Fact-checked by Grok 2 weeks ago

SIM Application Toolkit

The SIM Application Toolkit (SAT) is a set of commands, procedures, and mechanisms specified by the European Telecommunications Standards Institute (ETSI) for the Subscriber Identity Module (SIM) in Global System for Mobile Communications (GSM) networks, enabling resident applications on the SIM to proactively interact with the mobile equipment (ME), the man-machine interface (MMI), and the mobile network to deliver enhanced services during network operation. This toolkit extends the basic SIM-ME interface defined in earlier GSM specifications, allowing the SIM to initiate actions independently of user or network triggers. Originally introduced in GSM Phase 2+ as part of ETSI GSM 11.14, SAT has evolved into the USIM Application Toolkit (USAT) under 3GPP specifications starting from Release 4, integrating with Universal Subscriber Identity Module (USIM) for 3G UMTS networks and extending to 4G LTE and 5G systems through TS 31.111. This progression supports broader functionality in the Universal Integrated Circuit Card (UICC), the modern SIM evolution, while maintaining backward compatibility with legacy GSM environments. USAT builds on SAT by incorporating advanced security features, file structures, and protocols for the UICC-ME interface, facilitating applications like authentication, payment services, and network slice management in newer cellular standards. Key features of SAT/USAT include proactive commands that permit the SIM/USIM to drive handset behavior, such as displaying text or menus to the user, selecting items from lists, sending short messages, or establishing data connections without altering the device's firmware. These commands activate in response to network events (e.g., location updates or incoming calls) or user interactions, enabling operators to deploy over-the-air (OTA) updates and personalized services like mobile banking menus or location-based notifications directly from the card. The toolkit also defines mandatory procedures for error handling, security (e.g., command authentication), and data encoding, ensuring reliable operation across diverse mobile ecosystems. By preprogramming functionality onto the SIM/USIM, SAT/USAT empowers mobile network operators to innovate service delivery while leveraging the secure, tamper-resistant nature of smart card technology.

Introduction

Definition and Purpose

The SIM Application Toolkit (STK) is a GSM and 3GPP standard that enables the Subscriber Identity Module (SIM) to initiate proactive actions and interact with the mobile equipment (ME) and the network, facilitating the delivery of value-added services (VAS). This framework provides a standardized execution environment for SIM-resident applications, allowing them to leverage ME functions such as display and input capabilities while ensuring interoperability across different manufacturers and operators. By defining procedures for SIM-ME communication during network operation, STK extends beyond traditional SIM roles to support dynamic service interactions. The primary purpose of STK is to empower the SIM to control specific handset behaviors independently of the device's native operating system, thereby enabling service providers to deploy customized applications without modifying the ME software. For instance, it allows the SIM to trigger actions like menu displays or SMS transmissions to enhance user-network engagement and personalize services. This capability supports secure, trusted execution of applications on the SIM, promoting flexible content delivery via the public land mobile network (PLMN). STK was initially deployed in GSM networks to enable simple interactions between users, the network, and the SIM, building on the foundational authentication functions of the SIM. It extends basic SIM authentication and identification to application-level control, transforming the SIM into a platform for executing VAS that improve user experience and operator service management. In subsequent evolutions, STK progressed to the USIM Application Toolkit (USAT) for 3G systems.

Key Components

The SIM Application Toolkit (STK) comprises several core components that facilitate communication between the Subscriber Identity Module (SIM) and the Mobile Equipment (ME). These include proactive SIM commands, which enable the SIM to initiate interactive actions such as displaying text or setting up menus on the ME; envelope commands sent from the ME to the SIM to report events or user inputs; and terminal responses provided by the SIM to acknowledge or process ME feedback on executed commands. The Card Application Toolkit (CAT) serves as the overarching framework for STK, providing a standardized set of procedures for card-ME interactions, with STK representing the specific implementation tailored for GSM SIM cards. This framework, developed under ETSI and 3GPP standards, ensures compatibility across mobile networks. In the interaction model, the SIM communicates with the ME through the SIM-ME interface, utilizing Application Protocol Data Unit (APDU) structures formatted with Basic Encoding Rules-Tag-Length-Value (BER-TLV) or Simple-TLV data objects to exchange commands and responses efficiently. Foundational data elements within STK include event downloads, which allow the ME to notify the SIM of occurrences such as incoming calls or location updates; menu systems, enabling the SIM to construct and manage user-selectable options on the device display; and language selection mechanisms, where the SIM specifies preferred languages for text rendering via notification commands and coding schemes like GSM 03.38.

History and Development

Origins in GSM

The SIM Application Toolkit (STK) was developed in the 1990s as part of the GSM Phase 2+ enhancements, aimed at expanding the capabilities of the Subscriber Identity Module (SIM) beyond basic authentication and storage functions for voice and SMS services. This initiative sought to leverage the untapped computing power within SIM cards, which were initially passive components limited to responding to commands from the Mobile Equipment (ME). By introducing proactive capabilities, STK enabled the SIM to initiate interactions with the ME and network, facilitating dynamic services during the operational phase of GSM connections. The primary motivation for STK was to overcome the constraints of earlier SIM designs, particularly under the T=0 protocol where the ME acted solely as the master, restricting the SIM to reactive roles. This limitation hindered the delivery of emerging value-added services (VAS), such as interactive menus and network-initiated prompts, which required bidirectional communication to enhance user experience and operator control. STK addressed these issues by defining a set of commands and procedures that allowed the SIM to proactively request actions like displaying text or sending short messages, thereby supporting menu-based services without relying on device-specific software. The first formal specification for STK, GSM 11.14, was published by the European Telecommunications Standards Institute (ETSI) in 1996, with version 5.1.0 released in August of that year and subsequent updates following through the late 1990s. This document outlined basic toolkit functions for the SIM-ME interface, ensuring interoperability across GSM devices and networks as part of the initial Phase 2+ specifications developed starting in 1996. Early adoption of STK occurred in the early 2000s.

Standardization Evolution

The standardization of the SIM Application Toolkit (STK) evolved from its origins in the Global System for Mobile Communications (GSM) phase, transitioning to a unified framework under the 3rd Generation Partnership Project (3GPP) to support Universal Mobile Telecommunications System (UMTS) and beyond. In Release 4 (initiated in 2001), the GSM-specific specification ETSI GSM 11.14 was integrated as an annex into 3GPP TS 31.111 during TSG-T meetings that year, titled "Universal Subscriber Identity Module (USIM) Application Toolkit (USAT)," ensuring backward compatibility with 2G networks while extending capabilities to 3G environments. This shift, managed by 3GPP's Technical Specification Group Terminals (TSG-T), replaced the standalone GSM 11.14 and aligned STK with UMTS requirements, including enhanced proactive commands for USIM cards. Further evolution incorporated STK into broader Universal Integrated Circuit Card (UICC) specifications through ETSI TS 102 223, "Smart Cards; Card Application Toolkit (CAT)," which provides the generic framework for application toolkits on the UICC, with USAT as a specific instance. 3GPP TS 31.111 predominantly references TS 102 223 for physical and logical interface details, enabling iterative updates across releases; the latest version of TS 102 223, V18.2.0 (April 2025), includes support for data bearers via bearer-independent protocols and access technology indications, such as event notifications for changes in network access types (e.g., from UMTS to LTE). ETSI, as a 3GPP organizational partner, publishes these specifications, while 3GPP drives development through collaborative working groups, ensuring alignment with evolving mobile networks. Additionally, integration with Java Card platforms was formalized in 3GPP TS 43.019, "Subscriber Identity Module Application Programming Interface (SIM API) for Java Card," starting from Release 4, allowing applet-based STK development on secure smart card environments. Key milestones mark progressive enhancements: Release 5 (2002) introduced support for enhanced menus, including color displays and varied text formats to improve user interfaces on capable devices. Release 8 (2008), aligning with Long-Term Evolution (LTE) introduction, prepared STK for 4G by adding provisions for Evolved Packet System (EPS) interactions and secured packet structures, as detailed in TS 31.111 updates and related specifications like TS 31.115. These iterative releases by 3GPP and ETSI have sustained STK's relevance through subsequent generations, up to Release 18 (frozen December 2024), focusing on 5G compatibility with features like network slice selection support, without altering core proactive mechanisms.

Technical Overview

Architecture and Framework

The SIM Application Toolkit (STK), now encompassed within the broader framework, operates in a distributed architecture where the or serves as the proactive initiator of interactions. The , such as a mobile phone, acts as the executor, carrying out commands issued by the SIM while interfacing with the user and the network. The network responds to STK-initiated actions, typically through for data downloads or for real-time exchanges, enabling dynamic service delivery without altering the ME's core software. This design ensures the SIM retains control over value-added services while leveraging the ME's display, input, and communication capabilities. The framework is structured across multiple layers to facilitate secure and standardized communication. At the , applets residing on the implement STK , processing and generating proactive commands. The employs Application Protocol Units (APDUs) transmitted over the T=0 half-duplex , as defined in ISO/IEC 7816-3, to exchange between the and ME. The layer manages the messaging using ENVELOPE commands from the ME to notify the of or deliver network , FETCH commands from the to request execution of proactive procedures, and TERMINAL RESPONSE messages from the to provide feedback or results to the ME. This layered approach abstracts the underlying , promoting across , , and networks. Proactive sessions in the STK framework begin when the SIM detects a triggering event, such as ME startup, location update, or timer expiration, prompting it to initiate a command sequence. The SIM sends a proactive command via FETCH, which the ME executes—such as displaying text or sending an SMS—and returns results through TERMINAL RESPONSE, allowing the SIM to process outcomes and issue follow-up commands if needed. This event-driven flow supports asynchronous interactions, with the SIM polling for new commands during idle periods to maintain session continuity. Network involvement occurs when STK commands trigger SMS submissions or USSD dialogues, enabling remote applet updates or service responses. STK is compatible with the platform through the UICC API defined in ETSI TS 102 241, which extends the to support toolkit applets. This integration allows secure execution of STK applications as Java Card applets, utilizing packages like uicc.toolkit for proactive command handling via ProactiveHandler and event registration. The CAT Runtime Environment within manages session flows, ensuring applet isolation and compliance with STK procedures, thus enabling developers to build portable, secure applications for SIM-based services.

Commands and Procedures

The SIM Application Toolkit (SAT) operates through a set of proactive commands issued by the SIM card to the mobile equipment (ME), enabling dynamic interactions such as displaying or initiating actions. These commands are encoded in a Encoding Rules (BER)-TLV and are retrieved via specific procedures. Key proactive commands include REFRESH (command code 0x01), which updates files on the SIM or initializes the network access application to reflect changes in the or SIM data. SET UP MENU (0x25) allows the SIM to configure a menu with selectable items on the ME display, supporting options like item icons and hidden menu entries for user navigation. DISPLAY TEXT (0x21) instructs the ME to show a text message or icon, with support for immediate clearance of the display upon completion. SEND SHORT MESSAGE (0x13), also known as SEND SMS, enables the SIM to initiate an transmission, including options for packing additional parameters like alpha identifiers. SET UP CALL (0x10), referred to as CALL in some contexts, sets up a voice call or multiparty call, with qualifiers to handle capabilities like call confirmation or redialing. SAT procedures define the between the SIM and ME, ensuring reliable command execution and . The FETCH allows the ME to retrieve a pending proactive command from the SIM when it receives a status word of '91 XX', where XX indicates the data length; the SIM must issue a reminder via '91 XX' if the command remains unprocessed. TERMINAL RESPONSE provides from the ME to the SIM after command execution, structured with mandatory TLV elements including command details (tag '81'), device identities (tag '82'), and result (tag '83'), along with optional elements like text strings (tag '85') for user input or local information (tag '88') such as IMEI or location area code. The ENVELOPE enables the ME to notify the SIM of unsolicited events, such as location updates (reporting MCC, MNC, and LAC changes) or timer expirations, using event download TLVs (tag 'D6') with specific event types (tag 'D0') and data like location status (tag '8A'); events are queued if the SIM is busy and retried on '93 00' status. Command qualifiers modify proactive command within the command TLV. levels include (default, bit 1=0) for queued and high (bit 1=1) for immediate execution, applicable to commands like DISPLAY TEXT to override screen content. coding schemes support 8-bit encoding ( for SMS-like data) or (UCS2/) for text in like GET INKEY. identity handling uses the device identities TLV (tag '') to specify source (e.g., ME as 0x82) and destination (e.g., as 0x81), ensuring proper for commands like PROVIDE . Error handling in SAT relies on status words in APDU responses to indicate overall processing outcomes, with '90 ' denoting and '91 XX' signaling a new proactive command pending. UICC processing failures are reported via status words like 9F XX (e.g., 9F for errors). ME-specific execution errors are conveyed in the result TLV ( 83) of the TERMINAL RESPONSE, with the APDU status word typically '90 '; result codes include 20 for temporary problems (e.g., ME unable to process to screen busyness), 30 for commands beyond ME capabilities, and 32 for incomprehensible data, prompting the SIM to adjust or reissue commands accordingly.
APDU Status WordMeaningExample Context
90 00Normal successCommand executed successfully
91 XXProactive command pendingSIM has additional commands to
9F XXUICC command failureGeneral or issue during UICC handling
TERMINAL RESPONSE Result CodeMeaningExample Context
20ME currently unable to processScreen busy for display commands
30Command beyond ME capabilitiesUnsupported feature like advanced data channels
32Data incomprehensible by MEInvalid parameters in command

Applications and Use Cases

Value-Added Services

The SIM Application Toolkit (STK) enables a range of value-added services (VAS) by allowing the to interact directly with the mobile equipment and network, facilitating operator-driven applications without requiring device software modifications. These services leverage proactive commands and envelope procedures to deliver personalized, interactive experiences, such as secure transactions and , enhancing and operator . Common VAS include , where users perform secure operations like balance inquiries and fund s through SIM-initiated USSD or supplementary service commands, ensuring controlled PIN entry via dedicated menus. Content download services allow users to acquire ringtones, games, or horoscopes by triggering SMS-based downloads or launches from the SIM, often initiated via proactive commands that handle over the SIM-ME . Location-based services utilize the SIM's to retrieve network-provided , such as (MCC), Mobile Network Code (MNC), Location Area Code (LAC), and Cell Identity, to enable context-aware applications like targeted notifications or service routing. Operator menus, established through the SET UP MENU command, provide intuitive interfaces for services like balance checks and subscription management, where users select options that trigger envelope commands to report choices back to the SIM for further processing. These menus integrate seamlessly into the device's menu system, supporting up to 18 items with text and icons for enhanced usability. STK integrates with for over-the-air (OTA) service provisioning, using SMS-PP data download or cell broadcast mechanisms to remotely update SIM content and configurations, such as file changes or application refreshes, in compliance with 03.48 standards. This OTA capability allows operators to dynamically provision VAS, like personalized menu updates or content pushes, ensuring efficient service delivery across networks.

Integration with Mobile Devices

The Mobile Equipment (ME) in mobile devices must support core commands defined in 3GPP TS 31.111 to enable SIM Application Toolkit (STK) functionality, ensuring seamless interaction between the SIM and device hardware such as displays and keypads. Mandatory procedures include proactive commands like DISPLAY TEXT for rendering text with alpha identifiers and optional icons, GET INKEY for single-key user input (e.g., yes/no responses), and GET INPUT for text entry with configurable lengths. Additional required commands encompass SET UP CALL for initiating voice or data calls, SEND SMS for message transmission, and PROVIDE LOCAL INFORMATION for sharing device data like location (MCC, MNC, LAC/TAC, Cell ID). These commands are executed via the ME's terminal responses, which report success (code 00), inability (code 20), or limitations (code 30), adapting to hardware constraints such as no-display (ND) or no-keypad (NK) terminals by ignoring unsupported features like icons. At the operating system level, STK integrates as a system-level component to handle SIM-initiated events without disrupting core device functions. In Android, the STK app operates through layers including the Radio Interface Layer (RIL) for low-level SIM communication, telephony services for translating BER-TLV messages, and a dedicated UI framework using activities like StkMenuActivity for menu displays and StkInputActivity for input prompts. It is triggered by events such as device boot (via PROFILE DOWNLOAD and proactive commands like SET UP MENU) or incoming calls/SMS (via RIL_UNSOL_STK_EVENT_NOTIFY), presenting carrier menus or dialogs directly on the home screen or during sessions. In iOS, STK functionality is embedded in carrier services, accessible via Settings > Cellular > SIM Applications, where SIM events like boot or network changes provision carrier-specific UIs for services, maintaining isolation from user apps through system-level telephony frameworks. This integration enables value-added services like menu-based banking by leveraging device events for proactive SIM responses. STK maintains backward compatibility across device types by supporting graduated capability profiles, allowing basic operation on feature phones while extending to advanced features on smartphones. Feature phones typically implement core commands through simple MMI interfaces, handling display and input via basic screens and keypads without advanced graphics like icons, as per profile adaptations in 3GPP TS 31.111. Smartphones build on this with richer UIs, such as full-color icons and multi-session support, and expose APIs for third-party integration; for instance, legacy Windows Mobile provided SIM Toolkit APIs for developers to access proactive commands and envelope responses, enabling custom applications to interface with SIM events. This ensures STK applications from older GSM networks function on modern devices, with the ME declaring supported features during PROFILE DOWNLOAD to negotiate compatibility. Conformance testing for ME-SIM interactions verifies STK through standardized procedures outlined in ETSI TS 151 010-4 for SIM Toolkit and TS 131 124 for USIM Application Toolkit. These tests simulate SIM behaviors using a test SIM or simulator, evaluating sequences for core commands, such as displaying UCS2 text in DISPLAY TEXT (e.g., verifying Cyrillic rendering) or handling user input timeouts in GET INKEY (within 5 seconds). Display and input tests cover icon rendering, soft key navigation, and error responses, while overall assesses proactive session management, envelope commands like CALL CONTROL, and event handling (e.g., MT call notifications). Passing these ensures reliable hardware-software interplay, with verdicts based on ME responses matching expected terminal profiles.

Advantages

Security Benefits

The SIM Application Toolkit (STK) enhances through SIM-based , which authenticates users for value-added services (VAS) by leveraging the SIM card's of trust to prevent unauthorized access. This process utilizes proactive UICC commands, such as PROVIDE LOCAL INFORMATION and SEND USSD, to confirm subscriber against network-stored credentials, ensuring that only legitimate requests from verified entities are processed. STK employs robust encryption mechanisms for over-the-air () updates, establishing secure channels via standardized algorithms like and as specified in protocols. These encryptions, applied through secure packet structures with cryptographic checksums and counters to prevent replay attacks, protect command packets transmitted over point-to-point or Bearer Independent Protocol (BIP), safeguarding sensitive updates from interception or modification. The toolkit's tamper stems from the SIM's inherent , which shields sensitive such as PINs and cryptographic keys from vulnerabilities in the device operating . By confining operations within the tamper-resistant UICC —equipped with physical protections like sensors against invasive attacks—this ensures that even if the mobile equipment is compromised, STK-protected elements remain secure. STK aligns with standards for usage, particularly in payments, where the serves as a certified tamper-resistant for storing payment credentials and enabling authenticated transactions. This facilitates and adherence to requirements, such as those in 's remote provisioning .

Operational Efficiency

The Over-The-Air () provisioning capability of the SIM Application Toolkit (STK) enables mobile network operators to remotely update and manage SIM content, such as applets and data files, without requiring physical access to devices. This eliminates the need for widespread physical distribution of new SIM cards or , leading to substantial in operational expenses for operators. For instance, mechanisms allow and enhancements to be applied fleet-wide, minimizing and the expenses associated with manual interventions or SIM swaps. STK further enhances by reducing reliance on handset-specific applications, as services are executed directly on the SIM card using standardized commands. This handset-agnostic approach ensures across diverse devices, avoiding the need for development or for each manufacturer or model. Consequently, operators experience lower development and deployment overhead, as a single SIM-based implementation can support uniform service regardless of the underlying . In terms of resource optimization, STK's proactive commands permit the SIM to initiate actions like menu displays or event notifications without constant network polling, thereby minimizing signaling for routine interactions. These commands streamline communication between the SIM, , and , reducing unnecessary exchanges and conserving , particularly in high-volume scenarios. The architecture of STK supports through its use of lightweight applets that operate with minimal resource demands on both the SIM and network infrastructure. This design allows operators to deploy and manage value-added services for millions of subscribers efficiently, as the processing occurs locally on the SIM rather than requiring intensive server-side computations or frequent backend interactions. Such is evident in large-scale and mobile deployments where STK enables proactive behavior management without compromising performance.

Limitations

Technical Constraints

The SIM Application Toolkit (STK) exhibits significant limitations in handling, primarily supporting text-based and short () interactions without capabilities for such as images or videos. Proactive commands like TEXT are restricted to a maximum of 160 characters using the 7-bit default , while -related commands such as SEND SHORT adhere to standard limits of 160 characters (7-bit) or 140 bytes (8-bit). These constraints confine STK applications to rudimentary textual menus, prompts, and notifications, precluding richer user interfaces or data-intensive features. SIM hardware imposes strict and limitations that the and execution of applets. Each proactive command is capped at 256 bytes of , necessitating trade-offs in application —for instance, the SET UP or SELECT ITEM commands can up to 18 menu items only if each is to approximately 10 bytes of text, reducing for more elaborate structures. Traditional SIM cards, with their modest embedded processors and , cannot accommodate computationally intensive tasks, restricting STK to procedures like event-driven responses rather than advanced or . Post-issuance updates to STK applications face inherent challenges, relying on over-the-air (OTA) mechanisms via SMS Point-to-Point (SMS-PP) or cell broadcast for data modifications, or requiring physical SIM card swaps for substantive changes. The REFRESH command enables limited file updates and reinitialization but does not permit dynamic loading of new executable code, as applet binaries must be pre-installed during manufacturing or initial provisioning. This static nature limits the toolkit's adaptability, often necessitating carrier intervention for any evolution beyond simple data refreshes. STK's dependence on low-bandwidth communication protocols like and (USSD) results in performance bottlenecks, including delays in command-response exchanges that can range from seconds to minutes based on . transactions are confined to 140-160 bytes per message, while USSD supports up to 182 characters per session but operates in a request-response model prone to from short message service center queuing or signaling overhead. These factors impede real-time applications, as the toolkit cannot leverage higher-speed data channels, leading to sluggish interactions in bandwidth-constrained environments.

Compatibility Issues

The support for SIM Application Toolkit (STK) in mobile handsets varies significantly due to its optional implementation in mobile equipment (ME), resulting in inconsistent user interfaces and functionality across devices and operating systems. ETSI specifications indicate that STK support is not mandatory for MEs, though supported devices must comply with defined proactive commands and procedures to ensure basic interoperability. This variability has been evident in early smartphone platforms; for example, iOS provides a limited "SIM Applications" menu accessible via Settings > Cellular > SIM Applications, which is often hidden or unavailable depending on carrier provisioning, restricting full STK interactions. Similarly, certain Android devices and custom ROMs may lack complete STK UI support, leading to failures in displaying or processing SIM-initiated menus and prompts. The Nokia N900, running the Maemo operating system, exemplifies such incompatibility by not supporting key STK features, causing disruptions with operators relying on proactive SIM commands. Network transitions pose additional challenges for STK, particularly in environments beyond pure GSM deployments, where partial support necessitates fallback mechanisms to maintain basic connectivity. ETSI standards primarily define STK for GSM and UMTS networks, limiting seamless operation in hybrid or non-GSM setups without adapted procedures, such as error indications for unsupported commands during access technology changes. In practice, this requires MEs to revert to legacy modes when encountering STK elements incompatible with the current network type, potentially delaying value-added services. Version mismatches between SIM cards and MEs further exacerbate compatibility, as older STK-enabled SIMs may fail to execute commands on newer handsets due to differences in command qualifiers and phase-specific features. ETSI guidelines highlight cross-phase compatibility problems, recommending that advanced functions be restricted to matching proactive SIM-ME pairs to prevent errors like invalid command responses. For instance, SIMs adhering to earlier ETSI TS 101 267 versions might issue deprecated qualifiers that newer MEs reject outright, resulting in session terminations or ignored proactive sessions. Global deployment of STK has been uneven, with notably limited adoption in the United States prior to widespread 4G LTE rollout, owing to the dominance of CDMA networks that employed alternative toolkit standards. In CDMA ecosystems, operators utilized the Card Application Toolkit (CAT) defined by ARIB STD-T64 and 3GPP2 specifications for similar SIM interactions, rather than GSM-centric STK, leading to a lack of native support in devices like early CDMA handsets from Verizon or Sprint. This divergence meant U.S. users often experienced STK failures or required carrier-specific adaptations until the shift to universal SIM-based LTE authentication.

Security Considerations

Vulnerabilities and Exploits

One notable vulnerability in SIM Application Toolkit (SAT/USAT) implementations is the SIMJacker exploit, discovered in 2019, which targets the SIMalliance Toolbox Browser (S@T Browser) embedded on certain Universal Integrated Circuit Cards (UICC). This flaw allows attackers to send specially crafted SMS messages containing SAT/USAT instructions that the S@T Browser executes without user interaction, enabling the retrieval of the device's location via cell ID information and International Mobile Equipment Identity (IMEI) number. Furthermore, the exploit facilitates the silent transmission of premium-rate SMS messages, potentially leading to unauthorized charges on the victim's account, and has been actively used for surveillance by state actors across at least 29 countries. SAT/USAT's proactive commands, such as those for sending SMS or initiating calls, pose risks when over-privileged applications on the SIM/USIM card are present or compromised, allowing unauthorized actions without user consent. For instance, in Android devices prior to version 5.1.1, attackers could intercept or emulate these Telephony SAT/USAT commands, enabling the execution of background operations like dialing premium numbers or dispatching messages that bypass device-level safeguards. If the SIM/USIM is physically accessed or remotely manipulated, these commands can be abused to perform actions that appear legitimate to the network but result in privacy invasions or financial losses. Over-the-air (OTA) update mechanisms in early SAT specifications suffer from weak encryption, particularly reliance on algorithms like COMP128v1, which facilitate man-in-the-middle (MITM) attacks during SIM application updates. Attackers intercepting OTA messages can exploit the predictable nature of this encryption to derive the SIM's secret key (Ki) from as few as two captured authentication challenges, decrypting update payloads and injecting malicious code into SAT applications. This vulnerability, prevalent in legacy GSM-era SIMs, exposes users to remote compromise without detection, as the Proof of Receipt feature in OTA protocols fails to prevent altered transmissions. In 5G-enabled IoT devices, USAT's exposure amplifies risks for remote control scenarios lacking robust authentication, as the toolkit's command interface can be abused to manipulate embedded SIMs (eSIMs) in resource-constrained environments. For example, malicious USAT instructions delivered via network signaling could override device functions, such as unlocking access or altering configurations in connected vehicles or industrial sensors, without requiring physical tampering or user approval. This issue persists due to the backward compatibility of USAT in 5G architectures, where IoT deployments often inherit vulnerabilities from earlier cellular standards. As of 2025, recent vulnerabilities in eUICC cards, such as those in Kigen eSIMs, have exposed billions of IoT devices to risks including cloning, communication interception, and persistent backdoors via exploited provisioning and USAT commands.

Mitigation Strategies

To mitigate security risks associated with the SIM Application Toolkit (SAT/USAT), enhanced encryption protocols have been standardized for over-the-air (OTA) communications. Specifically, the adoption of AES-128 and AES-256 algorithms in 3GPP TS 31.111 starting from Release 9 provides stronger cryptographic protection for SAT/USAT-related data exchanges between the SIM/USIM and the mobile equipment (ME), replacing weaker legacy ciphers like DES to prevent interception and tampering. Operators implement controls such as SIM/USIM profile restrictions and real-time monitoring to detect and block anomalous SAT/USAT commands, enabling proactive intervention against unauthorized menu displays or data extractions. These measures involve configuring SIM/USIM cards with predefined access policies that limit command execution scopes and logging suspicious activities for forensic analysis. Device hardening further strengthens SAT/USAT security by requiring the ME to validate all incoming SAT/USAT commands against predefined rules before execution, such as verifying digital signatures or command origins, and prompting users for explicit consent on sensitive actions like SMS sending or location queries. This approach reduces the risk of silent exploitation by ensuring transparency and halting unverified operations. The GSMA provides comprehensive guidelines for Secure Element best practices, recommending features like remote lockout and management for compromised SIMs/USIMs to swiftly disable SAT/USAT functionalities in case of breach detection. These practices include secure provisioning of applets and periodic integrity checks, ensuring that SAT/USAT applications remain resilient against evolving threats.

Evolution in Modern Networks

In 3G and 4G

The USIM Application Toolkit (USAT), introduced in 3GPP Release 4, extends the SIM Application Toolkit functionality to the Universal Subscriber Identity Module (USIM) environment in UMTS (3G) networks, enabling UICC applications to interact with the mobile equipment through proactive commands and procedures. USAT supports proactive interactions in multi-application UICC environments, enhancing flexibility compared to the single-application GSM SIM. Key enhancements in USAT for 3G and 4G (LTE) include support for packet-switched data services such as GPRS and EDGE, facilitated by commands like OPEN CHANNEL that activate Packet Data Protocol (PDP) contexts for data connections. Bearer indications are incorporated into these commands, specifying circuit-switched, packet-switched (GPRS), or local bearers to guide the mobile equipment in selecting appropriate network resources, thereby accommodating the evolving data-oriented architecture of UMTS and LTE. Backward compatibility is maintained through dual-mode SIMs/USIMs capable of handling both GSM and UMTS operations, with USAT event downloads extended to include handover events such as location status changes and cell identity updates during network transitions. This ensures seamless toolkit functionality across 2G/3G handovers without disrupting active applications. Deployment of USAT became widespread in 3G networks to enable enhanced value-added services (VAS), such as triggers for WAP browsing, where proactive commands like LAUNCH BROWSER allow UICC applications to initiate web sessions for services including mobile banking and content delivery. USAT adoption grew in the early 2000s to support interactive internet services over UMTS bearers.

In 5G and Beyond

In 5G networks, the USIM Application Toolkit (USAT) enhanced through 3GPP 31.111 starting from 15 to ISIM and USIM functionalities aligned with 5G New Radio (NR) access. These updates include proactive commands and envelope procedures that enable the UICC to interact with network features such as network slicing, where the USIM stores Network Slice Selection Assistance Information (NSSAI) to facilitate slice selection and during attachment or . Additionally, USAT supports notifications for Ultra-Reliable Low-Latency Communication (URLLC) scenarios, allowing applets to respond to low-latency requirements via terminal indications and refresh commands that incorporate 5G-specific parameters. The adoption of (RSP) for eUICC-based deployments introduces heightened risks, including potential profile manipulation and unauthorized downloads due to vulnerabilities in the SGP.32 , which relies on secure channels but remains susceptible to man-in-the-middle attacks if endpoint protections fail. Looking toward future developments, the emphasis on eSIM technologies in 5G ecosystems is reducing reliance on physical SAT interactions, as via RSP streamlines provisioning for scalable deployments while maintaining with USAT commands. In 5G contexts, challenges arise from an expanded , exacerbated by the of diverse technologies; in TS 31.111 and related ETSI TS 102 223 introduce technology qualifiers, such as indications for , to differentiate radio types in proactive commands and envelopes, thereby aiding in detection but also requiring robust ME-UICC . Further enhancements in Releases 17 and 18 support reduced capability () devices for and 5G-Advanced features, including improved USAT integration for provisioning and slicing.

References

  1. [1]
    [PDF] GSM 11.14 - Specification of the SIM Application Toolkit - ETSI
    SIM Application Toolkit is a set of commands and procedures for use during the network operation phase of GSM, in addition to those defined in GSM 11.11 [14].
  2. [2]
    [PDF] ETSI TS 101 267 V8.18.0 (2007-06)
    Overview of SIM Application Toolkit. The SIM Application Toolkit provides mechanisms which allow applications, existing in the SIM, to interact and operate.
  3. [3]
    Specification # 31.111 - 3GPP
    Universal Subscriber Identity Module (USIM) Application Toolkit (USAT) ... SIM Application Toolkit. S1 , T3. See details, False. 60141. USAT. USIM Application ...
  4. [4]
    ETSI - Sim Card Technology - ETSI
    A SIM (Subscriber Identity Module) is a 'Smart Secure Element' that contains the subscriber's identity and authenticates the terminal when accessing a network.
  5. [5]
    [PDF] ETSI TS 131 111 V16.1.0 (2020-07)
    This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical ...
  6. [6]
    SIM toolkit features and usage in Windows 10 Mobile - Microsoft Learn
    May 23, 2025 · SIM toolkit is a set of applications on the SIM card that activate based on network events or user actions in Windows 10 Mobile.
  7. [7]
    Definition of SIM Toolkit (SIM Application Toolkit) - Gartner
    SIM Toolkit (SIM Application Toolkit) ETSI standard that allows additional information and functionality to be preprogrammed on to the SIM card.
  8. [8]
    SAT SIM Application Toolkit - Mpirical
    The SIM (Subscriber Identity Module) Application Toolkit function resides on GSM. It essentially enables the SIM card to drive the GSM handset, allowing an ...
  9. [9]
    [PDF] GSM 11.14 - Specification of the SIM Application Toolkit - ETSI
    SIM Application Toolkit is a set of commands and procedures for use during the network operation phase of GSM, in addition to those defined in GSM 11.11 [14].
  10. [10]
    [PDF] 3G TS 22.038 V2.0.0 (1999-10) - 3GPP
    This ETSI Technical Specification defines the stage one description of the SIM application Toolkit (SAT). Stage one is an overall service description, primarily ...
  11. [11]
    [PDF] ETSI TS 151 014 V4.1.0 (2003-03)
    The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities.
  12. [12]
    [PDF] ETSI TS 102 223 V17.5.0 (2024-12)
    specifically for "NAA Card Application Toolkit". The Card Application Toolkit (CAT) is a set of generic commands and procedures for use by the ICC ...
  13. [13]
    Specification # 51.014 - 3GPP
    Reference: 51.014. Title: Specification of the SIM Application Toolkit for the Subscriber Identity Module - Mobile Equipment (SIM - ME) interface.Missing: evolution | Show results with:evolution<|control11|><|separator|>
  14. [14]
    [PDF] The development of GSM standards and features - NET
    Phase 2 was frozen in October 1995, and subse- quent improvements and additions will automatically make their way into Phase 2+. The history of GSM's phases is ...
  15. [15]
    Simjacker: SIM-based phone hacking - Kaspersky
    Sep 30, 2019 · Cybercriminals can spy on phones by hacking the SIM card. We explain how the attack works, how the SIM Toolkit is involved, and how carriers ...
  16. [16]
    SIM Toolkit What does it do?! - XDA Forums
    Jul 12, 2004 · SIM Toolkit applications are additional menus, that mostly contain SMS information services, that are ordered automatically without manually typing keywords ...Missing: 2000s Europe
  17. [17]
    [PDF] ETSI TS 131 111 V18.7.0 (2024-10)
    3GPP TS 31.111 version 18.7.0 Release 18​​ IPRs essential or potentially essential to normative deliverables may have been declared to ETSI.
  18. [18]
    [PDF] ETSI TS 143 019 V4.1.0 (2001-12)
    3GPP TS 43.019 version 4.1.0 Release 4. 4.1. GSM Java Card Architecture. The over all architecture of the SIM Toolkit API based on Java Card 2.1 is: Applets.
  19. [19]
    [PDF] Overview of 3GPP Release 5
    such enhancements include the possibility to display toolkit menus in colour and various text formats as well as the ... protocols for (U)SIM resident (U)SIM ...
  20. [20]
    [PDF] ETSI TS 102 223 V17.6.0 (2025-04)
    Apr 6, 2025 · The present document can be downloaded from the. ETSI Search & Browse Standards application. The present document may be made available in ...
  21. [21]
    [PDF] ETSI TS 102 241 V17.1.0 (2021-08)
    Aug 1, 2021 · ETSI TS 102 241 V17.1.0 is a technical specification for Smart Cards, specifically the UICC API for Java Card™ (Release 17).
  22. [22]
    [PDF] ETSI TS 102 223 V18.0.0 (2024-08)
    Aug 6, 2024 · USSD proactive command is used in 3GPP access ... commands have not been elaborated at this stage of the toolkit specification.
  23. [23]
    [PDF] White Paper SIM – The basis for Mobile Value Added Services
    SIM Toolkit (STK) is today mainly used as a tool that enables an operator controlled menu for SMS and voice services. It is also used for more advanced services ...
  24. [24]
    [PDF] ETSI TS 131 111 V18.6.0 (2024-07)
    The present document may refer to technical specifications or reports using their 3GPP identities. These shall be interpreted as being references to the ...<|control11|><|separator|>
  25. [25]
    Sim Toolkit Application (STK) | Android Open Source
    This document offers a high-level overview of the SIM Toolkit Application for Android 1.0 and is primarily of interest for implementors of the Radio Interface ...
  26. [26]
  27. [27]
    Using SIM Tool Kit API to interact with SIM menu or STK
    With MOBITEK® SIM Tool Kit Application Programming Interface (STK API), Windows application can now access the SIM application. (Note: STK, SIM Tool Kit, SIM ...
  28. [28]
    None
    Below is a merged summary of the conformance testing procedures for the SIM Application Toolkit (SAT) in Mobile Equipment (ME) based on ETSI TS 151 010-4 V17.0.0 (2022-04). The information is consolidated into a dense, structured format using tables where appropriate to retain all details from the provided segments. The response includes ME-SIM interactions, core commands, display and input testing, integration aspects, and useful URLs, organized for clarity and completeness.
  29. [29]
    [PDF] ETSI TS 131 124 V18.1.0 (2025-02)
    The present document can be downloaded from the. ETSI Search & Browse Standards application. The present document may be made available in electronic ...
  30. [30]
  31. [31]
    [PDF] ETSI TS 101 181 V8.8.0 (2001-12)
    [6]. 3GPP TS 11.14: "Specification of the SIM Application Toolkit for the Subscriber Identity Module. - Mobile Equipment (SIM - ME) interface". [7]. ISO/IEC ...Missing: GSMA | Show results with:GSMA
  32. [32]
  33. [33]
    [PDF] Security of Proximity Mobile Payments
    ... secure element hosting the payment application, a subscriber identity module (SIM) card, the payment application, and a user interface application running.Missing: Toolkit | Show results with:Toolkit
  34. [34]
    OTA Platform – OTA solution for SIM Management - IDEMIA
    The OTA Platform simplifies SIM management and logistics with OTA post-personalization, minimizes card replacement costs by doing OTA corrections, and improves ...
  35. [35]
    Connection Efficiency Protection Mechanisms within Mobile Networks
    Use of SIM Toolkit Applications. Some operators implement a SIM toolkit application within their SIM card that detects inefficient IoT Device behaviour such ...
  36. [36]
    [PDF] The benefit of using SIM application toolkit in the context of NFC ...
    Benefits of SIM Application Toolkit. ▫ Closed Systems – Everything runs on SIM/Secure Environment. ▫ SIM/JCOP is Standardized Development Platform.
  37. [37]
    None
    ### Summary of SIM Card Hardware Constraints
  38. [38]
    NVD - CVE-2019-16257
    ### Summary of CVE-2019-16257 (SIMJacker Vulnerability)
  39. [39]
  40. [40]
    SIM Cards in 29 Countries Vulnerable to Remote Simjacker Attacks
    Oct 12, 2019 · Until now, I'm sure you all might have heard of the SimJacker vulnerability disclosed exactly a month ago that affects a wide range of SIM ...
  41. [41]
    CVE-2015-3843 Detail - NVD
    Sep 30, 2015 · The SIM Toolkit (STK) framework in Android before 5.1.1 LMY48I allows attackers to (1) intercept or (2) emulate unspecified Telephony STK SIM commands.Missing: privileged | Show results with:privileged
  42. [42]
    SIM Toolkit (CVE-2015-3843) - Dr.Web
    Vulnerability CVE-2015-3843, which is detected in Android 5.1 and earlier, allows cybercriminals to intercept and emulate SIM commands.Missing: privileged | Show results with:privileged
  43. [43]
    SIM Card Vulnerabilities and Security
    Comprehensive overview of SIM card vulnerabilities, attack vectors, and security countermeasures.
  44. [44]
    SIM Cards Encryption Vulnerability: The Scope of the Problem
    Aug 1, 2013 · The only potentially vulnerable cards are those that simultaneously support OTA, feature Proof of Receipt and have an OTA message encrypted by ...Missing: Toolkit | Show results with:Toolkit
  45. [45]
    SIM card vulnerabilities easy to fix, researcher says - CSO Online
    Jul 24, 2013 · For some vulnerable SIMs, it may be possible to switch off the DES encryption and turn on Triple DES, a more secure form of encryption that is ...
  46. [46]
    5G Could Compromise SIM Card-Dependent IoT Devices
    May 31, 2018 · The SIM application toolkit, which is essentially a group of useful functions, can also be abused to compromise SIM cards and, by extension, ...
  47. [47]
    [PDF] ETSI TS 131 111 V4.17.0 (2009-10)
    ETSI TS 131 111 V4.17.0 (2009-10). 28. 3GPP TS 31.111 version 4.17.0 Release 4. Description. Clause. M/O/C. Min. Length. POWER ON CARD). R-APDU (only required ...
  48. [48]
    [PDF] ETSI TS 131 111 V15.8.0 (2020-01)
    This technical specification covers digital cellular systems (GSM, UMTS, LTE, 5G) and the USIM Application Toolkit (USAT).Missing: slicing URLLC
  49. [49]
    [PDF] Trusted Connectivity Alliance Recommended 5G SIM: A Definition
    3GPP TS 31.111. Network Slicing is the 5G networks ability to guarantee management of broadband and latency connections. Each particular type of application ...Missing: URLLC | Show results with:URLLC
  50. [50]
    [PDF] eSIMplicity or eSIMplification? Privacy and Security Risks in the ...
    Aug 13, 2025 · A key driver of this adoption is the enhanced flexibility, convenience, and scalability of remote SIM provisioning (RSP). This adoption is ...
  51. [51]
    [PDF] Trusted Connectivity Alliance Recommended 5G SIM for 3GPP ...
    3GPP TS 31.111. Network Slicing is the 5G network's ability to guarantee management of broadband and latency connections. Each particular type of application ...
  52. [52]
    [PDF] ETSI TS 102 223 V16.1.0 (2025-04)
    Apr 6, 2025 · (USIM) Application Toolkit (USAT) (3GPP TS 31.111) ... This is achieved by the toolkit application using the Access Technology command qualifier in.<|control11|><|separator|>
  53. [53]
    Attacks Against GSMA's M2M Remote Provisioning (Short Paper)
    Aug 7, 2025 · We study GSMA's “Remote Provisioning Architecture for Embedded UICC” specification, which focuses on M2M devices, and we analyze the security of ...