TL;DR answer: It seems like Nokia 1100 made it easier to spoof someone's phone number, but it wasn't as easy as media presented it. You still had to copy someone's SIM card.
I don't see how such a thing would be possible for many reasons (how was it even possible to modify the software of such a closed platform where not even firmware upgrades were simple?
The application that cybercriminals had access to, allowed them to decrypt Nokia 1100 software. So you could modify it even if it wasn't publicly available for example as open source, as you can read here:
That application allows a hacker to decrypt the Nokia 1100's firmware, Becker said. Then, the firmware can be modified source
Then you're asking:
can you really "reprogram" a phone to use a different number when such information is actually stored on the SIM card?
They didn't reprogram phones just to impersonate some number. They reprogram it, so this phone would make it possible to use already copied SIM card. SIM card was doing the "impersonating", I assume that the problem was just finding the device on which this SIM card could be used. So just the phone alone will not be enough, and copying someone's SIM is needed, and it's not an easy task, as you need to gain access to that SIM card. Not to say that modern SIM cards have better protection against copying (but back then they probably didn't):
[...] cryptic analysis can be used to obtain Ki value only on those SIM cards which support the most obsolete version of A3 algorithm – COMP128v1. Those are still used by some carriers, and such cards can indeed be cloned. More advanced carriers have already switched to COMP128v2 and COMP128v3 algorithms which increase the number of RAND-SRES bundles so the Ki key cannot be calculated with the use of the abovementioned method. source
By saying that "reprogram it, so this phone would make it possible to use already copied SIM card" I mean that they have been able to change IMEI and IMSI of the phone:
Then, the firmware can be modified and information such as the IMEI (International Mobile Equipment Identity) number can be changed as well as the IMSI (International Mobile Subscriber Identity) number, which allows a phone to register itself with an operator. alternative source
Both of those numbers (IMEI, IMSI) might be a problem if you wanted to login with mobile operator with copied SIM card and operator's network noticied that you're logging from a phone with different IMEI/IMSI. It might be that. I say "might", because keep in mind that it was allegedly used in east europe, years ago. Security of mobile operators might be specific back then and in those countries. For example some operators were alarmed if you suddenly logged to the network (with copied SIM card) from far away from the last login (login from genuine SIM card):
Then carriers did their homework and introduced some primitive means of security: if a subscriber suddenly registers far from the location he was registered recently, administrators would get a corresponding notification: hey, guys, somebody has just invented a teleporter. source
It might be similar with IMEI and IMSI back then, with operators in countries where it was allegedly being used, maybe they checked IMSI and/or were alarmed while it was changed. Especially that operators usually associate SIM with IMSI:
The SIM number is usually associated with your IMSI number (phone number). This association remains constant until you loose a SIM and get a new one, or you get a new SIM for a different phone. The IMEI number is related to the handset that you are using. Most operators use the Equipment Identity Register (EIR) to associate the IMSI number with the current active IMEI number. When you use your SIM on another handset, changes are made to the EIR to reflect the IMEI number of the new handset. source
Because what happened when someone log into network with cloned SIM card? The mobile phone with genuine SIM card gets disconnected and then all SMS and phone calls are being directed to phony SIM card:
If a cloned SIM card is active during the time when the legitimate subscriber is registered in the mobile network, the latter would get its connection cut off and still remain totally unaware of it. In that case, all inbound calls and messages will be directed to the adversary, and they, in turn, would be able to make calls, send messages and browse the Internet on the victim’s behalf.
The unsuspecting victim would even see the normal network indicators and the name of the carrier on the screen, which would create the illusion of connection, however, the targeted subscriber would not be able to make calls until the handset is rebooted or the mobile network obligatory refreshes the registration status — this typically happens automatically once every few hours. source
It might be with those mobile operators systems that when mobile phone with cloned SIM card have different IMSI than mobile phone that is already online, then the phone with genuine SIM card, that is already online, is not being disconnected and have priority. And criminal with cloned SIM card is not being able to override genuine SIM card on the network, unless it goes offline by itself (turn on "airplane mode", turn off the phone etc).
So, I would sum it up to 3 points:
- We would never know for sure how it worked exactly, since details of the attack were not disclosed and it was years ago, probably with specific mobile operators.
- Media exaggerated the problem, because you couldn't pretend to be any number in Nokia 1100 without copying SIM card first. Unless security of mobile operators in that countries were really weak and specific. The bug in Nokia 1100 allowed you to change IMEI and IMSI
- I would say that gangs also created some kind of hype on Nokia 1100 and that turned the price too high. Here I don't have any source, but Nokia 1100 probably wasn't the only way to change IMEI/IMSI back then. Just the ability to change IMEI/IMSI doesn't seems worth 25000 euro, as you said