Hacker News Reader

This is at the SIM card level.

Most SIM cards are actually micro computers that communicate with the host system for certificates, encryption and some provider specific information, besides the common address stuff.

Usually the software is done in Assembly, C or JavaCard, with JavaCard use getting increased in the last years.

The JavaCard exploits are related to the VMs running the system, which are usually coded in a mix of Assembly and C. JavaCard VMs don't have a JIT due to memory constraints.

From what I could gather, the sandboxing was actually referring to the SIM card itself. It was hard to tell through the layman-ified description, but it sounded like he used some sort of buffer overflow to break out of the sandbox and access other parts of the SIM's memory which he shouldn't have been able to.

That's a separate sandboxing system. The SIM has its own sandboxes.