Millions of SIM cards in use today are vulnerable to hacking - allowing for attacks where SIM cards could be cloned remotely, or voicemail numbers could be changed, according to a German security researcher.

The vulnerability uses a Seventies-era cipher still used on millions of SIM cards worldwide, according to Karsten Nohl or Security Research Labs.  Nohl’s research will be presented at the   BlackHat security conference in Las Vegas on July 31. Karsten Nohl says, “With over seven billion cards in active use, SIMs may well be the most widely used security token in the world.”

“We can spy on you. We know your encryption keys for calls. We can read your SMSs. More than just spying, we can steal data from the SIM card, your mobile identity, and charge to your account”, Nohl said in an interview with the New York Times.

There are six billion cellphones currently in use - and many still use the outdated DES encryption. Nohl tested 1,000 SIMs over two years, and found that around one-quarter were vulnerable. The UN’s International Telecommunications Union reviewed the research, and described it as “hugely significant”. ITU secretary general Hamadoun Touré said, "These findings show us where we could be heading in terms of cybersecurity risks.”

Nohl claims that over-the-air software updates - sent as cryptographically-secured SMS messages - using custom Java software, pose a “critical hacking risk.”  Hackers would send an improperly signed OTA command - but the cards respond with a cryptographic signature which can be resolved to a 56-bit key on a "standard computer," acccording to Nohl. This allows an attacker to install Java applets.

Nohl says, “ A Java applet can break out of its realm and access the rest of the card. This allows for remote cloning of possibly millions of SIM cards including their mobile identity (IMSI, Ki) as well as payment credentials stored on the card. Applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse.”

Nohl says that the enormous number of “legacy” SIM cards in use means that the problem may be complex to deal with. New gnerations of cards should be designed to resist such attacks, he says, but handsets and networks should also adopt defenses.

“Cards need to use state-of-art cryptography with sufficiently long keys, should not disclose signed plaintexts to attackers, and must implement secure Java virtual machines. While some cards already come close to this objective, the years needed to replace vulnerable legacy cards warrant supplementary defenses,” Nohl says.