Captures flags with @TeamTasteless. Assistant Professor at @unibirmingham and maintainer of FirmWire & avatar2.
- Tweets 671
- Following 458
- Followers 2,017
- Likes 652
ALT Screenshot of first page of the paper "Download more RAM: Dismantling Windows Operating System Defences with Mischievous Memory."
ALT Overview Figure from the paper, describing the workflow of the attack.
ALT Screenshot from the demo video of the attack. Left side shows the download more RAM script being executed, right side shows the windows security center, demonstrating Windows Defender being disabled. A textbox overlay states "known blocked BYOVD attacks work again".
![Screenshot of the paper abstract for "CATANA: On the Dangers of SIM-Originating AT Commands".
The text states:
Hostile SIMs have been discussed as an attack vector against Mobile Equipment (ME) connected to cellular networks. One main attack path are proactive commands sent from the SIM to the victim device. In this work, we examine the threats posed by the RUN AT command which are SIM originating requests for the ME to execute a specified AT command, effectively creating a SIM AT interface.
To explore this interface, we introduce the CATANA toolkit and use it to analyze
real-world devices. Despite existing community knowledge on proactive commands and the dangers of AT commands, our investigation shows that SIM AT commands pose a significant security risk for MEs.
We survey 26 different MEs (8 IoT devices and 18 smartphones) and find that 9 expose the SIM AT interface, leading to the discovery of 4 vulnerabilities. [...]](/pic/orig/media%2FHPWxW9-WUAAtl02.png)
ALT Screenshot of the paper abstract for "CATANA: On the Dangers of SIM-Originating AT Commands". The text states: Hostile SIMs have been discussed as an attack vector against Mobile Equipment (ME) connected to cellular networks. One main attack path are proactive commands sent from the SIM to the victim device. In this work, we examine the threats posed by the RUN AT command which are SIM originating requests for the ME to execute a specified AT command, effectively creating a SIM AT interface. To explore this interface, we introduce the CATANA toolkit and use it to analyze real-world devices. Despite existing community knowledge on proactive commands and the dangers of AT commands, our investigation shows that SIM AT commands pose a significant security risk for MEs. We survey 26 different MEs (8 IoT devices and 18 smartphones) and find that 9 expose the SIM AT interface, leading to the discovery of 4 vulnerabilities. [...]
ALT Screenshot from the paper, showing a 2G downgrade attack against a phone initiated by a hostile SIM.
ALT Cover slide of Troopers 2026 talk "A SIM Hacking Odyssey - Can a SIM Hack YOU?". The slide shows the title over an image of HAL9000.
ALT Preview of paper: "Security Through Transparency: Tales from the RP2350 Hacking Challenge". The image shoes the upper half of the first page of hthe paper.
