Over the Air, Under the Radar: Attacking and Securing the Pixel Modem
summary
Team achieves over‑the‑air, no‑click remote code execution against a Pixel 6 modem by chaining ASN.1 decoder heap out‑of‑bounds writes into an unsafe‑unlink arbitrary write, aided by an MMU misconfiguration that leaves heap executable. Methods include host‑based fuzzing, CodeQL audits and a Unicorn firmware emulator; exploit development uses a USRP B200 SDR and OpenBTS to deliver an 80‑byte stage‑0 payload that assembles a larger stage‑1 and exfiltrates SMS to bypass Twitter MFA. Findings: ~120 bugs (≈50 in ASN.1), two CVEs fixed; mitigation: disable 2G toggle.
AI-written summary · about
chapters (15)
- 0:00Pixel modem security risks
- 1:04Session agenda
- 2:08Android Red Team methods
- 3:11Modem security concerns
- 4:14OTA remote code execution
- 6:21Pixel modem purpose
- 7:452G attack surface
- 9:10Fuzzing and static analysis
- 15:14Key vulnerabilities
- 24:53Live RCE exploit demo
- 31:18Real-world implications
- 33:26Attack setup cost
- 35:34Exploit development challenges
- 37:01Mitigating attacks
- 38:06Concluding thoughts
related talks
44mExposing Critical Threats In Millions Of Connected Devices
45mExploiting Qualcomm WLAN and Modem Over The Air
20mSoK: Insecurity of Cellular Basebands
25mAttacking Mobile Broadband Modems Like a Criminal Would
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
39mFuzzing GPRS Layer-2 For Fun And Profit
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week