According to Ben Lovejoy at 9to5Mac, the vulnerability was discovered by Karsten Nohl, an encryption expert who was able to break the encryption used by
While his previous hack allowed him to listen in on phone calls, the SIM vulnerability gives even more access to the software installed on a phone:
"Nohl found that by sending a fake carrier text message to a phone, in about 25 percent of cases the phone would reply with an error message that revealed the 56-bit security key for the SIM. A second text message claiming to be a software update, and which the SIM would accept because it used the encryption key, would then allow a virus to be installed which would allow a hacker wide-ranging control over the phone."
The vulnerability Nohl found only works on SIM cards using the older Data Encryption Standard, which has a decades-long history of vulnerability. As the Wikipedia entry for the standard notes, network security experts were able to break the encryption as far back as 1997.
This new technique require far less time, however. Nohl says that in testing on over a thousand SIM cards, he was able to gain control over a device in as little as two minutes.
While newer SIM cards use a stronger form of encryption, the practice of moving SIM cards to new phones from previous devices means that even users of newer devices may be vulnerable. Mobile operators and the GSM Association (which creates the standards for SIM card software) are currently looking into the situation.