eSIM security

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://security-explorations.com/esim-security.html
• Blog Title: eSIM security
• Suggested Section: generic-hacking/smartcard-java-card-exploitation.md

🎯 Content Summary

Complete Compromise of Kigen’s eUICC Java Card VM

Vulnerability Overview

Security Explorations of AG Security Research demonstrated a complete compromise of Kigen’s eUICC Java Card VM (Infineon SLC37 ESA1M2 on 32-bit ARM SecurCore SC300) by exploiting missing type-safety checks in the getfield and putfield bytecodes. These instructions do not verify whether the operand is an object or an array, allowing an attacker to cast between array an...

🔧 Technical Details

Java Card VM type-confusion: Missing type-safety checks in getfield/putfield allow casting between object and array references. The overlap of an array’s length field with object instance fields provides an arbitrary memory read/write primitive on the eUICC.

SMS-PP OTA applet installation: By leveraging publicly known GSMA consumer certificate keys and the SMS-PP APDU sequence (e.g., 80 CA DF 1F 00 to read firmware version), an at...

🤖 Agent Actions

Added new page: src/generic-hacking/esim-javacard-exploitation.md

Key points added:
• Detailed explanation of Java Card VM type-confusion in getfield/putfield leading to arbitrary read/write on eUICC
• Full OTA exploitation chain (SMS-PP LOAD/INSTALL, firmware check, memory leak, key theft, profile cloning)
• APDU examples, byte-code snippet and step-by-step workflow
• Description of the Basic Security Check (bsc) toolkit modules for automated detection/exploitation
• Mitigation guidance and quick pentest checklist
• References section with links to the original research and relevant specs

No existing HackTricks pages covered smart-card / eSIM topics, so a standalone file was created under generic-hacking.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 852
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://security-explorations.com/esim-security.html

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/smartcard-java-card-exploitation.md".

Repository Maintenance:

• MD Files Formatting: 852 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0