. This along no response to our inquiries from vendors and government CERT teams [10] questioned current formula of the company.
Security Explorations issues a call for sponsors concerned about security of Gemalto solutions and willing to provide support to conduct security analysis of Gemalto Java SIM cards for the purpose of making the results of the analysis available to general public.
The result of the call is to provide a key answer with respect to the need of an independently conducted security analyses of key technologies such as Java based SIM cards. It is also to decide about the future of Security Explorations as well.
All interested parties are encouraged to refer to the official Gemalto Java SIM cards research - Call for Support document [11] for further details.