ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem
summary
Researchers extract 3,500 AT commands from over 2,000 Android firmware images across 11 vendors, build an automated USB tester that talks to phones over the USB CDC ECM interface, and test eight devices. Findings show vendor-specific AT commands that can unlock screen and enable ADB, rewrite firmware, change IMEI, exfiltrate files via procfs traversal, and inject touch events; demos include bypassing an LG lockscreen and enabling ADB. Prototype fixes: remove or restrict the modem USB interface or whitelist allowed commands; Samsung and LG release patches.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:25Those BBS Days...
- 1:49Motivation
- 3:51AT Commands
- 5:00How to find them?
- 7:04Android Version Distribution
- 7:38ATcmd Distribution Per Vendor
- 8:28How to test them?
- 9:37Android Devices Tested
- 11:10Firmware Flashing
- 11:50Android Security Bypassing
- 12:37Sensitive Information Leaking
- 13:38Modem AT Proxy
- 14:20Hidden Menus
- 14:49Demo
- 17:31Mitigations & Fixes
- 18:35Now What?
related talks
23mCharge Your Device with the Latest Malware
36mPhysical Attacks Against Smartphones
16mCATana: On the Dangers of SIM-Originating AT Commands
58mResearching Android Device Security with the Help of a Droid Army
32mHacking the Hackers’ Code: Inside Android Malware
49mAll the 4G Modules Could be Hacked
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps