The Report
A team of researchers spent time doing something most people never think to do: they asked what a SIM card is actually allowed to say to a phone. Not what it stores. What it can order.
The paper is called CATana. It was presented at USENIX WOOT ’26. Eighteen phones, ten manufacturers, one question: can the SIM card issue raw commands straight to the modem, with no involvement from the operating system and no consent from the owner? What follows is that report, stripped of jargon and academic throat-clearing, kept to what matters.
Three phones said yes.
A Card With Opinions
SIM cards have always been more than an identity chip. The SIM Application Toolkit — standardised since the 1990s, defined in 3GPP TS 11.14 — lets the card push menus, send text messages, and run background tasks on the handset. It was designed so operators could manage the phone remotely. Convenient for them. Rarely scrutinised by anyone else.
Buried in that toolkit is a proactive command called RUN AT. Its job is to hand an AT command straight to the modem and let it execute. AT commands are the low-level language modems have used since the dial-up era — they can change network mode, kill the radio, read configuration, and more. On a phone where RUN AT is enabled, the SIM effectively gets a console session with the baseband. No app. No prompt. No log the owner will ever see.
A SIM card is not always trustworthy hardware. It can be cloned, reprogrammed, or swapped by anyone with brief physical access and the right equipment. On a phone that honours RUN AT, that person doesn’t need to touch the operating system at all.
The Test
The researchers built their own SIM test tooling and fuzzers, then worked through eighteen handsets from Apple, Google, Motorola, OnePlus, OPPO, Samsung, ASUS, Huawei, Oukitel and ZTE. Every phone got the same question: does the modem accept a SIM-originated AT command, or does it refuse?
| Manufacturer | Model | Chipset / Baseband | SIM‑originated AT? |
|---|---|---|---|
| Apple | iPhone 15 | Qualcomm X70 5G | No |
| Apple | iPhone 16e | Apple C1 | No |
| Pixel 7 | Samsung Exynos 5300 | No | |
| Pixel 9 | Samsung Exynos 5400 | No | |
| Motorola | One Vision | Samsung Exynos 9609 | No |
| Motorola | Moto G32 | Qualcomm SM6225 | No |
| OnePlus | 5T | Qualcomm MSM8998 | No |
| OnePlus | Nord CE 2 | MediaTek Dimensity 900 | No |
| OPPO | Find X5 | Qualcomm SM8350 | Yes |
| OPPO | Reno14 F 5G | Qualcomm SM6450 | Yes |
| Samsung | Galaxy A14 | MediaTek MT6769 | No |
| Samsung | Galaxy A72 | Qualcomm SM7125 | No |
| Samsung | Galaxy S22 | Samsung Exynos 2200 | No |
| Samsung | Galaxy Z Flip6 | Qualcomm SM8650 | No |
| ASUS | Zenfone 9 | Qualcomm SM8475 | Yes |
| Huawei | P40 Lite | HiSilicon Kirin 810 | No |
| Oukitel | C19 | MediaTek MT6735 | No |
| ZTE | Blade A54 | Unisoc SC9863A | No |
Three phones, out of eighteen. Two OPPO models and one ASUS. All three run Qualcomm silicon, though plenty of other Qualcomm-based phones in the same table refused the command — so the chipset alone doesn’t decide it. What decides it is how the vendor configured that chipset’s modem firmware.
What “Yes” Actually Buys An Attacker
On the affected devices, a hostile SIM can issue any of roughly 198 identified AT commands with no OS-side exploit at all. Two primitives stand out. The first forces the modem into 2G-only mode — a network generation with weaker authentication and long-broken encryption, and one that stays forced until something changes it back. The second cuts modem power outright, a clean denial of service that needs nothing more clever than a single command string.
The researchers also found related weaknesses reaching further than handsets — arbitrary file reads and shell injection on some IoT modules, demonstrated against an EV charger. The phone story and the embedded-device story are the same story: a SIM was trusted more than it should have been.
None of this needs a compromised app, a phishing link, or a zero-click browser exploit. It needs a SIM the attacker controls and a modem willing to listen.
Mitigation
There is no toggle in your settings menu for “disable RUN AT.” This sits in modem firmware, configured by the vendor, invisible from the Android or iOS side. That leaves practical, unglamorous countermeasures:
- Keep firmware current. Baseband patches ship alongside OS updates and rarely get announced with any fanfare. Install them anyway.
- Never insert an unknown SIM. The entire attack chain starts with physical or cloned SIM access. Don’t hand that access to anyone.
- Ask before you assume. If you’re on an affected model or anything Qualcomm-based you’re unsure about, ask the vendor or your carrier whether RUN AT is disabled in your firmware build.
- Turn off what you don’t use. VoLTE and VoWiFi expand the modem’s attack surface for marginal benefit if you don’t rely on them. Where your carrier allows it, disable them.
The Part That Doesn’t Fit On A Slide
Everyone audits the app layer. Permissions, sandboxes, code signing, store review. Fewer people audit the layer underneath — the modem, and the tiny plastic card that was quietly granted a command line to it decades ago and never had that privilege revisited.
The card was never just storage.
It never asked permission to stop being trustworthy.