Recently, the security research laboratory, AG Security Explorations, released some exceptional threat research looking at a vulnerability on the eSIM (enhanced/embedded SIM).
It was an excellent and very comprehensive technical examination, performed by security analysts with enviable levels of expertise. Their work provided valuable insights into a potentially serious security issue.
ZARIOT and our customers are not at risk as we had already taken mitigating steps to ensure our cyber security hygiene, which extends to our SIM profile*.
*The Firmware applied by all mobile operators onto their SIMs to enable connectivity and other secondary functionality.
While not effected, we want to keep our customers informed with details of the threat.
Like your laptop, the SIM has an operating system (in its case JavaCard). This is an Oracle product that allows Java-based applications (applets) to be run securely on a SIM or other smart cards (e.g. your credit card). The applications can provide very useful functionality and ZARIOT provide a portfolio of them, but if not protected using a thorough and effective cryptographic security process, could be used to introduce malicious features.
A lack of diligence when assuring this cryptographic security is the basis of the threat.
The researchers show how, with access to the eSIM and a level of technical knowledge, external applets could be applied to an eSIM without sufficient protection.
In their two research papers from 2019 & 2025, they describe how some SIMs never had sufficient processing power to check the validity of applets when loaded on the SIM, but instead, used external verification, with that external source being adequate to allow the applet to be run. If you imagine a similar situation where your old iPad can no longer run some Apps because they are too large and you have to use the webpage instead, it is similar.
In parallel, they showed that a set of test keys were published and used widely by the industry and in some cases were not changed from the advertised/default values when deploying on the live environment. Again, you can imagine not changing the password for your new device from the default.
We are pleased we were able to avoid this risk and will endeavour to continue our best practice policy on cyber.
We are happy the GSMA has taken this seriously and updated its documentation to mitigate the potential of exposed cryptographic keys. We firmly believe cellular telecoms maintains its position as the most secure communications option for IoT.
All industries need to be held to account for their cyber security and so thanks must be extended to AG Security Explorations. Theirs and similar security researchers work is invaluable and will always be commended and supported by ZARIOT.