What does a police interrogation have to do with a SIM card that goes silent?

Security is like sitting in an interrogation — the more you say, the more there is to use against you.

In this case the error was a low counter. Why is there a counter at all? To stop a replay attack — an attacker resending a captured command to make it run twice. The counter defeats that: every command must be higher than the last, so an old one is rejected as stale.

But look what the counter just did. Reply “wrong counter” and you've told the attacker the counter. Reply encrypted and it's worse — now every rejection hands them a message they already know, paired with its encrypted form.

Collect enough of those pairs and you've given them exactly what they need to start attacking the key. The fix for one attack quietly opened the door to another.

This isn't theoretical, and it isn't new.

In 2013, Karsten Nohl (Security Research Labs, Black Hat USA) showed some SIMs would answer using progressively weaker encryption if you simply asked them to. Each weakened reply opened up another slice of the key to attack — until the whole key was exposed, one piece at a time. The cipher was never broken. The card just answered questions it should have refused.

Five years later, Avoine and Ferreira (IACR TCHES 2018) found the same lesson one layer down. A tiny timing difference in how a card responded to manipulated SCP02 ciphertext let them read the encrypted message — no key needed, about two thousand queries.

Two attacks, two layers, one cause: the card responded, and the response was the leak.

So the best cards do what my customer's card did.

Now here's one for you.

You're the one under interrogation now. They lean in and ask what you were doing last Tuesday.

Choose one: