Slashdot Mirror
Smartphones From 11 OEMs, Including Google, Samsung, HTC, Lenovo and Sony, Vulnerable To Attacks Via Hidden AT Commands (bleepingcomputer.com)
An anonymous reader writes: In massive and groundbreaking research, a team of eleven scientists from the University of Florida, Stony Brook University, and Samsung Research America, have looked into what types of AT commands, or the Hayes command set, are currently supported on modern Android devices.
The research team analyzed over 2,000 Android firmware images from eleven Android OEMs such as ASUS, Google, HTC, Huawei, Lenovo, LG, LineageOS, Motorola, Samsung, Sony, and ZTE. They say they discovered that these devices support over 3,500 different types of AT commands, some of which grant access to very dangerous functions. These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.
The research team analyzed over 2,000 Android firmware images from eleven Android OEMs such as ASUS, Google, HTC, Huawei, Lenovo, LG, LineageOS, Motorola, Samsung, Sony, and ZTE. They say they discovered that these devices support over 3,500 different types of AT commands, some of which grant access to very dangerous functions. These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.
Why is a cell phone modem still emulating a dial-up modem in 2018? (!) Shouldn't it behave like an Ethernet card or something? Do they still "officially" need to dial "#777" to get a data connection?
Imperial All Terrain Armored Transport vehicles (aka Walkers) vulnerable to attacks via hidden AT-AT commands.
It must have been something you assimilated. . . .
One of the easiest backdoors into phones just got noticed. I'm not shocked, and wonder if the RF side of the baseband is just as bad.
Upshot is that your devices will be a lot more secure after this gets patched. The downside is that all those companies providing 'unlocks' for law enforcement just had a major hole closed up and their lives just got more difficult
PC's BIOS contains code that allow security mechanisms to be bypassed, code injected, formatted, and even become hijacked with alternative OS'es. I'm glad they are discovering this for us but it's not that scary - to me the news is that this is undocumented.. assuming they googled the results.
What's new? Do people actually expect their phones or PCs to survive encounters with offensive USB hardware? Nevermind RIL access I can plug a keyboard or mouse into a phone USB port and hack away without authorization as well. It only takes a couple of seconds to drop a payload with malicious HID USB via preprogrammed keystrokes. Attack surface of USB is as massive as it is indefensible.
From TFA 5 of the 13 devices they tested give access to serial interface over USB by default. The others require explicit configuration to expose interface.
Next thing you will tell me is that there are Pascal vulnerabilities.
+++ATH0
I don't know if anyone of you are into Arduino?
But it's been common knowledge for years now that you can purchase chips complete with IMEI number, multi-band RX/TX, fully featured with data, phone, simcard reader (just solder directly to pins!) mic in/speaker out pins, and the commands you send to it is via normal serial connections, you can use AT commands just like on an old HAYES(tm) modem.
The ones on ebay are often batches from really old cellphones, but very simple to code as you basically can do this just by interfacing them with an USB to SERIAL adapter, and then you can in fact use them just as a regular cellphone. I have a bunch of such chips in my drawer, let me give you some numbers for fun so you can find out for yourself, it's really an open door, surprising that so few know this, here's some numbers: NEOWAY M590E and another: SIM800L, if you google the first - you'll find tons of coding examples (which is so easy a 12 year old can figure it out), and instructional videos. The chips are often found complete with DIY PCB's someone put together as a kit out there, or presoldered, usually around 2-3 dollars, what a world we live in.
And yes, these can be wired up to become your own cellphone, simple, or smart (use an raspberry pi with a touch screen, load it up with an OS, your choice). And a little software magic aka amateur hour - and you're done.
A lot of devs, have done the same thing, it's a lot easier and a LOT more accessible to construct your own phone, than most people even dare to dream of.
What this world is coming to - is for you and me to decide.
Colossus and Guardian are one.
Would were! Should is! Could be! And live a hundred times three.
I understand that through careful use of AT commands through a device a user would have to physically dock into you can trigger the device to perform certain actions (like dial a call), but the claims in the summary are nothing short of fantastical:
These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.
Exactly what AT command from the 1980s Hayes smartmodems does one use to "perform screen unlocks" or "inject touch events" into a device, let alone "exfiltrate sensitive device information"?
Ken
Those command are how USB tethering works
Yes, it pretends to be a modem/serial port. Oh well.
The USB gadget interface is odd at best.
The cellular AT commands are specified by the 3GPP Open Standard document 27.007.
Anyone can download the latest doc from http://www.3gpp.org/ftp/Specs/...
There was no need to reinvent the wheel because the old Hayes inspired AT command technology could easily be applied to modern cellular devices.
Bluetooth can use AT commands for transferring contact information between devices and therefore AT commands are not restricted to the USB to serial interface. In other words, Bluetooth can provide virtual serial links over the Bluetooth radio link which I suspect an attacker would like to exploit remotely.
When implementing an AT command interpreter, care is needed to not allow unauthorised entities from executing actions that are deemed to be dangerous to the integrity of the system.
However, vendors can create their own vendor specific commands. That can be a weakness because they won't be tested in conformity testing for 27.007 and other AT command specifications.
NO CARRIER
Comment removed based on user account deletion
Holy crap! I haven't used AT commands since I got rid of my external modem in the dial up internet days. Started with a 2400bps, then 9600, 33k, and 56k. When I went to 1.5meg DSL then to a whopping 3-6 meg, thought it couldn't get any better LOL. AT commands...there's a walk down memory lane!
+++ath
Just testing...
Seriously, this article is fucking ridiculous scare mongering, pure and simple.
Let's see.
They need physical access to your phone.
They need to have your password because the phone must be able to install as a modem, but Android does not do without enabling it EACH time you plug it in.
They need the modem drivers.
Then, they need to send AT commands after all that. After they were already holding your unlocked phone.
Likely most people have no idea about AT commands. Yes, they are still used. They are also mandatory to support, should you wish to certify your phone according to PTCRB, which, unless you are selling only to VzW or Sprint, you MUST do to be allowed on the network.
AT commands are normally not used by people. They are used by machines.
They are used by SIM application tool kit for example. Your SIM card has applications on it that handles things like steering of roaming. This is done via at commands to the modem.
Or changing the PLMN as another example.
If you really want to fuck with your phone, then DL a copy of QXDM and start tweaking NV items. NV items are used by qualcomm to control everything about the radio. Change the bands? Sure, no problem. Change power class? Yup.
Of course, the physical HW would not support it and likely you would damage the PA, but you can still set it. There likely wont be any matching circuit in the antenna path either. So if the PA can transmit in that band, you will get some pretty wicked spurious emissions.
There are tons of settings you can make to brink your phone straight away.
This takes the same level of access then sending stupid AT commands.
This isn't even an issue.
The fact that the modem itself speaks AT commands isn't anything new (the smartphone OSes still needs to send command to it to ask to get a 3G/4G connection, or to dial a voice number. The ethernet-card-like interface is only exposed by the modem when the connection is set up.)
The problem lies at two different levels :
- Why is the smartphone exposing the modem over its USB connection ? It might by a bug in the OS (it should either expose some android-y interface like ADB, expose whatever shitty thing is popular currently on Windows to exchange file (MTP ?), and/or expose a USB-Network). It might be a firmware error (like the USB connection being handled by the cell modem and accidentally exposing internals).
- Nowadays, nearly all smartphone have the cell modem directly built in the SoC and functioning as the north bridge of the chipset (in charge of bringing up and controling tons of sensitive parts, including RAM, boot firmware, etc.) This give a couple of tiny advantages (powersavings : e.g. the modem could handle a call, including routing to bluetooth, while the main OS sleeps). Bur opens tons of security issue, specially once you factor in that this critical part, due to how frequency licensing works, CANNOT run an opensource firmware, but is instead controlled by the chipset manufacturer and the service provider.
(The only notable exception are a few geek project like the Purism Librem 5, and Dragon Pyra, where the modem is still a separate chip that only speaks over serial+ethernet to the main chipset, has no other access to anything sensitive and can be killed with a simple switch).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Pretty much all 2G, 3G, 4G, NB-IoT, Cat-M1, etc. cellular modules use AT commands. Anyone building things like GNSS trackers or M2M devices is familiar with them. It's something that worked and could easily be adapted for new uses without reinventing the wheel.
Nice. Back in the 28.8 and 33.6 days, that actually worked on most modems using Rockwell chipsets as they didn't have "guard time" between the +++ interrupt and taking a command. People could mass-dump people from IRC channels and such with that command (or worse - chain on a dial command for some long distance number / 911) until firmware updates came out to insert guard time.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
That's why you used the IRC PING command, as their client you sent the request to would response with PONG and the argument you sent them.
Sending PING +++ATH0 caused their client to respond with PONG +++ATH0
Those are vendor-specific extensions that have nothing to do with Hayes Smartmodem actions but do things like simulate touch events, read and send back phone data, and other actions normally shielded by security measures. Read the article next time.
"Made up/misattributed quote that makes me look smart. I am on