CATana: On the Dangers of SIM-Originating AT Commands
summary
The CATana toolkit explores SIM-originating AT commands and finds concrete risks: a survey of 26 devices shows 9 of 26 devices expose SIM AT, yielding four vulnerabilities that allow command execution, arbitrary file read, persistent 2G downgrade and DoS. Tools named Caddy, Catallet and automation reveal the SIM’s RUN AT proactive command is usable to inject AT strings, unlock screens, exfiltrate files over modem channels, and persist state until reboot or manual reconfiguration.
AI-written summary · about
chapters (9)
- 0:00CATana and SIM AT commands
- 1:57AT commands and SIM interface
- 3:45SIM-originating AT commands
- 5:51Exploring SIM-AT interface
- 9:26Device survey with CADto
- 11:11Device survey results
- 12:36Attacks: 2G downgrade and code execution
- 14:00Mitigations and responses
- 15:49Summary and call to action
related talks
23mATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem
44mExposing Critical Threats In Millions Of Connected Devices
25mAttacking Mobile Broadband Modems Like a Criminal Would
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
55mHidden Agendas: Bypassing GSMA Recommendations On SS7 Networks
49mAll the 4G Modules Could be Hacked
48mSATCOM Terminals: Hacking by Air, Sea, and Land