← Back to TelcoSec Arsenal
ShadySIM
SIM / USIMSIM card application installation and exploitation toolkit for loading custom Java Card applets onto SIM/USIM cards for OTA attack simulation and SIM toolkit research.
⚡ Quick Telecom Protocol BriefSIM / USIM
ShadySIM is an open-source SIM Card Exploitation component included in TelcoChisel for telecommunications security auditing. It targets SIM / USIM infrastructure for compliance with 3GPP and GSMA telecom security standards.
Primary Binary:
shadysimHardware: PC/SC Smartcard Reader (ACR38U / Omnikey)ShadySIM — SIM Card Applet Exploitation Toolkit
ShadySIM enables loading custom Java Card applets onto programmable SIM cards (sysmoISIM-SJA2, Gialer blanks). Within TelcoChisel, it is preconfigured with PC/SC reader drivers and sample exploit applets for testing SIM Toolkit (STK) command injection, OTA SMS key bruteforcing, and carrier OTA platform security assessment.
Key Capabilities & Security Vectors
- Custom Applet Installation: Load arbitrary Java Card applets onto writeable SIM/USIM cards for security testing.
- SIM Toolkit Hijacking: Install rogue STK menus that intercept user interactions (call setup, SMS sending, USSD queries).
- OTA Attack Simulation: Simulate over-the-air SIM update attacks by testing OTA key derivation and binary SMS payload handling.
- APDU Trace Analysis: Log and analyze SIM ↔ ME (Mobile Equipment) APDU command sequences for protocol reverse engineering.
TelcoChisel Execution Cheatsheet
1. List Installed SIM Applets
# Enumerate all applets installed on the target SIM card
shadysim -l -r 0
2. Install Custom STK Applet
# Install a SIM Toolkit test applet from compiled CAP file
shadysim -i /opt/shadysim/applets/stk-intercept.cap -r 0
3. Delete Applet from SIM
# Remove a previously installed applet by AID
shadysim -d A0000000620001 -r 0
No community field notes posted yet. Be the first telecom engineer to leave feedback!