10 ms·
ATtention Spanned: Comprehensive Android Vulnerability Analysis of AT Commands
- kevin_nisbet 8y agoAwesome, reminds me of my day's working in telco, doing automated testing of our DPI based billing by having a laptop on my desk connect > download file > disconnect > repeat and checking for discrepancies in the records. Was it ever hard to find the AT commands at the time to automate this from the spec sheets on the modems.
- on_and_off 8y ago>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..
- Avamander 8y agoThis allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.
- p4bl0 8y agoYep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.
- noja 8y agoYou need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.
- Immortalin 8y agoAny way to sandbox or proxy the power negotiation through the sheath? Laptop's USB controller chip could be vulnerable.
- simcop2387 8y agoNot sure of any that do that, but I've seen quite a few that support most of the charging standards and negotiate the highest current available (still at 5V) so that the phone can usually charge reasonably fast.
- Avamander 8y agoThere are chips you can buy that do power negotiation. You could design your own PCB that does the job.
- driverdan 8y ago> when using an untrusted USB power source... Don't do that. Ever. Always use your own charger and cable, preferably the ones that came with the phone. If not make sure you're sourcing them from a reputable company and not an anonymous Chinese importer.
- blattimwind 8y agoYou can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.
- ForHackernews 8y agoThis is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?
- kageurufu 8y agoUSB-C has separate lines for the "Configuration Channel", that is used to negotiate voltage and amperage. I'm unaware if the specification allows for cables without data lines, but I don't believe they would be required. It would only work on USB-C host devices as well though, USB-A would still revert to either 500mA as long as the data lines are tied with a resistor
- joezydeco 8y agoThere's the USB Condom: https://int3.cc/products/usbcondoms https://int3.cc/products/usbcondoms http://syncstop.com/ http://syncstop.com/
- digi_owl 8y agoWhile not at guaranteed, killing the data wires (or shorting them) makes the device think it is dealing with a charge only port. Thus various companies have made devices that conditionally apply said short. Here is one example: https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-Fast-Charging-Adapter~USB2CHADP https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-F...
- joezydeco 8y agoThe USB condom is more for situations where you are in public and wish to charge your device from an unknown and possibly hostile USB-A receptacle.
- xen2xen1 8y agoUmm, Hayes commands are still used? That's a blast from the past. I thought those went out in the 80s or 90s?
- count 8y agoAnything talking to a modem is using them still...
- puzzle 8y agoDialup was still a thing in this century, even if it feels like a long, long time ago. You could still reset people's connections by having them echo ATH0 back to you, if they were on a bad setup.
- acheron 8y agoNO CARRIER
- gnachman 8y agoOnly if you could get the other party to type +++ first to enter command mode, though. I'm not aware of any modem that would accept commands, including ATH0, outside of command mode. Then again, there were a lot of bad modems in the world…
- puzzle 8y agoWell, yeah, my "ATH0" was shorthand for "+++ATH0". All it would take was a hand crafted ping packet and a bad modem on the receiving end. The better modems implemented the Hayes safeguard of checking that no data was sent for an entire second after the third plus. Then, and only then, they would enter command mode.
- jhayward 8y agoAs recently as 2001 the majority of americans used dialup to connect to the internet. AOL was the worlds biggest ISP, and carried more than 50% of all US web traffic.
- 8y ago
- deleted 8y ago[deleted]
- ddingus 8y agoThis is all super interesting! Now I am wary of public charging stations. And, it is time to hack on my phone. Frankly, the automation they show in the video can be super useful.
- ddtaylor 8y agoHas anyone done research yet on the ability to control low level modems using a GSM tower? It seems likely commands like these could be executed over the air. Also I see they got access to /proc which I assume is also access to memory via /proc/pid/mem?
- monocasa 8y agoI've done a little, and from what I saw AT wasn't available over the air, but more scary stuff like "update your firmware to this unsigned binary" and stuff were. Testing was with SIM[8/9]00. Albeit those are simpler basebands than you would find in a smart phone. They have a "lol, what's a OS/mmu" view of the world.
- deleted 8y ago[deleted]
- oopsman88 8y agoAT vulnerabilities... 2003 all over again
- strags 8y agohttps://youtu.be/ITbqTl8pTMs?t=200 https://youtu.be/ITbqTl8pTMs?t=200 Err... were these commands meant to be obfuscated the whole time?
- krackers 8y agoI'm not really sure why it was blurred when it is easily searchable on the database they publish
- digitalcold 8y agoAt the time we released the video, that specific command was still not patched in some vendors.
- IshKebab 8y agoNo I think the latter ones were because he typed the usb one out later.
- driverdan 8y agoAny info about Apple phones? Do they use AT commands?
- Rjevski 8y agoThey do internally, but as far as I know there's no way to send them from outside - you have to be root, and if you're root you don't really need AT commands to exfiltrate data.
- someguydave 8y agoOr you could be the cellular telco/hacker who knows how to program/attack the baseband from the RF side.
- wemdyjreichert 8y agoThank you for not branding this vuln!
- Laforet 8y agoHuh, this is an old trick but always a good one. Back in the days when iPhones were AT&T exclusive people managed to bypass the carrier lock by fuzzing all possible permutations of AT commands to the baseband. Once a crash was found it could potebtially be used as an exploit to modify its internal state. It took Apple four years to harden their baseband firmware to resist all kinds of fuzzing efforts and bear in mind Apple only had 2-3 concurrent models to worry about. It must be harder for android vendors with their myriad different platforms.
- EvangelicalPig 8y agoRelated: Anyone remember how Geohot's iPhone 2G hardware unlock worked back in the day? (~2007)
- an_account_name 8y agoI remember there was one that could be triggered just by loading a web page with a specially crafted image file.
- Laforet 8y agoThat would be a later jailbreak, not a baseband unlock per se. Geohot's first iPhone hack, IIRC, used an unsecured JTAG pinout he managed to find on the PCB that allowed direct write access to the firmware. Later it was discovered that the system bootloader had enough exploits that the process could be done entirely in software. Later iPhone models would gradually ramp up security to the point that nothing of this sort could be done very easily even with physical access.
- tinus_hn 8y agoApple provides the baseband firmware itself. Android manufacturers have to ask the chipset manufacturer for updates. That’s a major difference.
- nicogetz 8y agoI read something a few years ago which led me to believe all phones had a baseband processor which scarily accepts all AT commands, unauthenticated, over the air-http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste... Am I conflating 2 different issues? Before, it was a theoretical risk. So with a basestation/stingrays you could do it remotely, and now over USB as well.
- klondike_ 8y agoThe real issue here is proprietary baseband modems. These modems contain fully functional microprocessors along with low level access to the main processor. Even if you replace your ROM with an open source one, it is usually impossible to change the firmware on the modem.
- mcny 8y agoIs this still a problem if the phone doesn't have a sim card and is on airplane mode with WiFi and Bluetooth turned on?
- adrianN 8y agoI guess the answer to this is "who knows". You can't really trust the hardware on your phone.
- ohazi 8y agoIt'd be nice if someone designed a phone that architecturally resembled a computer attached to a mobile hotspot. You could have an SoC of your choice for a user-facing operating system and a separate SoC with separate memory for the baseband and whatever the hell the carrier wants to push to the device. The operating system running on the user SoC could have a driver that allows it to get internet access from the baseband SoC over some high-bandwidth-but-not-memory-sharing bus. Until I can buy something like this, my gpg and ssh keys are staying far away from my phone, which kind of sucks.
- Flow 8y agoI recall reading an article years ago describing iPhone being architectured like this. Even if the baseband system is compromised, it don't have access to the rest of the system. And traffic from the rest of the system passing thru the baseband is mostly encrypted. I don't know if it's true, but it makes sense given the, allegedly, crappy code base in Broadcoms firmwares.
- maccam94 8y ago
- cabaalis 8y agoReally curious, why treat these automation capabilities as a vulnerability? Several security popups appeared, a cable was attached, an application executed on the computer... as a user I'd much rather have the possibility in the future of automating my phone's UI than to have vendors treat this as a vulnerability and patch. Edit: Just realized that the commands bypassed the prompts. That is a different beast. But the question still remains.
- userbinator 8y agoI found it somewhat amusing that they mentioned model, manufacturer, IMEI and serial as being a "sensitive information leak" --- if you're in physical possession of the phone, those things can be found without even turning it on.
- fmj 8y agoIt doesn't require an attacker to have physical possession of the phone. They just need you to plug your phone into one of their USB ports. Something like a public charging station would be perfect for this. An IMEI and serial are still unique identifiers that can be used for tracking.
- userbinator 8y agoI'm surprised that the full command strings appear verbatim in the firmware --- and even more surprised that they appear with their "AT" prefix; this suggests they're being parsed by an algorithm that isn't particularly efficient, like a linear search. If something more optimised like a switch or trie were used, it wouldn't be possible to extract them this way, and some more intense reverse-engineering would be required.
- kevin_thibedeau 8y agoSequential search is near optimal for short lists. On embedded hardware you don't always have the luxury to create elaborate data structures for the "proper" solution.
- userbinator 8y agoThat makes it all the more surprising that they would include the "AT" prefix, which all the commands start with --- if I were implementing a command processor like this in a memory- and CPU-constrained environment, I'd match "AT" separately from the rest (differing) parts of the command.
- kevin_thibedeau 8y agoThey probably support other commands without a common prefix. It's not worth special casing a subset of the command set. It only burns a few dozen bytes.
- IshKebab 8y agoIt would be ridiculous over-engineering to use a trie here given the performance requirements.
- nanch 8y agoI'm glad to see this research being done. They did a great job with the paper and their searchable site. As mentioned in the article/paper, this attack vector has been used before. The AT+USBDEBUG command was used to unlock the Samsung S6 Dec 10, 2015. Blog about this exploit back then: https://www.bloglovin.com/blogs/xda-developers-5233323/2015-samsung-lock-bypass-exploit-details-4833408555 https://www.bloglovin.com/blogs/xda-developers-5233323/2015-... Video of the unlock back then: https://twitter.com/rpaleari/status/674983960162787328/video/1 https://twitter.com/rpaleari/status/674983960162787328/video... The code published by FICS here: https://github.com/FICS/atcmd/blob/master/usbswitch/usbswitcher.c https://github.com/FICS/atcmd/blob/master/usbswitch/usbswitc... is based off the same code from Dec 2015 here: https://github.com/ud2/advisories/blob/master/android/samsung/nocve-2016-0004/usbswitcher.c https://github.com/ud2/advisories/blob/master/android/samsun...