drankitagarwal.in

Intercepting the Air: Forensic Analysis and Mitigation of eSIM Profile Hijacking

cs.ankit11@gmail.com
Intercepting the Air: Forensic Analysis and Mitigation of eSIM Profile Hijacking

Introduction

For years, “SIM swapping” was the bane of digital identity security. Attackers relied on social engineering, bribing retail store employees, or exploiting weak customer verification processes to port a victim’s phone number to a physical SIM card under their control. Once in possession of the number, they bypassed SMS-based multi-factor authentication (MFA) to drain bank accounts and hijack social media profiles.

Today, physical SIM cards are rapidly becoming legacy technology. In their place, embedded SIM (eSIM) technology has taken over. While eSIMs offer unparalleled convenience—allowing users to switch carriers or activate plans instantly from their device settings—they have also changed the threat landscape. Attackers have adapted, moving away from physical store heists to sophisticated, remote, and automated eSIM Profile Hijacking. Understanding how these attacks happen, how to investigate them forensically, and how to defend against them is critical for modern security practitioners.

The Architecture of eSIM Remote Provisioning

To understand how eSIM hijacking occurs, we must first understand how a device downloads a carrier profile. The GSMA standardizes this process through Remote SIM Provisioning (RSP). The ecosystem relies on three primary components:

When you scan an activation QR code, you are providing the LPA with an activation string that looks like this:

LPA:1$SM-DP+ Address$Activation Code

The LPA establishes a secure, TLS-encrypted session with the SM-DP+ server. Mutual authentication occurs using certificates embedded in the eUICC chip and the SM-DP+ server. Once trusted, the encrypted profile is delivered to the device, decrypted inside the secure enclave of the eUICC, and activated.

How eSIM Hijacking Occurs in the Wild

If the cryptographic channel between the eUICC and the SM-DP+ server is secure, how do attackers hijack eSIMs? The vulnerability almost never lies in the cryptography; instead, it lies in the provisioning APIs and identity verification workflows.

1. Carrier API Abuse and Credential Stuffing

Many Mobile Network Operators (MNOs) expose customer portals and mobile applications to allow users to request an eSIM replacement (e.g., when moving to a new phone). Attackers target these portals using credential stuffing or session hijacking. Once inside the victim’s carrier account, the attacker requests a “device upgrade” or “SIM swap” to an eSIM. The carrier’s backend API automatically generates a new eSIM profile on the SM-DP+ server and displays the activation QR code directly on the compromised screen, or sends it via email.

2. Malicious QR Code Delivery (Phishing & MitM)

In this vector, attackers host phishing pages mimicking carrier login screens. After harvesting the user’s credentials, the attacker’s automated script logs into the real carrier portal in real-time, requests an eSIM swap, and displays the newly generated QR code on the phishing site, instructing the victim to “scan this code to verify your device.” The moment the victim scans it, their physical SIM or original eSIM is deactivated, and the line goes active on the attacker’s phone.

3. API Bypasses and Business Logic Flaws

In some cases, carriers have failed to properly secure the endpoints responsible for profile generation. Security researchers have discovered flaws where changing a simple parameter (like the EID or IMEI) in an API request allowed unauthorized users to generate eSIM activation tokens for arbitrary phone numbers without proper authentication.

Forensic Analysis of an eSIM Hijack

When an incident occurs, digital forensic investigators must reconstruct the timeline. Did the swap happen via a compromised user account, a carrier-side breach, or physical access? Forensic traces can be found on both the mobile device and the carrier network.

On-Device Forensics (Android & iOS)

Extracting logs from the device can help determine when and how a profile was modified. On rooted or developer-enabled Android devices, investigators can query the EuiccManager system service logs via logcat to trace LPA activity:

adb logcat | grep -E "EuiccManager|LpaService"

These logs reveal when an eSIM download was initiated, the address of the SM-DP+ server queried, and whether the download succeeded or failed with error codes (e.g., RESOLVABLE_ERROR or TEMPORARY_ERROR).

On iOS, running a sysdiagnose and analyzing the CoreTelephony and CellularPlanManager log files will yield timestamped entries of eSIM state transitions, such as profile installations, deletions, and active/inactive switches.

Carrier-Side Forensics

Because the device is often disconnected from the network immediately after a hijack, carrier logs are the most reliable source of truth. Key artifacts to request include:

“In eSIM forensics, the EID is your smoking gun. Unlike IMSI or IMEI numbers which can sometimes be spoofed or altered in transit, the EID is cryptographically bound to the physical hardware chip during manufacturing, providing an immutable anchor of identity.”

Mitigation and Defenses

Mitigating eSIM hijacking requires action from both enterprise administrators protecting their workforce and developers securing telecom systems.

For Security Teams and Enterprises

For Carriers and Developers

Conclusion

eSIM technology is a monumental step forward for cellular connectivity, but its software-driven nature means that cell networks are now subject to the same web and API vulnerabilities that plague the rest of the internet. By moving identity verification away from retail stores and onto digital portals, carriers have shifted the battleground. For security teams and forensic investigators, staying ahead of this shift requires understanding the underlying Remote SIM Provisioning architecture, knowing how to parse EID-related logs, and aggressively moving away from SMS-based trust models.

Exit mobile version