So, you've probably switched to an ESIM and you're feeling pretty good about it, right? I mean, it makes sense. A hacker can't physically steal a little plastic chip that isn't even there. On the surface, it seems like a total security upgrade. And yeah,

### Notes on eSIM Security Risks and Techniques for Hijacking

#### Overview
- Transitioning from physical SIM cards to eSIMs has created an illusion of security.
- The common belief is that with no physical chip, the risk of theft is reduced. However, this overlooks new digital vulnerabilities.

#### Key Points
1. **Shift in Attack Vector**:
   - **Old Threat**: Physical access required for SIM card fraud.
   - **New Threat**: Remote access methods taking advantage of cloud servers.

2. **Technology Architecture**:
   - **Local Profile Assistant (LPA)**: 
     - Runs with high-level privileges on devices, managing eSIM profiles.
     - A significant vulnerability due to its powerful access.
   - **Subscription Manager Data Preparation (SMDP1)**:
     - Acts as a digital vault for SIM profile data (IMSI and cryptographic keys).
     - If exploited, attackers can bypass security measures.

3. **Common Hijacking Techniques**:
   - **Social Engineering Swap**:
     - Attacker gathers personal info (often from data breaches).
     - Contacts the carrier, using a fabricated story to convince support to deactivate user’s eSIM and activate it on a new device.
   - **QR Code Interception**:
     - Carriers send QR codes over email for eSIM activation.
     - If an attacker intercepts this email, they can scan the QR code to gain access to the user’s eSIM profile.
   - **Device Compromise**:
     - Advanced attacks involving malware or zeroclick exploits that target the local profile assistant.
     - Attackers gain direct control over the LPA, enabling them to transfer or manipulate the eSIM profile without detection.

#### Red Flags of an Attack:
- Sudden loss of service on the phone indicates eSIM has been deactivated.
- Calls going straight to voicemail (number has likely been hijacked).
- Notifications about changes to eSIM profiles.
- Banking and social media apps asking for re-login, indicating that the attacker may be using the number for password resets.
- Absence of two-factor codes via SMS.

#### Protection Strategies (Six-Step Plan):
1. **Number Lock/Port Freeze**:
   - Contact your carrier to put a PIN on your account to prevent unauthorized number switches.
   
2. **QR Code Protocol**:
   - Avoid accepting QR codes via email for eSIM activation. Use official carrier apps instead for secure transactions.

3. **Two-Factor Authentication**:
   - Enable 2FA on the carrier’s account, but avoid SMS-based methods; use an authenticator app instead.

4. **Secure Email Account**:
   - Treat your email account security as critical.
   - Employ strong passwords and robust 2FA.

5. **Monitor Notifications**:
   - Stay alert for notifications regarding eSIM profile changes.

6. **Be Cautious with Installations**:
   - Be selective with apps, especially on Android.
   - Avoid granting device admin access unless necessary.

#### Conclusion
- The real weakest link in eSIM security is the human element.
- Combining advanced technology with lax verification practices can create significant vulnerabilities.
- Understanding these risks and employing protective measures is crucial for cybersecurity resilience.

### Takeaways
- As an ethical hacker focusing on eSIM security, one must be vigilant about evolving tactics used by attackers.
- Awareness and education are vital in mitigating these risks to prevent unauthorized access and maintain personal security.