Researchers operating out of the University of Florida, Stony Brook University and Samsung Research America have made a disturbing discovery. Millions of Android smartphones manufactured by eleven different OEMs (Original Equipment Manufacturers) were found to be vulnerable to attack via AT Commands.
If you’re not sure what an “AT Command” is, you’re not alone. Part of the Hayes Command Set, ATtention Commands were developed in the early 1980s and designed to be transmitted via phone lines to issue commands to modems.
Most people aren’t even aware of the fact that their high-tech smartphones contain a basic modem within them, which allows the high-tech wonder to connect to the internet. While AT Commands have been standardized, many vendors have added custom AT Commands to their devices, and unfortunately, these commands can control a surprising variety of advanced features including the built-in camera and the touchscreen interface.
The AT Commands can be accessed via the phone’s USB interface. This means that a would-be attacker would have to gain physical access to the device, or place a malicious component inside a user’s charger, charging station, or USB dock.
Once a hacker is connected in this manner to the victim’s phone, he could use one of the AT Commands to steal data, unlock the screen, mimic touchscreen events, or even rewrite the phone’s firmware.
The research team has complied a database of phone models and firmware versions that are vulnerable to this type of attack. They have contacted all the vendors, and are continuing their testing.
Initially, the team tested AT Commands via the USB interface. Phase two of the research will test to see if those commands can be issued via WiFi or Bluetooth connections. The team has also published the Shell script they used in their original testing, available on GitHub.
So far, none of the OEMs contacted have released any information or given a timetable for a fix.
President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.
Google has introduced a new Gmail feature called “Confidential Mode,” which seeks to make sending and receiving important or sensitive emails more secure. Unfortunately, it may have inadvertently created as many problems as it solves.
According to Google’s support page on the matter, disabling your phone’s “Location History” in your phone’s privacy settings will prevent Google from tracking every move you make.
Android 9 is finally here, at least for some users. As of today, if you have any of the following phones, you can get the latest update:
Microsoft has made numerous ventures into the smartphone ecosystem, but so far, they’ve only been met with limited success. This time, they’re trying something a little different.
There is a small but significant change from Google, with the release of Chrome 68. The updated browser will now prominently notify browsers when they surf their way to non-HTTPS websites, displaying them as “Not Secure.”
Researchers from the digital security firm ESET have recently spotted a new malware campaign with a nasty twist. It was created using a legitimate security certificate stolen from D-Link.
File this one away under “watch your permissions.” It’s recently come to light that an unknown number of third party apps have access to read emails sitting in your Gmail account.
Malicious code can wind up on your PC or phone by any number of roads. Companies do their best to guard the digital passes, but invariably, things get missed and the hackers find a way in. It’s a constant battle, and sadly, one that the good guys are losing.
Change is coming, and not everyone is happy about it. Recently, Google redesigned its G-mail interface, and since then, they’ve allowed their free users to opt into the new changes. G-Suite users may or may not see the option to try the new interface, depending on whether their administrators have enabled the option and made it visible.
