Schneier on Security

Thoth • November 30, 2016 9:22 PM

@Bruce Schneier

Ross Anderson had a nice idea but what’s worrying is the use of “Overlay” SIM cards. Overlay SIM are simply a sticker containing a SIM chip and you paste the SIM sticker on top of a cellphone’s GSM SIM card and this has gotten GSMA very worried.

In fact, GSMA, in an effort to retain their powers, had wrote a letter to all Service Providers to take Overlay SIMs as possible problems to the GSM network.

To put it bluntly, the Powers That Be hates changes and prefers the old ways to retain their market control.

I see an avenue for camera phones with a modification to Ross Anderson’s method to use Overlay SIMs combined with cameras on phones to create a lightweight distributed payment with more security by exchanging asymmetric keypairs (i.e. Currve25519 or ECC P-256) instead of shared keys. Although Ross Anderson was correct that SIM chips are tamper resistant, the fact is that they still can be decapped and gotten hold of the shared keys. If keypairs are used, decapping a single Overlay SIM is useless as everyone would theoretically have a different keypair and this is where you use the camera of the phone comes in to do photo-based QR code verification and transmission of parties’ public keys just like how Signal and other security apps use QR codes to exchange public keys with camera phones.

The main thing is snapping the spine of GSMA controlled authentication and payment because GSMA will not sit idly to allow DigiTally the rampant adoption as GSMA and their Service Providers that makes profits over telco network services would see a drop in revenue since DigiTally does not provide payment over SMS and GSMA’s warning to telcos about the “dangers” of Overlay SIM.

Link: http://www.gsma.com/publicpolicy/wp-content/uploads/2014/08/GSMA-Security-Group-Overlay_SIM_Security_Assessment_August_18_2014.pdf

Thoth • December 1, 2016 4:57 AM

@Winter

The reason GSMA wrote the letter is due to the fact that they have their own payment and financial APi over GSM network (linked below). All the GSMA APIs are behind NDAs, paywalls, contracts and so on.

Noting that major telcos in Africa have the M Pesa mobile payment initiatives and DigiTally seems to outperform M Pesa (froim the reports), what are the chances that the telcos who have their own lousier implementation would back down and admit that DigiTally is the better version and support it ? There is a chance the huge telcos may back down and adopt DigiTally or revamp their M Pesa to use DigiTally schemes but I guess their huge corporate egos may not allow it to happen ?

These are all my guesses though.

Link:
– http://www.gsma.com/personaldata/api-exchange
– http://www.gsma.com/personaldata/mobile-connect-banking
– http://www.gsma.com/personaldata/mobile-connect-commerce
– https://en.wikipedia.org/wiki/M-Pesa