Sponsored Advertisements
Slide Image
Slide Image
Slide Image
Slide Image
Slide Image

NITDA Alerts Nigerians to Critical eSIM Security Gap Exposing Over 2 Billion Devices

News (Headlines) 5 hrs ago
  • User
    Infinity Media
    5 hrs ago
    Thread Thumbnail

    NITDA has raised the alarm over a newly discovered eSIM vulnerability that could expose billions of devices—from smartphones to IoT gadgets—to cyberattacks. The flaw, found in outdated GSMA TS.48 test profiles, opens the door to profile hijacking and identity theft. Thankfully, updated patches and GSMA’s TS.48 v7.0 specification offer a robust fix—if applied promptly.

    Nigeria’s National Information Technology Development Agency (NITDA) has issued a critical alert about a recently identified vulnerability in embedded SIM (eSIM) technology. This flaw threatens billions of devices worldwide—including smartphones, tablets, wearables, and Internet of Things (IoT) devices.

    What’s the Vulnerability?

    The issue stems from the GSMA TS.48 Generic Test Profile (version 6.0 and earlier), widely used during eUICC (Embedded Universal Integrated Circuit Card) radio compliance testing. These test profiles, if left unsecured, can grant attackers the chance to install unverified or malicious applets on eSIM chips, compromising device security.

    How Serious Is It?

    The flaw impacts more than 2 billion eSIM-enabled devices globally, including mobile phones and IoT systems, greatly expanding the potential threat landscape.

    How Could the Flaw Be Exploited?

    Researchers from Security Explorations—a unit of AG Security Research—first highlighted this vulnerability. They demonstrated that, with physical access to a device and the activation of legacy test profiles, attackers could install malicious code and potentially hijack communication functions.

    In more advanced attacks, cybercriminals managed to extract private encryption keys from compromised eSIMs and clone profiles. This capability allowed complete takeover of someone’s phone identity, including calls, messages, and two-factor authentication codes—without detection.

    What Has Been Done to Fix It?

    Kigen, the company behind the affected eUICC chips, released patches and collaborated with GSMA to roll out the updated TS.48 v7.0 specification. This newer version enhances security by:

    • Restricting access to RAM keys by default

    • Disabling JavaCard applet installation on test profiles

    • Randomizing keysets during testing

    • Strengthening OS mechanisms to block unauthorized remote installs

    These measures make exploiting the vulnerability virtually impossible when devices are updated properly.

    Views (0) Reply
Ask a Question

Comments (0)

  • Be the first to comment!

Leave a Reply

Related Threads For You

Top Contributors - 2025

These members spark lively discussions and attract the most attention in August 2025.

New Discussions