SoK: Insecurity of Cellular Basebands
summary
Survey shows baseband firmware are large and opaque — often 19 MB binaries with no symbols, custom ISAs like Hexagon ISA, and limited hardening; CVEs spike since 2015 and Zerodium offers bounties since 2019. Paper catalogs implementation bugs (memory corruptions, null ciphers), demonstrates fuzzing plus state-machine inference and over‑the‑air testing vs emulation tradeoffs, notes stack canaries added recently on Pixel, and flags unencrypted Samsung modems and missing crash reporting as practical blockers.
AI-written summary · about
chapters (6)
- 0:00Cellular baseband insecurity
- 3:25Basebands critical and hard to analyze
- 9:45Attack surfaces and threat models
- 13:11Test cases for basebands
- 16:20Crash detection and deep state exploration
- 18:30Challenges in baseband security
related talks
36mBehind Closed Curtains - Insights on Security Vulnerabilities in Smartphone Basebands
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
44mExposing Critical Threats In Millions Of Connected Devices
21mSoK: Where’s the “up”?! A Comprehensive (bottom-up) Study on the Security of...
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
44mNew Vulnerabilities in 5G Networks
23mConflicts in Vulnerability Management and Patching