D2T1 - Establishing Covert Channels By Abusing GSM AT Commands
summary
Demonstrates covert data exfiltration by issuing GSM AT commands to a DIY handset built from a SIM900 GSM module and recycled parts, using AT dialing and caller-ID controls (ATD, AT+CLIP and related commands) to encode bits as missed/hidden calls. Measured throughput is about ≈12 bits/minute for simple missed‑call encoding and up to ≈28–29 bits/minute using virtual numbers or caller‑ID spoofing; experiments use prepaid/anonymous SIMs, run reliably in lab and long‑term tests, and successfully transfer hundreds of bits without establishing paid calls.
AI-written summary · about
chapters (12)
- 0:00Introduction and presenters
- 1:59Covert channels and freakin history
- 4:12Mobile phone low-level research
- 6:21Building a custom mobile phone
- 11:09AT commands and GSM interface
- 25:34First covert channel demo
- 29:20Channel capacity and stability
- 32:14Amplification techniques
- 36:50Virtual phone numbers demo
- 40:16Caller ID spoofing demo
- 44:11Conclusions and future work
- 46:25Q&A session
related talks
08mHacking 4G and how to get arrested in 10 minutes
24mEnhancing Physical Perimeter Defense Using SDR
55mHidden Agendas: Bypassing GSMA Recommendations On SS7 Networks
26mBack to the Future. Cross-Protocol Attacks in the Era of 5G
39mSecure Your Data
54mExposing device features on 4G & 5G networks
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
16mCATana: On the Dangers of SIM-Originating AT Commands