Opening Pandora's box through ATFuzzer: dynamic analysis of AT interface for Android smartphones

Imtiaz Karim; Fabrizio Cicala; Syed Hussain; Omar Chowdhury; Elisa Bertino

doi:10.1145/3359789.3359833

Back

Opening Pandora's box through ATFuzzer: dynamic analysis of AT interface for Android smartphones

Conference proceeding

Open access

Opening Pandora's box through ATFuzzer: dynamic analysis of AT interface for Android smartphones

Imtiaz Karim, Fabrizio Cicala, Syed Hussain, Omar Chowdhury and Elisa Bertino

Proceedings of the 35th Annual Computer Security Applications Conference, pp.529-543

ACSAC '19

12/09/2019

DOI: 10.1145/3359789.3359833

Files and links (1)

url

https://doi.org/10.1145/3359789.3359833View

Published (Version of record) Open Access

Abstract

This paper focuses on checking the correctness and robustness of the AT command interface exposed by the cellular baseband processor through Bluetooth and USB. A device's application processor uses this interface for issuing high-level commands (or, AT commands) to the baseband processor for performing cellular network operations (e.g., placing a phone call). Vulnerabilities in this interface can be leveraged by malicious Bluetooth peripherals to launch pernicious attacks including DoS and privacy attacks. To identify such vulnerabilities, we propose ATFuzzer that uses a grammar-guided evolutionary fuzzing approach which mutates production rules of the AT command grammar instead of concrete AT commands. Empirical evaluation with ATFuzzer on 10 Android smartphones from 6 vendors revealed 4 invalid AT command grammars over Bluetooth and 13 over USB with implications ranging from DoS, downgrade of cellular protocol version (e.g., from 4G to 3G/2G) to severe privacy leaks. The vulnerabilities along with the invalid AT command grammars were responsibly disclosed to affected vendors and two of the reported vulnerabilities have been already assigned CVEs (CVE-2019-16400 and CVE-2019-16401).

android smartphone security and privacy

attack

vulnerabilities

Details

Title: Subtitle: Opening Pandora's box through ATFuzzer: dynamic analysis of AT interface for Android smartphones
Creators: Imtiaz Karim - Purdue University West Lafayette
Fabrizio Cicala - Purdue University West Lafayette
Syed Hussain - Purdue University West Lafayette
Omar Chowdhury - University of Iowa
Elisa Bertino - Purdue University West Lafayette
Resource Type: Conference proceeding
Publication Details: Proceedings of the 35th Annual Computer Security Applications Conference, pp.529-543
Series: ACSAC '19
DOI: 10.1145/3359789.3359833
Publisher: ACM
Grant note: DOI: 10.13039/100000001, name: National Science Foundation, award: CNS-1657124 and CNS-1719369; name: Intel; name: NSF/Intel ICN-WEN program
Language: English
Date published: 12/09/2019
Academic Unit: Computer Science
Record Identifier: 9984259485202771

Metrics

9 Record Views

9 Times Cited - Web of Science