mitre / mitre/secure-coding-case-studies
Simjacker - A telecom software vulnerability enabling remote device control.
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
The Simjacker vulnerability(CVE-2019-16256, CVE-2019-16257), a serious security flaw found in 2019 that affected SIM Toolkit (S@T Browser) software. It allowed attackers to send special binary SMS messages that could run commands on users' phones without them knowing. It revealed how weak security in SIM Toolkit (S@T Browser) software could let attackers remotely control mobile devices through hidden SMS commands. This case study aims to explain how it happened and what lessons developers can learn from it.
Good read about the incident:
https://arstechnica.com/information-technology/2019/09/hackers-are-exploiting-a-platform-agnostic-flaw-to-track-mobile-phone-locations/
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked Ars Technica report and the issue description to understand the Simjacker incident, its CVEs, and the affected SIM Toolkit software. Add a case study explaining how the vulnerability worked and the secure-coding lessons developers can learn; the issue does not name a target file, template, or validation process.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100