Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

atcommands.org

Post reply on HN
Print view View original

11–20 of 79 posts

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#11

Post by noja »

p4bl0 wrote: post #9
Avamander wrote: post #7

Earlier quoted context omitted.

This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.

Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.

You need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#13

Post by puzzle »

xen2xen1 wrote: post #4

Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?

Dialup was still a thing in this century, even if it feels like a long, long time ago. You could still reset people's connections by having them echo ATH0 back to you, if they were on a bad setup.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#14

Post by jhayward »

xen2xen1 wrote: post #4

Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?

As recently as 2001 the majority of americans used dialup to connect to the internet. AOL was the worlds biggest ISP, and carried more than 50% of all US web traffic.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#15

Post by ForHackernews »

blattimwind wrote: post #8
on_and_off wrote: post #3

>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..

You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.

This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#16

Post by ddtaylor »

Has anyone done research yet on the ability to control low level modems using a GSM tower? It seems likely commands like these could be executed over the air.

Also I see they got access to /proc which I assume is also access to memory via /proc/pid/mem?

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#17

Post by kageurufu »

ForHackernews wrote: post #15
blattimwind wrote: post #8

Earlier quoted context omitted.

You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.

This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?

USB-C has separate lines for the "Configuration Channel", that is used to negotiate voltage and amperage. I'm unaware if the specification allows for cables without data lines, but I don't believe they would be required.

It would only work on USB-C host devices as well though, USB-A would still revert to either 500mA as long as the data lines are tied with a resistor

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#18

Post by joezydeco »

ForHackernews wrote: post #15
blattimwind wrote: post #8

Earlier quoted context omitted.

You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.

This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?

There's the USB Condom:

https://int3.cc/products/usbcondoms

http://syncstop.com/

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#19

Post by Immortalin »

noja wrote: post #11
p4bl0 wrote: post #9

Earlier quoted context omitted.

Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.

You need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.

Any way to sandbox or proxy the power negotiation through the sheath? Laptop's USB controller chip could be vulnerable.
Post reply on HN