Fuzzing GPRS Layer-2 For Fun And Profit
summary
Fuzzing focuses on GPRS layer‑2 LLC by injecting a fuzz task into firmwire emulation and driving inputs from AFL++; initialization requires handcrafted state fixes (GMM/SNCP/XID) so inputs reach higher layers. A three‑hour campaign on a Samsung S10e 2023 image produces nine crashes (some duplicates); one confirmed case is a heap overwrite in GMM triggered by a malformed Activate PDP Context Accept that causes a memset beyond payload bounds. Several crashes replicate over‑the‑air on Pixel 6/8 and S22/A14 as modem crashes/connection drops (DoS, potential for future exploit).
AI-written summary · about
chapters (12)
- 0:00Introduction to GPRS fuzzing
- 3:53Cellular basements overview
- 10:12Firmware emulation approach
- 14:44Initializing fuzzing tasks
- 17:39Handling stateful systems
- 21:32First fuzzing results
- 22:59Over-the-air replication
- 24:43Analyzing a GMM crash
- 29:19Live crash demonstration
- 30:23Defenses in modern basements
- 31:47Conclusion and future work
- 33:11Q&A session
related talks
14mLLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband...
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
44mExposing Critical Threats In Millions Of Connected Devices
20mD2T2 - A New Fuzzing Method for Android
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
54mExposing device features on 4G & 5G networks
53mFuzz Testing for Fun and Profit
45mExploiting Qualcomm WLAN and Modem Over The Air