The Plastic Trojan: Why We Must Kill the SIM's Power to Command Our Hardware

I have spent my career operating under a simple premise: trust nothing, verify everything, and assume the perimeter is already breached. But there is one piece of hardware we all treat as a trusted root of authority, a tiny sliver of plastic we slide into our devices without a second thought. We treat the SIM card as a passive credential. We are wrong.

As first reported by The Register, researchers from the University of Birmingham—Tomasz Piotr Lisowski and Marius Muench—alongside Kristian Covic of Fuzzware, have exposed a gaping hole in our cellular security architecture. Using a toolkit they dubbed CATANA, the team discovered that the very standards designed to make cellular communication seamless are being weaponized to turn our devices against us.

This is not a story of a 'bug' in the traditional sense. This is a story of architectural negligence. Marius Muench pointed out that the technical specifications for cellular communication explicitly define both the proactive capabilities of a SIM and the resulting attack surface. In other words, these attacks are "specification-compliant." We aren't fighting a glitch; we are fighting the blueprint.

At the heart of this vulnerability is a command known as RUN AT. This functionality allows a SIM to request the execution of AT commands—an instruction set that has been used to control modems since the 1980s. By granting a piece of plastic the ability to boss around the modem, we have essentially left a back door open for any hostile SIM to walk through.

When the researchers tested 26 devices—consisting of 18 smartphones and eight IoT modems—they found that nine of them exposed an AT command interface to the SIM. The results for the IoT sector were particularly damning: seven of the eight modems tested exposed the interface.

From a defender's mindset, the implications are catastrophic. The researchers demonstrated that a malicious SIM could trigger code execution, arbitrary file reads, and denial of service. They didn't just theorize this; they proved it. By targeting an Autel EV charger equipped with a Quectel EC25-AFX cellular module, the team exploited a command injection bug in the modem's Linux-based application processor to achieve code execution.

Even our high-end smartphones aren't safe. On an Oppo Reno14 F 5G, the researchers identified 198 available AT commands and variants via the SIM interface. These commands could be used to kill the modem or power down the handset entirely. Most alarming was the ability to force a connection downgrade to 2G. Once this happened, the researchers found it was incredibly stubborn; the downgrade persisted even after they toggled airplane mode, disabled the SIM, and altered network settings.

We are effectively allowing a piece of hardware to drag our sophisticated 5G infrastructure back to the security vulnerabilities of the 2G era.

Furthermore, the research highlighted a terrifying potential for data exfiltration. Using a Quectel EG25-G modem, the team combined a malicious symbolic link with SIM-originating commands to email a targeted file directly to a server controlled by the attacker.

Some will argue that this is a low-risk vector because it requires control of the SIM. But in a world of supply chain compromises, breached operators, and physical tampering, that is a naive assumption. The threat is real, and as Muench pointed out, hostile SIMs remain missing from many industry threat models despite previous research and leaked intelligence documents warning of these risks.

We have already seen the software side of this failure. The Register reports that vulnerable versions of Android allowed a hostile SIM to use the standardized LAUNCH BROWSER command to open attacker-controlled websites without user interaction, even on locked phones. While Google patched this (CVE-2025-48618) across Android 13 through 16 in December 2025, the underlying hardware problem remains.

To their credit, some movement is happening. The researchers disclosed their findings to the GSMA in May, as well as to Qualcomm, Semtech, Google, Oppo, and Quectel in March. Qualcomm has since created a hardened configuration to disable the SIM AT interface by default, and the GSMA is tracking the wider issue under the ID CVD-2026-0122.

But a "hardened configuration" is a band-aid on a bullet wound. The only acceptable solution is the one proposed by the researchers: the total retirement of RUN AT and other risky proactive SIM functionality.

Modern smartphones may be starting to move in this direction, but the IoT world is lagging dangerously behind. We are deploying millions of connected devices—from EV chargers to industrial sensors—that are essentially welcoming a malicious SIM to take the wheel.

It is time to stop pretending that "specification-compliant" means "secure." If the standard allows a piece of plastic to execute code and dismantle our security stack, then the standard is the vulnerability. We must stop trusting the SIM and start stripping it of its power to command our hardware.