Attacking And Securing the Pixel Modem
Google Android Red Team details offensive security evaluations of Pixel smartphone baseband modems using SDRs to discover remote cellular vulnerabilities.
Summary
The High-Stakes Threat Model of Smartphone Modems
Cellular baseband processors operate as highly privileged, independent system components that parse complex, unauthenticated wireless radio signals directly from cell towers.
Democratizing Baseband Research with Software-Defined Radio
Farzan Karimi, Xingyu Xing, and Eugene Rodionov explain how modern SDR toolkits and open-source cellular stacks enable researchers to audit previously opaque proprietary modem codebases.
Offensive Evaluation of Google Pixel Modems
The Android Red Team outlines their methodology for fuzzing over-the-air LTE and 5G protocol parsers, memory isolation boundaries, and inter-processor communication channels on Pixel devices.
Proactive Defense and Hardening Modems
Implementing compiler-level exploit mitigations, memory sanitizers, and rigorous internal red-teaming ensures critical baseband flaws are eliminated prior to consumer device release.
Related talks
Main Stage·40 min
Matthias Fischer · Patrick Wardle
Reveals critical baseband and firmware vulnerabilities in popular cellular modems that allow remote over-the-air exploitation and device takeover.
Main Stage·46 min
Cooper Quintin
EFF researcher Cooper Quintin introduces Crocodile Hunter, an open-source tool using low-cost SDRs to detect 4G LTE IMSI catchers (Hailstorm) in real time.
RF Village·26 min
Ron Broberg
Details building open-source 2G, 4G, and 5G cellular base station testbeds with SDRs to evaluate and benchmark EFF's Rayhunter IMSI catcher detector.