Group items tagged

G+D's Lars Hupel writes that eSIMs replace traditional, removable SIM cards with an embedded SIM chip directly on the device. SIM cards no longer need to be physically replaced for an update. Instead, a new eSIM can be simply downloaded. Starting with the iPhone 14 in 2022, Apple has stopped shipping physical SIM trays in the US. New models use eSIM only. By 2030, the eSIM adoption rate will reach 80% in Latin America, Southeast Asia and the Eurozone, while Middle East and North Africa is expected to reach 70%. Secure CBDC wallets could be run easily on eSIMs. https://www.gi-de.com/en/spotlight/digital-security/time-to-adopt-the-esim

SIM swapping, also known as SIM jacking, is a type of ATO (account take over) attack during which a malicious threat actor uses various techniques (usually social engineering) to transfers a victim's phone number to their own SIM card.

Crypto investor Michael Terpin has written an open letter to US FCC chairman Ajit Pai requesting urgent action on SIM swapping fraud. He asked the regulator to make mobile carriers hide customer passwords from employees and to provide a "no port" option, whereby customers would have to go through a company's fraud department before transferring their SIM information to a new phone. In a SIM swap, criminals pose as the owners of a victim's mobile phone number, convincing telecom providers to grant them access to the SIM card.

The Bank of China has partnered with China Telecom and China Unicom to test SIM card near-field communication (NFC) payments for the e-CNY on specific Android smartphones in certain regions. The SIM card hardware wallet shares its balance with the main wallet, eliminating the need for separate top-ups. In order to make payments, users are only required to move their mobile phones close to point of sales terminals, even with a switched-off smartphone. https://mp.weixin.qq.com/s/Il2p2rKE116xMh97Ml0wQg

Six individuals from 'The Community' hacking group have been charged with stealing over $2.4 million in cryptocurrency using the SIM swapping method.

Whilst governments can take different approaches to implementing SIM registration, we have asserted that 'Capture and Validate' (C&V) processes give the highest level of confidence that the person registering a SIM 'is who they claim to be'. This is because C&V enables mobile network operators (MNOs) to validate their customers' ID against a central government database, usually in real time. Globally, only 16 countries follow this approach.

A major hack that compromised Uganda's mobile money network has plunged the country's telecoms and banking sectors into crisis. The October 3 hack was a result of a security breach on a consumer finance aggregator, Pegasus Technologies, which mainly affected bank to mobile wallet transfers. At least $3.2 million is estimated to have been stolen. The hackers used around 2,000 mobile SIM cards to gain access to the mobile money payment system. They then instructed the banks to transfer millions of dollars to telecommunication companies who then paid out mobile money to these different SIM cards across the country.

The European Central Bank (ECB) is inviting experts in offline payments to participate in conversations to explore options for an offline digital euro as part of its retail central bank digital currency (CBDC) work. It wants to understand the marketplace for using embedded secure elements (eSEs) and embedded SIMs (eSIMs) in user devices. Secure elements are standard-compliant chips that ensure safe data storage embedded in most smartphones and many wearables, typically for payments. eSIMs facilitate user network switches via software updates, instead of swapping physical SIM cards. Both could play roles in offline payment functionality. The experts are to be drawn from original equipment manufacturers (OEMs), mobile network operators (MNOs) and specialized trusted service managers, but none that are participating in any of the ECB public tenders on digital euro components. https://www.ecb.europa.eu/press/intro/news/html/ecb.mipnews240801.en.html

A Secure Element securely stores card/cardholder data and manages the reading of encrypted data. During a payment transaction it acts like a contactless payment card using industry standard technology to help authorize a transaction. The Secure Element could either be embedded in the phone or embedded in your SIM card.

"This week, a stunning story from Vice revealed how easy it is for an attacker to siphon away your text messages. They don't need access to your phone; they don't even need your SIM card. They just need to pay a trivial sum, convince a VoIP wholesaler that they're a reseller (also a trivial matter), and sign a form swearing that they're allowed to route messages to your number to another."

While nowadays there are multiple ways of bypassing MFA protections, the FBI alert specifically warned about SIM swapping, vulnerabilities in online pages handling MFA operations, and the use of transparent proxies like Muraen and NecroBrowser.

The People's Bank of China will reportedly start small-scale testing its digital currency (CBDC) in Shenzhen this month (December). The test will be performed in a "horse race" model, with each of four participating banks proposing a different payment model. While some of the banks chose to collaborate with the three telecom firms participating in the pilot to develop SIM cards with built-in digital wallets, others have built their independent wallet apps. Suzhou may test the new currency as well.

Emirates Digital Wallet, along with First Abu Dhabi Bank, FAB, Mashreq Bank, National Bank of Fujairah and Mastercard launched the klip Digital Cash Platform. Klip offers a simple way for users to transfer money to others via a mobile number and allows users to seamlessly pay for goods in-store using the existing merchant reach offered by its partner banks. It further enables small businesses to start accepting digital payments via mobile phones, meaning more businesses can tap into the digital economy. It is available whether or not the user has a bank account - there is no minimum requirement, other than being a resident of the UAE and having a SIM card. klip is instant, and when a klip transaction is made no personal financial data is transferred. https://www.edw.ae/faqs-2/

"IDEMIA and ConsenSys have joined forces to offer a truly inclusive Central Bank Digital Currency (CBDC) solution that can work with any consumer device: smartphones of course, but also feature phones, biometric payment cards, sim cards, wearables and even connected machines, making CBDC available to everyone."

The Qingdao branch of the Bank of China (BOC) has rolled out a new payment option for Qingdao Rail Transit through digital yuan hardware wallets for payments without network and electricity. This "deferred payment" system allows travelers to use the public transit service first and pay later with the hardware wallet featured enabled on users' smartphones. This functionality requires the use of an Android-based smartphone running a "Super SIM" card that stores digital yuan account information for use when there's no network or electricity, introduced by China Mobile, China Telecom, and China Unicom in 2023. https://baijiahao.baidu.com/s?id=1794932657646082801&wfr=spider&for=pc

Central banks need to realise that it is impossible to prevent distribution of counterfeit coins that are transacted in an offline mode when a cryptographic dialogue is carried out between payer and payee. This vulnerability relates to most known secure elements/devices, stored-value cards, universal access devices and Tamper Resistant Elements (TRE), such as smart cards, SIM cards, embedded secure elements and so on, that are already being tested for offline clearing and final settlement capabilities. It derives from realizing that any cryptographic dialogue that convinces a payee offline may be emulated by a resourceful counterfeiter. If you wish to execute payments between two parties in offline mode when there is no internet connection, with no risk of counterfeit money to be distributed by adversaries, you need to have a physical procedure (not cryptographic) that enables a fast, instant, simple and secure (up to being quantum-safe) validation process and payment transaction, with finality of payment.

The eSIM ecosystem offers an equivalent level of security and protection to that provided by the removable SIM card. The protocols are based on state-of-the-art cryptographic mechanisms and secure the privacy of the end user. A public key infrastructure (PKI) governed by the Global System for Mobile Communications Association (GSMA) provides a secure authentication of the entities of the ecosystem. Manufacturers or providers of eSIM solutions have to undergo GSMA certification in order to be admitted into the ecosystem.

Giesecke+Devrient (G+D) has unveiled its Filia Unplugged offline payment solution that can be integrated into existing digital payment platforms, including tokenized deposit systems, instant payment systems, or mobile money services. It enables use cases such as peer-to-peer payments (P2P) or payment-to-business (P2B) payments. The solution stores monetary tokens on a hardware wallet (e.g. the SIM card of a smartphone) and requires only two wallets to operate, which can then be used without an online connection, for example via near field communication (NFC).