Malicious SIMs can shut down phones, steal files, and drag 5G back to 2G
- ID
- 13003
- Status
- summarized
- Published
- 11 Aug 2026, 5:37 PM
- Fetched
- 11 Aug 2026, 6:15 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/11/malicious-sims-can-shut-down-phones-steal-files-and-drag-5g-back-to-2g/5285482
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 5.5
- Created
- 11 Aug 2026, 6:16 PM
- Tags
- Audience
- developerssaas_founders
What happened
Researchers from the University of Birmingham and Fuzzware presented a toolkit called CATANA at USENIX WOOT that exploits proactive SIM functionality—specifically the RUN AT command—to hijack cellular modems. Testing 26 devices (18 smartphones, 8 IoT modems), they found 9 exposed an AT command interface to the SIM, enabling code execution, file theft, denial of service, and forced 2G downgrades. Demonstrated attacks include code execution on an Autel EV charger via a Quectel EC25-AFX module and 198 AT commands accessible on an Oppo Reno14 F 5G, including one that forced a stubborn downgrade to 2G that couldn't be reversed by toggling airplane mode or changing network settings.
Why it matters
If you ship IoT devices with cellular modules (especially Quectel modems, which are common in Malaysian IoT and fleet deployments), audit whether your modem exposes the AT command interface to the SIM and whether you can disable proactive SIM commands. The Oppo Reno14 F 5G is a consumer device sold in Malaysia, so the 2G-downgrade and shutdown attacks are directly relevant to local mobile users—worth flagging if you build mobile apps or advise on device security.
Discussion angle
For IoT builders: do your Quectel-based devices expose AT commands to the SIM, and is proactive SIM functionality something you can disable in firmware? For everyone else: this is a reminder that SIM cards are active computing devices, not passive authentication tokens.