📱 Dual-SIM Defense

Why This Matters

When your Android device is compromised or behaving strangely, you face a difficult choice: factory reset and lose all your data, or keep using a potentially dangerous device. This technique gives you a third option.

The Dual-SIM Defense technique:

• Blocks cellular attacks: Forces device into non-attach state, severing attacker command-and-control
• Preserves WiFi: You can still connect to controlled networks for data backup
• Enables USB access: Stabilizes data transfer that may have been blocked
• No factory reset needed: Keeps all your data intact for investigation
• Completely reversible: Just remove the dummy SIM to restore normal function
• No warranty void: Unlike sideloading apps, this is a normal hardware feature

How It Works

Modern Android devices with eSIM and dual-SIM support have complex baseband logic for:

1. Modem provisioning: How the device connects to cellular networks
2. Subscription arbitration: Which SIM gets priority
3. Network attachment: The actual connection to cell towers

When you insert an inactive physical SIM alongside an active eSIM, the device's modem gets confused. It tries to provision both SIMs but can't attach cleanly to cellular service. This forces the device into a persistent non-attach cellular state.

What You'll Need

• Android device with eSIM + physical SIM slot: Most modern Android phones (Pixel, Samsung Galaxy, etc.)
• An old, inactive physical SIM card: Any carrier, any age—it doesn't need to be active
• 2 minutes: That's it

Step-by-Step Instructions

What This Achieves

✅ Cellular Isolation

Your device cannot attach to cellular networks. This severs any command-and-control channels that rely on cellular data, including:

• eSIM-based attacks
• Remote SIM provisioning exploits
• Cellular data exfiltration
• SMS-based C2 channels

✅ Preserved Functionality

Unlike airplane mode or SIM removal, this technique preserves:

• WiFi connectivity: Connect to controlled networks for backup
• USB data transfer: Often becomes MORE stable after cellular isolation
• Bluetooth: Still works for peripherals
• All your data: No factory reset needed

✅ Reversibility

To restore normal cellular function:

1. Eject the SIM tray
2. Remove the inactive physical SIM
3. Reinsert the tray
4. Your eSIM will resume normal operation

When to Use This Technique

🚨 Suspected Device Compromise

If your device is exhibiting signs of compromise:

• Unexplained data usage
• Battery draining quickly
• Device getting hot when idle
• Strange network activity
• Failed data export attempts

💾 Before Factory Reset

Use this technique to stabilize the device and backup your data BEFORE doing a factory reset. This gives you:

• Time to extract important data
• Ability to investigate what happened
• Evidence preservation for potential legal action

🔍 Forensic Investigation

Security professionals can use this to:

• Isolate compromised devices without destroying evidence
• Enable controlled data extraction over WiFi/USB
• Prevent further attacker activity during investigation

Advantages Over Other Methods

vs. Airplane Mode

• ✅ Dual-SIM: Works at baseband layer, can't be bypassed by malware
• ❌ Airplane mode: Can be toggled by sophisticated malware

vs. SIM Removal

• ✅ Dual-SIM: Doesn't trigger SIM removal detection in advanced malware
• ❌ SIM removal: May trigger anti-forensic mechanisms

vs. Factory Reset

• ✅ Dual-SIM: Preserves all data and evidence
• ❌ Factory reset: Destroys everything, no recovery possible

vs. Firewall Apps (NetGuard, etc.)

• ✅ Dual-SIM: No warranty void, no sideloading required
• ❌ Firewall apps: May void warranty, require F-Droid installation

Troubleshooting

❓ My phone still has cellular signal

This can happen if:

• The physical SIM is actually active (try a different, older SIM)
• Your device doesn't support dual-SIM properly
• The eSIM was disabled instead of left active

Solution: Make sure the physical SIM is truly inactive and the eSIM is still enabled.

❓ WiFi stopped working

WiFi should NOT be affected by this technique. If WiFi stops working:

• Check that you didn't accidentally enable airplane mode
• Restart your device
• Remove the physical SIM and try again

❓ I don't have an old SIM card

You can:

• Buy a prepaid SIM for $1-10 (don't activate it)
• Ask friends/family for old SIM cards they're not using
• Visit a carrier store and ask for a SIM card (often free)

❓ My device doesn't have a physical SIM slot

Some newer devices (iPhone 14 in the US, some Pixel models) are eSIM-only with no physical SIM slot. This technique won't work on those devices. Instead:

• Use airplane mode + WiFi
• Use PCAPdroid to monitor network activity (Guide #2)
• Consider a Faraday bag for complete isolation (Guide #8)

Next Steps

After using Dual-SIM defense to stabilize your device and backup your data:

1. Check for spyware: Investigate what caused the compromise → Guide #9: Check for Spyware
2. Monitor network activity: Use PCAPdroid to see what apps are doing → Guide #2: Install PCAPdroid
3. Factory reset if needed: If spyware is found, start fresh → Guide #10: Factory Reset
4. Harden your account: Prevent future compromises → Guide #12: Google Account Security