INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · SIMTESTER
SIMtester — SIM OTA Security Auditing
Research Overview
TL;DR — SIMtester by SRLabs is the industry-standard SIM card security auditing tool. It fuzzes ~130 Toolkit Application References (TARs) across 15 key-sets using 16 distinct mechanisms, performs TAR and APDU scanning to enumerate accessible OTA applets, and runs an OTA-Passthrough fuzzer to detect undocumented SMS delivery parameters that bypass carrier filtering. Contributes results to gsmmap.org.
SIMtester applies a systematic brute-force and fuzzing methodology to the 3GPP OTA update surface of SIM and USIM cards, implementing the full command set defined in ETSI TS 102.225 for remote file management and applet installation. The tool iterates across approximately 130 Toolkit Application References (TARs) and 15 key-sets, crafting binary SMS PDUs that exercise each TAR–keyset combination and evaluating ISO/IEC 7816 status word responses to classify each endpoint as accessible, rejected, or misconfigured.
Key derivation is tested across all supported ciphering algorithms (Single DES, Triple DES, AES-128), and the KIC/KID key identifier matrix is probed to detect cards still relying on deprecated 1-key-3DES configurations vulnerable to known-plaintext attacks. The OTA-Passthrough fuzzer probes for undocumented delivery parameters that bypass operator-side binary SMS filtering gateways — simulating the attack class used in Simjacker-adjacent vulnerabilities.
For researchers extending SIM security audits into baseband firmware behavior, FirmWire provides complementary analysis of how modems process OTA command sequences. SIMtester also contributes pseudonymized scan results to the gsmmap.org database for longitudinal global tracking of SIM security posture across network deployments.
Key Research Applications
- >Auditing OTA key algorithm strength before MNO SIM fleet migration from Single DES to AES-128-based key management
- >Identifying undocumented TAR endpoints that accept OTA commands without cryptographic authentication — the exact Simjacker attack surface
- >Assessing completeness of binary SMS filtering at carrier SMS-C and SMS firewall nodes to validate OTA delivery controls
- >Contributing pseudonymized TAR scan results to gsmmap.org for cross-carrier security benchmarking and historical trend analysis
Technical Specifications
Operational Mode
Level 2 certification required. Targeting SIM Cards infrastructure layers.
Compatibility
Smartcard reader and PC/SC drivers required.
Secure Audit Threat Vectors
SIM card OTA security is a persistent, real-world threat vector. The Simjacker vulnerability (2019) demonstrated that PUSH AT commands delivered via binary SMS to silent OTA TAR endpoints could extract IMSI and cell location without any user interaction — campaigns attributed to nation-state actors targeting journalists and dissidents across multiple countries.
SIMtester audits this exact attack surface: it probes accessible TAR endpoints to identify which application references accept OTA commands without cryptographic authentication, and tests whether carriers enforce binary SMS filtering to block unauthorized OTA delivery. OTA keys based on Single DES are breakable with commodity compute — cards still using deprecated key algorithms are vulnerable to key recovery attacks followed by silent applet installation for persistent surveillance. SIMtester's fuzzer also checks for undocumented delivery parameters that bypass carrier SMS firewalls, a class of bypass observed in commercially deployed MVNO configurations.
For baseband-level validation of how modems process OTA commands, see FirmWire.
Frequently Asked Questions
What is SIMtester?
SIMtester is an open-source telecom security utility in the SIM Cards category. SIMtester by SRLabs is the industry-standard SIM card security auditing tool. It fuzzes ~130 Toolkit Application References (TARs) across 15 key-sets using 16 distinct mechanisms, performs TAR and APDU scanning to enumerate accessible OTA applets, and runs an OTA-Passthrough fuzzer to detect undocumented SMS delivery parameters that bypass carrier filtering. Contributes results to gsmmap.org.
Which category does SIMtester belong to?
SIMtester is categorized under SIM Cards in the TelcoSec Tools console. This category covers tools used for auditing SIM card OTA security, APDU command surfaces, and Toolkit Application Reference vulnerabilities.
What hardware does SIMtester require to communicate with a SIM card?
SIMtester requires a PC/SC-compatible ISO/IEC 7816 smartcard reader such as the ACS ACR38U, HID Omnikey 3021, or Gemalto GemPC series. The tool communicates through the pyscard Python library which wraps the OS-level PC/SC daemon. The SIM card must be physically removed from the handset and inserted into the reader — embedded eSIM auditing requires different tooling and is out of scope for SIMtester.
How does SIMtester determine whether a TAR endpoint is accessible?
SIMtester crafts binary SMS PDUs addressed to each candidate TAR and evaluates the returned APDU status word. A 0x9000 (command successful) or 0x91XX (data available) response indicates the TAR is accessible. A 0x6982 (security status not satisfied) response indicates the TAR exists but requires a higher authentication key level. A 0x6A82 response indicates the TAR was not found, allowing SIMtester to distinguish between missing, protected, and open endpoints.
ADVANCED_TRAININGSIM Cards Security PathRecommended for: SIMtester
Master SIMtester Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about SIMtester? Send it directly to the research team.