35th Annual Computer Security Applications Conference (ACSAC 2019)

Full Program »
View File
View File

Opening Pandora's Box through ATFuzzer: Dynamic Analysis of AT Interface for Android Smartphones

This paper focuses on checking the correctness and robustness of the AT command interface exposed by the cellular baseband processor through Bluetooth and USB. A device's application processor uses this interface for issuing high-level commands (or, AT commands) to the baseband processor for performing cellular network operations (e.g., placing a phone call). Vulnerabilities in this interface can be leveraged by malicious Bluetooth peripherals to launch pernicious attacks including DoS and privacy attacks. To identify such vulnerabilities, we propose ATFuzzer that uses a grammar-guided evolutionary fuzzing approach which mutates production rules of the AT command grammar instead of concrete AT commands. Empirical evaluation with ATFuzzer on 10 Android smartphones from 6 vendors revealed 4 invalid AT command grammars over Bluetooth and 13 over USB with implications ranging from DoS, downgrade of cellular protocol version (e.g., from 4G to 3G/2G) to severe privacy leaks. The vulnerabilities along with the invalid AT command grammars were responsibly disclosed to affected vendors and two of the reported vulnerabilities have been already assigned CVEs (CVE-2019-16400 and CVE-2019-16401).

Imtiaz Karim
Purdue University

Fabrizio Cicala
Purdue University

Syed Rafiul Hussain
Purdue University

Omar Chowdhury
The University of Iowa

Elisa Bertino
Purdue University


Powered by OpenConf®
Copyright©2002-2020 Zakon Group LLC