Could the Nokia 1100 be hacked to sniff SMS messages intended for third parties?

Question

TL; DR; version: Is it possible that hackers were somehow able to "reprogram" a specific Nokia 1100 phone to make it receive SMS messages sent to another person's phone number?

---

A couple of years ago, a friend of mine asked me if I happen to have an old Nokia 1100 around. I inquired him about this very specific request and he told me that there's a "black market" forming where people buy these phones for hundreds of euros because "hackers found a way to hack ATMs through them".

Since this sounded just as ridiculous back then as it does now, I told him it's probably some kind of scam, but he insisted he knew people who sold them on e-bay for a lot more. I Googled it back then and found out that, supposedly, someone actually did sell a Nokia 1100 for as much as $32,413 (this probably started the whole thing).

PC World wrote extensively about this. In short:

• The fraud is possible because somehow the phone can be reprogrammed to use someone else's phone number, allowing them to receive some kind of code confirmation via SMS to confirm a bank transaction.
• The reprogramming is possible due to a software flaw.
• The flaw is only present in phones that were made in a factory in Bochum, Germany.
• In addition, the flaw only appears to be present in a specific firmware version (variously reported as RH-15, RH-16, RH-17 or RH-18).

Based on my limited knowledge of mobile phones, I don't see how such a thing would be possible for many reasons (how was it even possible to modify the software of such a closed platform where not even firmware upgrades were simple? can you really "reprogram" a phone to use a different number when such information is actually stored on the SIM card? wouldn't some kind of special device for these purposes be cheaper than $32000?), but PC World soon afterwards reported that investigators managed to replicate this somehow.

I failed to find any further information confirming or denying these claims or giving some "more technical" explanation and it seems people simply stopped talking about it soon after (despite it creating quite a buzz back then - hell, there were even sites dedicated to making markets for these specific phones), so I'm now curious whether this whole story makes sense in retrospect, the whole idea of "reprogramming" a phone to receive an SMS and then using this to somehow steal enough money to make it worth $32,000?

Answer 1

TL;DR answer: It seems like Nokia 1100 made it easier to spoof someone's phone number, but it wasn't as easy as media presented it. You still had to copy someone's SIM card.

---

I don't see how such a thing would be possible for many reasons (how was it even possible to modify the software of such a closed platform where not even firmware upgrades were simple?

The application that cybercriminals had access to, allowed them to decrypt Nokia 1100 software. So you could modify it even if it wasn't publicly available for example as open source, as you can read here:

That application allows a hacker to decrypt the Nokia 1100's firmware, Becker said. Then, the firmware can be modified source

Then you're asking:

can you really "reprogram" a phone to use a different number when such information is actually stored on the SIM card?

They didn't reprogram phones just to impersonate some number. They reprogram it, so this phone would make it possible to use already copied SIM card. SIM card was doing the "impersonating", I assume that the problem was just finding the device on which this SIM card could be used. So just the phone alone will not be enough, and copying someone's SIM is needed, and it's not an easy task, as you need to gain access to that SIM card. Not to say that modern SIM cards have better protection against copying (but back then they probably didn't):

[...] cryptic analysis can be used to obtain Ki value only on those SIM cards which support the most obsolete version of A3 algorithm – COMP128v1. Those are still used by some carriers, and such cards can indeed be cloned. More advanced carriers have already switched to COMP128v2 and COMP128v3 algorithms which increase the number of RAND-SRES bundles so the Ki key cannot be calculated with the use of the abovementioned method. source

By saying that "reprogram it, so this phone would make it possible to use already copied SIM card" I mean that they have been able to change IMEI and IMSI of the phone:

Then, the firmware can be modified and information such as the IMEI (International Mobile Equipment Identity) number can be changed as well as the IMSI (International Mobile Subscriber Identity) number, which allows a phone to register itself with an operator. alternative source

Both of those numbers (IMEI, IMSI) might be a problem if you wanted to login with mobile operator with copied SIM card and operator's network noticied that you're logging from a phone with different IMEI/IMSI. It might be that. I say "might", because keep in mind that it was allegedly used in east europe, years ago. Security of mobile operators might be specific back then and in those countries. For example some operators were alarmed if you suddenly logged to the network (with copied SIM card) from far away from the last login (login from genuine SIM card):

Then carriers did their homework and introduced some primitive means of security: if a subscriber suddenly registers far from the location he was registered recently, administrators would get a corresponding notification: hey, guys, somebody has just invented a teleporter. source

It might be similar with IMEI and IMSI back then, with operators in countries where it was allegedly being used, maybe they checked IMSI and/or were alarmed while it was changed. Especially that operators usually associate SIM with IMSI:

The SIM number is usually associated with your IMSI number (phone number). This association remains constant until you loose a SIM and get a new one, or you get a new SIM for a different phone. The IMEI number is related to the handset that you are using. Most operators use the Equipment Identity Register (EIR) to associate the IMSI number with the current active IMEI number. When you use your SIM on another handset, changes are made to the EIR to reflect the IMEI number of the new handset. source

Because what happened when someone log into network with cloned SIM card? The mobile phone with genuine SIM card gets disconnected and then all SMS and phone calls are being directed to phony SIM card:

If a cloned SIM card is active during the time when the legitimate subscriber is registered in the mobile network, the latter would get its connection cut off and still remain totally unaware of it. In that case, all inbound calls and messages will be directed to the adversary, and they, in turn, would be able to make calls, send messages and browse the Internet on the victim’s behalf.

The unsuspecting victim would even see the normal network indicators and the name of the carrier on the screen, which would create the illusion of connection, however, the targeted subscriber would not be able to make calls until the handset is rebooted or the mobile network obligatory refreshes the registration status — this typically happens automatically once every few hours. source

It might be with those mobile operators systems that when mobile phone with cloned SIM card have different IMSI than mobile phone that is already online, then the phone with genuine SIM card, that is already online, is not being disconnected and have priority. And criminal with cloned SIM card is not being able to override genuine SIM card on the network, unless it goes offline by itself (turn on "airplane mode", turn off the phone etc).

---

So, I would sum it up to 3 points:

1. We would never know for sure how it worked exactly, since details of the attack were not disclosed and it was years ago, probably with specific mobile operators.
2. Media exaggerated the problem, because you couldn't pretend to be any number in Nokia 1100 without copying SIM card first. Unless security of mobile operators in that countries were really weak and specific. The bug in Nokia 1100 allowed you to change IMEI and IMSI
3. I would say that gangs also created some kind of hype on Nokia 1100 and that turned the price too high. Here I don't have any source, but Nokia 1100 probably wasn't the only way to change IMEI/IMSI back then. Just the ability to change IMEI/IMSI doesn't seems worth 25000 euro, as you said