Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

atcommands.org

Post reply on HN
Print view View original

41–50 of 79 posts

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#41

Post by digitalcold »

krackers wrote: post #26
strags wrote: post #24

https://youtu.be/ITbqTl8pTMs?t=200 Err... were these commands meant to be obfuscated the whole time?

I'm not really sure why it was blurred when it is easily searchable on the database they publish

At the time we released the video, that specific command was still not patched in some vendors.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#42

Post by puzzle »

gnachman wrote: post #33
puzzle wrote: post #13

Earlier quoted context omitted.

Dialup was still a thing in this century, even if it feels like a long, long time ago. You could still reset people's connections by having them echo ATH0 back to you, if they were on a bad setup.

Only if you could get the other party to type +++ first to enter command mode, though. I'm not aware of any modem that would accept commands, including ATH0, outside of command mode. Then again, there were a lot of bad modems in the world…

Well, yeah, my "ATH0" was shorthand for "+++ATH0". All it would take was a hand crafted ping packet and a bad modem on the receiving end. The better modems implemented the Hayes safeguard of checking that no data was sent for an entire second after the third plus. Then, and only then, they would enter command mode.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#43

Post by someguydave »

Rjevski wrote: post #36
driverdan wrote: post #31

Any info about Apple phones? Do they use AT commands?

They do internally, but as far as I know there's no way to send them from outside - you have to be root, and if you're root you don't really need AT commands to exfiltrate data.

Or you could be the cellular telco/hacker who knows how to program/attack the baseband from the RF side.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#44

Post by bri3d »

wenc wrote: post #39
xen2xen1 wrote: post #4

Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?

Yes, I was wondering if I read that right, but it seems that AT commands are still in use. Us BBS nerds used to know AT commands by heart. We would send instructions to our 2400 baud Hayes modems using QModem: ATZ = reset ATDT1234 = dial 1234 on a touch tone phone (DP for pulse dial) Those of us who later moved to US Robotics modems started learning proprietary USR ampersand codes. ATH0.

Many peripherals with serial interfaces still use AT commands - Bluetooth Serial adapters, the original ESP2866 firmwares where it was a Wifi-to-Serial adapter, most Serial CANBus/OBD adapters like ELM327, basebands all spring to mind.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#46

Post by klondike_ »

The real issue here is proprietary baseband modems. These modems contain fully functional microprocessors along with low level access to the main processor. Even if you replace your ROM with an open source one, it is usually impossible to change the firmware on the modem.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#47

Post by cabaalis »

Really curious, why treat these automation capabilities as a vulnerability? Several security popups appeared, a cable was attached, an application executed on the computer... as a user I'd much rather have the possibility in the future of automating my phone's UI than to have vendors treat this as a vulnerability and patch.

Edit: Just realized that the commands bypassed the prompts. That is a different beast. But the question still remains.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#48

Post by userbinator »

cabaalis wrote: post #47

Really curious, why treat these automation capabilities as a vulnerability? Several security popups appeared, a cable was attached, an application executed on the computer... as a user I'd much rather have the possibility in the future of automating my phone's UI than to have vendors treat this as a vulnerability and patch. Edit: Just realized that the commands bypassed the prompts. That is a different beast. But the…

I found it somewhat amusing that they mentioned model, manufacturer, IMEI and serial as being a "sensitive information leak" --- if you're in physical possession of the phone, those things can be found without even turning it on.

Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands

#50

Post by userbinator »

I'm surprised that the full command strings appear verbatim in the firmware --- and even more surprised that they appear with their "AT" prefix; this suggests they're being parsed by an algorithm that isn't particularly efficient, like a linear search. If something more optimised like a switch or trie were used, it wouldn't be possible to extract them this way, and some more intense reverse-engineering would be required.
Post reply on HN