Security Analysis on IoT Equipment by Building a Base Station System
Baidu Security Lab researcher Shupeng demonstrates constructing test GSM and LTE base stations to intercept 2G/3G/4G traffic and execute machine-in-the-middle attacks on connected smart devices.
Summary
Expanding Cellular Connectivity Across IoT
Billions of modern connected devices—from shared bicycles and automotive telematics to vending machines and smart meters—rely on 2G, 3G, and 4G cellular links to exchange commands with cloud backends.
Constructing Software-Defined Base Stations
Baidu Security researcher Shupeng (XiaoHuiHui) presents the hardware and software architecture to build legal, localized GSM and 4G LTE base stations using Software Defined Radios (SDR).
Automating Rogue Base Station Associations
Drawing insights from malicious base station tactics in the wild, Shupeng introduces forced cell-selection techniques that compel nearby IoT cellular modems to associate automatically with the test tower.
Executing Cellular Machine-in-the-Middle Attacks
The speaker demonstrates four real-world exploitation case studies, capturing unencrypted cloud communications, spoofing backend API responses, and achieving remote command execution on connected endpoints.
Related talks
Main Stage·24 min
Cooper Quintin
Cooper Quintin details how 4G IMSI catchers operate and introduces open-source software with low-cost hardware to detect rogue base stations in real time.
Main Stage·47 min
XiaoHuiHui
Discovers systemic vulnerabilities across 4G LTE modem modules from major manufacturers used in billions of IoT devices.
Main Stage·16 min
Weiguang Li
Weiguang Li examines public warning system (PWS) based on mobile communication system is used to alert the public to emergency events such as earthquakes, tsunamis, hurricanes, etc.