Fear Rises over Sim Card Cloning, It’s Impossible – Operators

Even as network service providers insist otherwise, cloning GSM Sim card, that is illegal duplication of the Sim to allow calls or other services to use the identification of the cloned Sim appears easier than previously thought, Nigeria CommunicationsWeek can now reveal.

Leading Global System for Mobile communications (GSM) services providers in Nigeria said the possibility does not exist, citing several security checks including anti-tamper device built into their software which protect Sim (subscriber identification module).

Elsewhere, findings have however continued to show that the Sim is not foolproof because fraudsters can actually exploit the vulnerability of the GSM security design process to crack it.

At the height of the argument, operatives of the State Security Services (SSS) in Delta State last week arrested Charles Taribolou Gbendu, a 34 year- old Information Technologist, for allegedly cloning the Zain phone number of Dr. Emmanuel Uduaghan, Delta State Governor.

In a confessional statement to the police, Gbendu allegedly admitted that “he just wanted to try it and it worked.” He did not however say how.

Capitalizing on this, Gbenga Adebayo, chairman, Association of Licensed Telecom Companies of Nigeria (Alton) said GSM mobile Sim cannot be cloned on the same network.

Nodding in agreement, Adewale Goodluck, corporate services executive, MTN Nigeria, said that it is practically impossible for two people to use the same number on the same network.

Also Emmanuel Otorkhine, public relations manager, Zain Nigeria, said unless one does a Sim swap, it will be difficult to clone another person’s number on the same network.

Nigeria CommunicationsWeek however, gathered that the Sim card in the mobile phone stores a secret key which is used to authenticate the customer – knowledge of the key is sufficient to make calls (fraudulently) billed to that customer.

It is not rocket science, it is not elaborate. A lone fraudster with Sim card reader, a laptop equipped with software can actually extract needed information from victims and in minutes, he will be making calls with one, and the owner with another.

Ordinarily, the tamper-resistant smartcard is supposed to protect the key from disclosure (even against adversaries which may have physical access to the Sim). Authentication is done with a cryptographic protocol which allows the Sim to "prove" knowledge of the key to the service provider, thus authorizing a call.

Scientists have however discovered that the cryptographic codes used for authentication are not strong enough to resist attack.

Goodluck insisted that what could happen is that somebody may swap another person’s Sim card without the original owner knowing, by furnishing the network with false information.

Corroborating Goodluck, Adebayo said that each Sim card has only one address on the switch, which is the subscriber’s number.

“One  Sim does not have multiple addresses. That is why if a Sim card is reported stolen, it is blocked before a new one is created with the same number.”

Both said that if anyone attempts to use copied card (intentionally or by accident), the provider would undoubtedly know and most likely revoke access to the cell network immediately.