Unraveling the iPhone's Baseband Architecture to Defend Against Cellular Attacks

iPhone basebands handle the cellular connection, yet they receive little research, and iOS has no system-wide defence against attacks on that link, such as fake base stations or forced downgrades to 2G. The talk walks through how the baseband talks to the rest of the phone: carrier configuration bundles, Apple's remote invocation protocol on Intel modems, and Qualcomm's QMI protocol on newer models. The speaker showed how these messages can be captured and decoded with the BaseTrace tooling, including wireless diagnostics metadata stored as protocol buffers.

The research then moves to Qualcomm diagnostics data, which exposes over-the-air frames, and to a way of persuading the baseband to use an older logging format. The firmware of the Qualcomm chip, which runs on the Hexagon architecture, is harder to analyse and cannot be modified because it is verified at boot. Location data matters for detection, so the talk explained how Apple's location database maps cells to coordinates and how crowdsourced iPhones populate it.

To act on this, the team built CellGuard, an iOS app that scores each cell by whether it appears in that database, how far it sits from the reported position, its signal strength and any unexpected network rejections. Cells are classed as trusted, anomalous or suspicious, analysis runs on the device, and data is discarded after a few days. A study across Europe over six to seven months found few anomalous cells, and lab tests with a rogue base station worked best on LTE and older networks. The takeaway is that database coverage was strong in the region, but confirming a suspicious cell remains difficult.