Any info about Apple phones? Do they use AT commands?
ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
31–40 of 79 posts
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#32Earlier quoted context omitted.
You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.
This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?
I have several cables like this. It's always briefly mystifying when I accidentally grab one to sync some data. No negotiation, my fancy devices just charge at 500mA using these cables.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#33Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
Dialup was still a thing in this century, even if it feels like a long, long time ago. You could still reset people's connections by having them echo ATH0 back to you, if they were on a bad setup.
Only if you could get the other party to type +++ first to enter command mode, though. I'm not aware of any modem that would accept commands, including ATH0, outside of command mode. Then again, there were a lot of bad modems in the world…
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#34Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
The popular esp8266 wifi microcontroller was initially sold as a wifi interface to other microcontrollers, communicating over a serial interface, using AT commands. Indeed this was the first esp8266 I came across (ESP-01) - a cheap wifi interface for an arduino. Later folks discovered that the esp is more powerful itself than an arduino, but I think the stock firmware that comes on the chip is the serial-wifi interface using AT commands.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#35Thank you for not branding this vuln!
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#36Any info about Apple phones? Do they use AT commands?
They do internally, but as far as I know there's no way to send them from outside - you have to be root, and if you're root you don't really need AT commands to exfiltrate data.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#37Huh, this is an old trick but always a good one. Back in the days when iPhones were AT&T exclusive people managed to bypass the carrier lock by fuzzing all possible permutations of AT commands to the baseband. Once a crash was found it could potebtially be used as an exploit to modify its internal state.
It took Apple four years to harden their baseband firmware to resist all kinds of fuzzing efforts and bear in mind Apple only had 2-3 concurrent models to worry about. It must be harder for android vendors with their myriad different platforms.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#38Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
They're used by a variety of communication devices. I recently worked with some Phoenix Contact industrial bluetooth devices that used Hayes commands for configuration.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#39Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
Yes, I was wondering if I read that right, but it seems that AT commands are still in use.
Us BBS nerds used to know AT commands by heart. We would send instructions to our 2400 baud Hayes modems using QModem:
ATZ = reset
ATDT1234 = dial 1234 on a touch tone phone (DP for pulse dial)
ATH0.Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#40I read something a few years ago which led me to believe all phones had a baseband processor which scarily accepts all AT commands, unauthenticated, over the air-http://www.osnews.com/story/27416/The_second_operating_syste...
Am I conflating 2 different issues? Before, it was a theoretical risk. So with a basestation/stingrays you could do it remotely, and now over USB as well.