That Tiny SIM Card in Your EV Charger Could Be a Hacker's Backdoor

Michael Miller · 2026-08-11

You probably don't think much about the SIM card inside your devices. It's just that little plastic chip that keeps your phone connected, right? But what if I told you that a malicious SIM card could actually order the device it sits in to run commands of the attacker's choosing? That's not sci-fi—it's a real vulnerability that researchers just uncovered, and it's got serious implications for the Internet of Things (IoT) devices we're increasingly relying on. ### The Hidden Danger in Cellular Modules Here's the thing: SIM cards aren't just passive storage. They contain small applications that can interact with the host device. When you're talking about a smartphone, that's bad enough. But the real trouble starts with cellular modules—the components that give internet connectivity to electric-vehicle chargers, industrial routers, and car telematics units. In those devices, a compromised SIM can be the key that unlocks the entire system. Researchers at the University of Birmingham, working alongside the security firm Fuzzware, decided to test just how widespread this problem is. They examined 26 different phones and cellular modules for this vulnerability. The results? They found it. And not just in a few edge cases—the capability to run attacker-controlled code was present across a significant number of the devices they tested. ### Why This Matters More Than You Think Let's put this into perspective. Your EV charger isn't just a dumb plug. It's a connected device that handles payments, monitors power usage, and communicates with your car. An attacker who gains control of that module could potentially disrupt charging sessions, steal payment information, or even manipulate the charger's behavior in dangerous ways. Industrial routers are even scarier. These are the backbone of factory automation, remote monitoring, and critical infrastructure. If someone takes over one of those, they're not just messing with your Wi-Fi—they could be messing with an entire production line. And car telematics? That's your vehicle's brain for navigation, emergency services, and remote diagnostics. Compromise that, and you've got a serious problem on your hands. ### The Technical Breakdown So how does this attack actually work? It comes down to the SIM Application Toolkit (SAT). This is a set of commands that a SIM card can use to interact with the device it's inserted into. Normally, these commands are benign—things like displaying a menu or sending a text message. But a malicious SIM card can abuse these commands to execute arbitrary code on the device's modem. - The SIM card sends a proactive command to the modem - The modem processes the command without proper validation - The attacker's code runs with the modem's privileges - From there, it's a stepping stone to full device takeover It's a classic supply chain attack vector. The SIM card itself is the malicious element, so even if the device's firmware is perfectly secure, it's still vulnerable. And because SIM cards are often provided by third-party carriers or even the device manufacturer, there's a lot of trust placed in them. ### What This Means for IoT Security This research is a wake-up call. We've been treating SIM cards as a trusted element in the IoT ecosystem, but they're not inherently secure. The researchers' findings suggest that this isn't a theoretical risk—it's a practical one that could be exploited right now. "The problem is that these cellular modules are designed to trust the SIM card completely," says one of the researchers. "And that trust is misplaced." The team's work shows that a determined attacker could create a malicious SIM card and use it to gain a foothold in devices that we rely on for safety, security, and daily operations. ### What Can You Do About It? At the moment, there's no simple patch for this vulnerability. It's baked into the way cellular modules and SIM cards interact. But there are some steps you can take to reduce your risk: - Only use SIM cards from trusted sources, especially in critical devices - Monitor your IoT devices for unusual behavior or unexpected commands - Keep firmware updated, as manufacturers may release mitigations - Consider using separate, isolated networks for critical IoT infrastructure This is a developing story, and it's likely we'll see more research in this area. For now, the takeaway is clear: even the smallest components in our connected world can be a gateway for attackers. So the next time you plug in your EV or check your industrial router, remember—that tiny SIM card might not be as innocent as it looks. For more insights into protecting your digital infrastructure, stay tuned. And if you're managing IoT devices, this is one vulnerability you don't want to ignore.