SoylentNews is people
SoylentNews
Submitted via IRC for BoyceMagooglyMonkey
[...] Unknown to the common user is that modern smartphones include a basic modem component inside them, which allows the smartphone to connect to the Internet via its telephony function, and more.
While international telecommunications bodies have standardized basic AT commands, dictating a list that all smartphones must support, vendors have also added custom AT command sets to their own devices —commands which can control some pretty dangerous phone features such as the touchscreen interface, the device's camera, and more.
[...] Once an attacker is connected via the USB to a target's phone, he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.
(Score: 2) by looorg on Monday August 27 2018, @07:45PM (4 children)
So we can now wait for the avalanche of malware apps that will start to dial some really expensive toll-/pay-numbers when it notes that the phone is idle and you are most likely asleep. Only much much later will you figure out the massive cost as you see you get your phonebill. Should be more money in that then in say having someone mine crypto on your phone.
(Score: 1) by nitehawk214 on Monday August 27 2018, @07:50PM (1 child)
I was going to post a comment with the title "ATDT8675309"
I did not know that AT commands were still a thing.
"Don't you ever miss the days when you used to be nostalgic?" -Loiosh
(Score: 2) by EETech1 on Tuesday August 28 2018, @03:12AM
Jenny has probably long since changed her number anyway:(
(Score: 1, Touché) by Anonymous Coward on Monday August 27 2018, @08:28PM
You could always do both
(Score: 3, Interesting) by Anonymous Coward on Monday August 27 2018, @10:38PM
Apps aren't the attack vector for this issue, it's the USB port. So if you're charging your phone through your laptop/PC then it could be compromised via malware on the computer. Further the phone likely requires additional drivers to enable the modem. For example, my Samsung phones require installing a driver package from their website (not available via Windows Update). So the phone will charge and do MTP out of the box but the modem won't be accessible; at least not on Windows. Not sure if the same is true on Linux and Mac.
The bigger risk will be using public charging stations (avoid trains and airports). If you must use them then get yourself a USB cable that lacks the data lines so nothing can talk to your device.
Also, malicious apps that fraudulently dial/text have been a thing for a very long time...