The Ghost SIM attack: a working clone that never needed the secret key

Every mobile subscriber assumes one thing: without the operator's secret key, nobody can clone their SIM. Ghost SIM challenges that assumption.

Presented at Black Hat SecTor 2025 by Ethon Shield, the Ghost SIM attack registers a cloned identity on a live mobile network without ever recovering the operator's secret key (Ki). It works whenever the network — through a weak authentication policy — simply forgets to challenge the SIM. This article explains why that gap exists and how operators and users close it. It's written to explain risk and defense — not as a fraud guide. It continues a series on telecom-layer security alongside our walkthrough of attacking the 5G core and SUCI probing in the wild.

01 / THE TWISTAuthentication isn't always enforced

Since 3G, mobile authentication is mutual: the network proves the subscriber is real, and the SIM proves the network is legitimate. The cryptography behind it — the AKA protocol — is sound. The weak point isn't the math. It's the policy that decides how often the network actually runs the check.

An authentication policy is the set of rules that trigger an authentication procedure: after a certain time, or on certain events — a call, an SMS, a registration, a mobility update. When those triggers are sparse, there are long windows in which the network accepts a device without challenging it. A SIM that doesn't hold the secret key can register during exactly those windows. That is the whole attack.

// The whole attack lives in one fork: if the network never asks the SIM to prove itself, a keyless clone gets in.

02 / THE SIMA SIM stores much more than a secret

A SIM is closer to a tiny computer than to a dumb token. Internally it behaves like a filesystem — a tree of elementary files holding the subscriber's identifier (the IMSI), the operator's secret key (Ki), operator codes and dozens of other parameters. In normal operation the Ki never leaves the card: it only ever participates in challenge–response.

The Ghost SIM doesn't try to extract that key. It copies the subscriber-related information onto a programmable card. Given the right authentication gap on the network side, that's enough to impersonate the subscriber — no cryptographic break required.

03 / THE ATTACK SURFACEHow identity leaks from a phone

A modern phone is really several computers sharing one shell: the user-facing OS (Android), the baseband (the modem), and the SIM itself. Each has its own trust boundary, and the seams between them are where identity can leak.

Two legacy paths matter. The first is the AT command set — a 1980s modem language that smartphones still speak; certain AT commands talk straight to the baseband and can reach the SIM, whether issued over USB (through the phone's serial /dev/ttyACM* device) or from an on-device shell (AT via ADB). The second is simply physical: pulling the card. Android's protections against the first have tightened over the years, but unevenly — coverage depends heavily on the manufacturer and the OS version. That heterogeneity is exactly what attackers rely on.

// The journey out of the SIM: identity is reachable through AT commands or the USB serial device, then via ADB. Amber tags are characteristics, not components.

04 / THE POLICY GAPWhen "weak" becomes exploitable

What makes a policy weak is predictability and laxity. If re-authentication only happens on a long timer — VoIP registrations, for instance, commonly renew every 3,600 seconds — or only after an arbitrary "one in N events" counter, the network spends meaningful time trusting devices it hasn't challenged.

How robust a policy needs to be depends on design choices an operator rarely revisits: the traffic the authentication nodes can absorb, mobility configuration, and the volume of control-plane signalling between core nodes. Tighten too far and you oversize that traffic; leave it loose and you open the Ghost SIM's window.

05 / RESULTSAcross operators and generations

Ethon Shield tested the attack against operators in Europe and Asia, from 2G through 5G. The findings — anonymized below — show the gap is not a legacy-network curiosity: it appears on modern generations too.

Operators and countries anonymized. The team could not fully test 5G Standalone abroad — those contracts require a local address and bank account; much of what is sold as "5G prepaid" is actually NSA. The pattern holds: most operators were affected on at least one live generation.

// See it live: the full Black Hat SecTor 2025 talk by Pedro Cabrera & Miguel Gallego.

06 / IMPACTWhy a keyless clone matters

Registering as the victim is not the end — it's the beginning. A Ghost SIM that receives the victim's calls and SMS can intercept one-time codes and defeat SMS- or call-based two-factor authentication. That single foothold chains straight into account takeover on the apps people trust most.

// Receiving the victim's calls and SMS means receiving their one-time codes — the last mile to hijacking messaging accounts.

Meanwhile the legitimate subscriber can be pushed offline — a denial of service on their own number. The outcome resembles SIM-swap fraud, but without ever contacting the operator's support desk to trigger a reissue.

07 / DEFENSEClosing the window

The window only exists when something is left loose. It closes from two sides.

08 / TAKEAWAYThe lesson worth keeping

The cryptography did its job. Ghost SIM never broke AKA, never recovered Ki, never touched the math — it walked through the one decision the standard leaves to the operator: whether to actually ask. A challenge that is never sent protects no one. Strong authentication isn't only strong cryptography; it's strong cryptography that is enforced. That is the part a policy, not a protocol, has to guarantee.

FAQCommon questions