ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
1–10 of 79 posts
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#2Awesome, reminds me of my day's working in telco, doing automated testing of our DPI based billing by having a laptop on my desk connect > download file > disconnect > repeat and checking for discrepancies in the records. Was it ever hard to find the AT commands at the time to automate this from the spec sheets on the modems.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#3>We found that in some cases the "charge-only" USB mode may also fail to block AT commands.
wow that is embarrassing. This needs to be added to CTS like 5 years ago ..
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#4Umm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#5[deleted]
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#6This is all super interesting!
Now I am wary of public charging stations.
And, it is time to hack on my phone.
Frankly, the automation they show in the video can be super useful.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#7>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..
This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#8>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..
You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it.
> We found that in some cases the "charge-only" USB mode may also fail to block AT commands.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#9>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..
This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.
Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.
Re: ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
#10This is all super interesting! Now I am wary of public charging stations. And, it is time to hack on my phone. Frankly, the automation they show in the video can be super useful.
You can use something like a PortaPow USB condom to isolate only the charging capability.