Multi-IMSI
Switch identity when roaming coverage is thin.
Tell me what you need to changeApplets · keys · design
Custom applets, key generation, and SIM design.
Something has to run on the card that the SIM vendor does not ship. Or the key ceremony was never designed properly. Or the electrical profile does not match what the campaign needs.
01
Applets
Java Card and STK. Multi-IMSI, IMEI lock, polling, network fingerprinting, SIMbox detection, custom business logic. Written, loaded over the air, tested on real cards from real vendors.
IMEI lock and beyond
Bind a SIM to hardware. Fraud learned to fake the IMEI, so Terminal Profile and other signals often matter more.
Tell me what you need to changeFree STK tool
Terminal Profile analyser
When a SIM meets a device: Reset → ATR → Terminal Profile. An applet reads that profile. No IMEI required.
02
Keys
Generating Ki, OPC and OTA keysets. How to hand them to a SIM vendor safely, how to store them, how to keep an inventory, how to rotate them. Most operators get this wrong once and live with it for a decade. The point of on-premise generation is that those secrets do not leave the site.
03
SIM design and security
File structure and electrical profile design (ETSI TS 102 221). Troubleshooting cards that behave differently across vendors. Security research on SIM and OTA: replay, counters, SCP weaknesses.
MF 3F00 Master file root of the card
EF ICCID Transparent one blob — the serial
DF TELECOM Folder phonebook, SMS, last numbers
EF ADN Linear fixed records: a phonebook table
EF LND Cyclic records circle read/write — last numbers dialled
ADF USIM Application a network identity lives here
EF IMSI Transparent the subscriber identity
EF ARR Linear fixed who may read or write each file
- Transparent
One stretch of bytes. Read or write by offset — like a single document.
IMSI, ICCID
- Linear fixed
Equal-length records, addressed by number — like rows in a table.
Phonebook (ADN), ARR
- Cyclic
Still records — same as linear. Read and write go in a circle: the newest write overwrites the oldest. TS 102 221 §8.2.2.3.
Last numbers dialled (EF LND)
Access: PIN1 · PIN2 · PUK1 · PUK2 · ADM · ARR per file OTA keyset (SCP80): KVN '01'–'0F' · KIc + KID + DEK/KIK · TS 102 225 annex A SCP81 (HTTP): PSK-TLS + DEK, typically KVN '40'–'4F' · GP Amendment B / SGP.02
Contact
Tell me what you need to change.
Email direct: contact@moreota.com
Include the network and SIMs, the SIM vendors, and what the campaign needs to do. A technical call is 30 minutes, engineering to engineering.
Enquiries are handled as in the privacy notice. Do not paste production keys.