AT vulnerabilities... 2003 all over again
ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
21–30 of 79 posts
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#22Earlier quoted context omitted.
This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?
There's the USB Condom: https://int3.cc/products/usbcondoms http://syncstop.com/
While not at guaranteed, killing the data wires (or shorting them) makes the device think it is dealing with a charge only port.
Thus various companies have made devices that conditionally apply said short.
Here is one example: https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-F...
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#23Has anyone done research yet on the ability to control low level modems using a GSM tower? It seems likely commands like these could be executed over the air. Also I see they got access to /proc which I assume is also access to memory via /proc/pid/mem?
I've done a little, and from what I saw AT wasn't available over the air, but more scary stuff like "update your firmware to this unsigned binary" and stuff were. Testing was with SIM[8/9]00. Albeit those are simpler basebands than you would find in a smart phone. They have a "lol, what's a OS/mmu" view of the world.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#24https://youtu.be/ITbqTl8pTMs?t=200
Err... were these commands meant to be obfuscated the whole time?
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#25Earlier quoted context omitted.
There's the USB Condom: https://int3.cc/products/usbcondoms http://syncstop.com/
While not at guaranteed, killing the data wires (or shorting them) makes the device think it is dealing with a charge only port. Thus various companies have made devices that conditionally apply said short. Here is one example: https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-F...
The USB condom is more for situations where you are in public and wish to charge your device from an unknown and possibly hostile USB-A receptacle.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#26https://youtu.be/ITbqTl8pTMs?t=200 Err... were these commands meant to be obfuscated the whole time?
I'm not really sure why it was blurred when it is easily searchable on the database they publish
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#27Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
Dialup was still a thing in this century, even if it feels like a long, long time ago. You could still reset people's connections by having them echo ATH0 back to you, if they were on a bad setup.
NO CARRIER
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#28This is all super interesting! Now I am wary of public charging stations. And, it is time to hack on my phone. Frankly, the automation they show in the video can be super useful.
You can use something like a PortaPow USB condom to isolate only the charging capability.
Good to know, thanks!
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#29Earlier quoted context omitted.
You need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.
Any way to sandbox or proxy the power negotiation through the sheath? Laptop's USB controller chip could be vulnerable.
Not sure of any that do that, but I've seen quite a few that support most of the charging standards and negotiate the highest current available (still at 5V) so that the phone can usually charge reasonably fast.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#30Earlier quoted context omitted.
This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.
Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.
> when using an untrusted USB power source...
Don't do that. Ever. Always use your own charger and cable, preferably the ones that came with the phone. If not make sure you're sourcing them from a reputable company and not an anonymous Chinese importer.