Editing Hayes AT command set (section)

=== Hayes' solution<span class="anchor" id="+++"></span> ===
{{further|Command mode and Data mode}}

[[Hayes Communications]] introduced a solution in its 1981 [[Smartmodem]] by using the existing data pins with no modification. Instead, the modem itself could be switched between one of two modes:
# ''Data mode'' in which the modem sends the data to the remote modem. (A modem in data mode treats everything it receives from the computer as data and sends it across the phone line).
# ''Command mode'' in which data is interpreted as commands to the local modem (commands the local modem should execute).

To switch from data mode to command mode, sessions sent an [[escape sequence]] string of three plus signs ({{precode|+++}}) followed by a pause of about a second. The pause at the end of the escape sequence was required to reduce the problem caused by [[in-band signaling]]: if any other data was received within one second of the three plus signs, it was not the escape sequence and would be sent as data. To switch back they sent the ''online'' command, {{precode|ATO}}. In actual use many of the commands automatically switched to the online mode after completion, and it is rare for a user to use the online command explicitly.

In order to avoid licensing Hayes's patent, some manufacturers implemented the escape sequence without the time guard interval ([[Time Independent Escape Sequence]] (TIES)). This had a major [[denial-of-service attack|denial of service]] security implication in that it would lead to the modem hanging up the connection should the computer ever try to transmit the byte sequence {{precode|+++ATH0}} in data mode. For any computer connected to the Internet through such a modem, this could be easily exploited by sending it a [[ping of death]] request containing the sequence {{precode|+++ATH0}} in the payload. The computer operating system would automatically try to reply the sender with the same payload, immediately disconnecting itself from the Internet, as the modem would interpret the [[Internet Control Message Protocol|ICMP]] data payload as a Hayes command.<ref>{{cite web|url=http://marc.info/?l=bugtraq&m=90695973308453&w=2|title=1+2=3, +++ATH0=Old school DoS|last=Max|first=Schau|date=27 September 1998|work=[[Bugtraq]] mailing list|access-date=8 December 2012}}</ref> The same error would also trigger if, for example, the user of the computer ever tried to send an e-mail containing the aforementioned string.