Exposing Critical Threats In Millions Of Connected Devices
summary
Describes full-chain compromise of a cellular modem: firmware dumped by decapping and NAND read, custom PCB to expose test pads, and over 300 AT-style commands discovered; local privilege escalation by overwriting a midlet permissions file and a remote heap overflow via SUPL SMS fragmentation that yields repeatable crashes and slow memory disclosure (~7 bytes/min). A Raspberry Pi fuzz rig and a 2G BTS are used to trigger and probe the bug, then a payload that remaps memory and a tiny smsfs driver give remote code execution and persistent midlet install; two critical CVEs reported.
AI-written summary · about
chapters (5)
- 0:00Introduction and motivation
- 17:51Firmware extraction process
- 34:49Remote code execution demo
- 40:57Conclusion and recommendations
- 42:31Q&A session
related talks
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
49mAll the 4G Modules Could be Hacked
25mAttacking Mobile Broadband Modems Like a Criminal Would
45mExploiting Qualcomm WLAN and Modem Over The Air
38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week
38mMission mPOSsible