CATAnA: Exploring the Dangers of SIM-Originating AT Commands in Cellular Devices

Executive Summary

Hostile SIMs represent a significant yet underexplored attack vector against modern cellular devices. While prior research acknowledged theoretical risks from SIM-originating proactive commands, comprehensive empirical analysis of this attack surface has been lacking. This research presents CATANA, a comprehensive toolkit for analyzing SIM-originated AT command execution, surveying 26 cellular devices spanning smartphones, IoT modems, and development boards. Investigation reveals that 9 devices expose the SIM AT interface, enabling discovery of 4 distinct vulnerabilities with severe security implications including arbitrary code execution, denial-of-service, network downgrade attacks, and unauthorized file access.

The findings demonstrate that despite academic and industry research highlighting the dangers of AT commands and proactive SIM commands, many cellular devices remain vulnerable to exploitation via SIM-originating requests. This work fills a critical gap in understanding mobile security threat models and provides practical evidence that hostile SIMs continue to pose significant risks, particularly for IoT and embedded cellular devices.

Background: AT Commands and SIM Interfaces

AT commands originate from the Hayes smart modem (1981) and remain fundamental to modern cellular devices. These commands enable control of modems over serial interfaces and maintain backward compatibility despite decades of evolution. Contemporary cellular devices implement Hayes-compatible interfaces, with 3GPP standards defining universally understood commands and vendors adding proprietary extensions.

Modern cellular devices typically follow a two-processor architecture: an Application Processor (AP) running user-facing operating systems (Android, iOS, Linux), and a Communication Processor (CP) handling all radio communications. The SIM card connects directly to the CP via an APDU (Application Protocol Data Unit) interface, not the AP. Proactive SIM commands enable SIMs to invert normal communication flow, allowing cards to originate requests to the CP. The RUN AT command specifically embeds AT command execution directly into proactive requests, creating an interactive SIM AT interface that can bypass expected system flows and reduce AP visibility.

The CATANA Toolkit

The research introduces CATANA, consisting of four specialized tools for exploring the SIM AT interface:

• CATtty (3331 lines of Zig): Operates in two modes—complete card emulation using SW SIM, or interposition of PC/SC-attached cards. Supports both interactive AT shell and one-shot automation.
• CATlet (338 lines of Java): Establishes bidirectional connection between a CAT LET applet on SIM and host CLI. Dispatches user-specified AT commands via proprietary ENVELOPE APDUs over AT+CSIM interface.
• CATauto: Automates sequential dispatch of AT commands from input files, collecting responses to output file for offline analysis.
• CATview: Analyzes CATauto output to produce human-readable JSON listing all AT commands producing non-error responses, with descriptions and variants.

Device Survey: 26 Devices Tested

Smartphones (18 models, 10 vendors)

Survey tested representatives from Apple, Google, Motorola, OnePlus, OPPO, Samsung, ASUS, Huawei, Oukitel, and ZTE. Results show that while most smartphones lack active RUN AT support, underlying infrastructure for handling these commands often remains present in firmware. Only 3 of 18 smartphones report RUN AT support in terminal profiles, all using Qualcomm CP chipsets. However, reverse engineering of Shannon-based firmware (Samsung Exynos) revealed that RUN AT parsing code exists but is unreachable under normal execution due to block list checks. This suggests that code paths could be triggered through control-flow hijacking exploits.

IoT Modems (8 devices, 4 vendors)

Survey examined Quectel, Nordic Semiconductor, Sierra Wireless, and Simcom modems deployed in EV chargers, industrial routers, automotive telematics units, and development boards. Most use Qualcomm-based CPs with Linux-based internal APs. Critically, 7 of 8 IoT modems support the RUN AT proactive command. Unlike smartphones, these modems typically forward SIM AT commands to internal APs for processing, exposing a rich attack surface. All Quectel-based modems support RUN AT, with internal APs running Android on ARM Cortex-A7 cores.

Case Studies: Four Practical Attacks

Case Study 1: Code Execution on EV Charger

Target: AUTEL Maxi US AC W12-L-4G (contains Quectel EC25-AFX modem with Qualcomm MDM9607 CP and Linux-based AP)

Vulnerability: The atfwd_daemon binary, which processes AT commands from various sources including SIM AT interface, implements shell command handlers using unsafe format strings. Two vulnerable code paths were identified executing shell commands with format string parameters. While a character block list prevents usual shell escapes, a newline character injection bypass was discovered.

Exploit: Two-stage attack creates custom executable wrapper to bypass block list, then leverages wrapper for arbitrary code execution via SIM-originated RUN AT proactive commands, achieving full command execution capability.

Case Study 2: Denial-of-Service & 2G Downgrade

Target: OPPO Reno 14 F 5G (Qualcomm SM6450 SoC with RUN AT support)

Attacks Demonstrated:

• AT$QCPWRDN — Powers down the phone causing temporary device DoS until reboot
• AT+CFUN=0 — Powers down the CP causing modem DoS until reboot
• AT+COPS=0,,,0 — Restricts access to 2G networks, forcing downgrade from 4G to 2G

The 2G downgrade cannot be mitigated by user actions including toggling airplane mode, manual network selection, disabling SIM, toggling mobile data, or changing network generation preferences. This vulnerability directly enables fake base station attacks exploiting 2G’s lack of mutual authentication.

Case Study 3: Arbitrary File Exfiltration

Target: Quectel EG25-G modem with multiple storage locations (User File Storage, Security File System, RAM, external SD card)

Vulnerability: Path traversal in outdated firmware allows breaking out of dedicated storage areas. Additionally, TFTP daemon on AP does not validate whether accessed files are ordinary files or symbolic links, enabling indirect access to arbitrary file system locations.

Exploit: Attacker inserts malicious symbolic link on UFS partition, then uses CAT TTY in interposer mode to exfiltrate linked file contents. Quectel proprietary AT+QSMTP commands enable email of exfiltrated data to attacker-controlled servers. TFTP daemon runs with root privileges, enabling potential code execution via writing to kernel configuration files.

Case Study 4: Additional Proactive Command Vulnerabilities

Beyond RUN AT, investigation discovered a new variation of the LAUNCH_BROWSER proactive command on recent Android devices. A hostile SIM can force a phone to visit attacker-controlled websites without any user interaction, even when the lock screen is active. This provides a potential entry point for complex exploit chains including credential harvesting or malware distribution.

Threat Model and Hostile SIM Sources

The research adopts a comprehensive threat model identifying four realistic sources for hostile SIMs:

• Software Stack Vulnerabilities: Remote exploitation of SIM software (demonstrated by SIMJacker attacks)
• Physical Access: Attacker exchanges SIM or installs interposer hardware
• Remote SIM Administration: Malicious or compromised operators remotely extend SIM functionality
• Supply Chain Attacks: Backdoors inserted during manufacturing or distribution (documented in NSA ANT catalog, recent operator data breaches)

Impact Assessment

SIM AT attacks enable diverse capabilities: fingerprinting of device type, firmware version, and IMEI via proactive commands; connection downgrade to 2G enabling fake base station attacks; SMS transceival establishing C&C channels; and code execution on internal APs serving as stepping-stones for full system compromise. For IoT devices, compromised internal APs enable machine-in-the-middle attacks and exploitation of benign assumptions in main device firmware expecting only legitimate modem inputs.

Mitigation and Defense Strategies

• Deprecation: Remove RUN AT and other dangerous proactive commands from CP firmware and AP software stacks entirely, rather than relying solely on block list checks
• Detection & Prevention: Extend existing frameworks like RILDefender and BaseTrace to detect SIM AT artifacts in modem logs
• Hardened Android: Disable processing of SIM AT commands in Android stacks to reduce attack surface
• Hardware Interposers: Develop SIM interposer defenses that drop proactive RUN AT commands before they reach the CP
• Kernel Module Signing: Enforce module signature verification to prevent loading of unsigned code via SIM-originating AT commands

Key Takeaways

• Widespread Exposure: 35% of surveyed devices expose SIM AT interface, with IoT modems at highest risk (87.5% support RUN AT)
• Legacy Interfaces Remain Dangerous: Despite decades of AT command security research, modern devices retain vulnerable code paths and minimal filtering
• Asymmetric Threat: Smartphones report limited RUN AT support but retain underlying infrastructure for command execution, vulnerable to control-flow hijacking
• IoT as Prime Target: IoT modems forward most SIM AT commands to internal APs, exposing rich attack surfaces for privilege escalation
• Block Lists Insufficient: Simple block lists and character filtering prove bypassable via format strings, newline injection, and wrapper execution
• Coordinated Disclosure Working: Vendor responses ranged from acknowledgment and patches (Quectel, Qualcomm, Semtech) to exclusion from bug bounty programs, highlighting inconsistent security posture

Defensive Recommendations

• Firmware Hardening: Remove RUN AT support entirely from all CP and AP firmware rather than implementing permissive block lists. Validate this through binary diffing of released firmware.
• Privilege Separation: Ensure AT command handlers run with minimal privileges. Avoid shell invocation for command processing; use structured argument parsing instead.
• Input Validation: Implement comprehensive input validation including character whitelisting, length limits, and format string protections. Validate at multiple layers (CP and AP).
• File System Protection: Implement symbolic link resolution checks and validate file access requests. Use SELinux or AppArmor policies to restrict AP file system access.
• SIM Authentication: Consider mutual authentication between SIM and CP to restrict proactive commands to authenticated SIMs, though this requires significant architectural changes.
• User Notification: Provide user-facing warnings when SIM attempts network configuration changes, module loading, or power state modifications.
• Monitoring & Logging: Implement comprehensive logging of all SIM-originated commands and AP responses. Make logs accessible for security analysis and forensics.

Conclusion

This research demonstrates that SIM-originating AT commands represent a significant and underappreciated security threat to modern cellular devices. Despite decades of AT command vulnerability research and growing awareness of hostile SIM risks, manufacturers continue to expose interactive SIM-controlled command execution interfaces with minimal security controls. The CATANA toolkit provides researchers with comprehensive capabilities for exploring this attack surface, and the case studies present practical evidence that these vulnerabilities translate to real-world exploitation scenarios. While smartphones show limited RUN AT support, reverse engineering reveals underlying infrastructure that remains vulnerable to control-flow attacks. IoT modems present particularly acute risks, forwarding most SIM AT commands to internal APs with insufficient validation. The research emphasizes that effective mitigation requires not just filtering dangerous commands, but architectural hardening including privilege separation, secure coding practices, and comprehensive elimination of legacy interfaces. As cellular devices proliferate across critical infrastructure and IoT deployments, addressing these security gaps becomes increasingly urgent.

Original text: Tomasz Piotr Lisowski, Kristian Covic, Marius Muench. “CATAnA: On the Dangers of SIM-Originating AT Commands” — 20th USENIX WOOT Conference on Offensive Technologies, August 2026.