5 ms·
Seems like a highjack may be possible actually... Here is a list of other things they listed they can do with the simjacker exploit that goes beyond simple data
by farisjarrah 7y ago
Seems like a highjack may be possible actually... Here is a list of other things they listed they can do with the simjacker exploit that goes beyond simple data exfiltration:
> PLAY TONE
> SEND SHORT MESSAGE
> SET UP CALL
> SEND USSD
> SEND SS
> PROVIDE LOCAL INFORMATION
> Location Information, IMEI, Battery, Network, Language, etc
> POWER OFF CARD
> RUN AT COMMAND
> SEND DTMF COMMAND
> LAUNCH BROWSER
> OPEN CHANNEL
> CS BEARER, DATA SERVICE BEARER, LOCAL BEARER, UICC SERVER MODE, etc
> SEND DATA
> GET SERVICE INFORMATION
> SUBMIT MULTIMEDIA MESSAGE
> GEOGRAPHICAL LOCATION REQUEST
- deleted 7y ago[deleted]
- mercora 7y agorunning arbitrary AT commands gives lots of potential... i wish they would provide (a lot) more details about their claims :(
- garaetjjte 7y agoWhen I recently watched this talk, https://www.youtube.com/watch?v=31D94QOo2gY https://www.youtube.com/watch?v=31D94QOo2gY, I wondered about that, that is if malicious STK app from network operator could execute AT commands on phone (and compromise device using commands from https://www.usenix.org/node/217625 https://www.usenix.org/node/217625). But from what I gathered from cursory search, RUN AT COMMAND isn't supported by most devices. (ETSI TS 102 223 states "This clause applies if class "b" is supported by the terminal and enabled by the subscriber through the terminal. ")