{"guid":"336838bc-dc14-5985-bb40-3ee424a68537","title":"📶 Analyzing Cellular Basebands with FirmWire 🔎","subtitle":null,"slug":"camp2023-57330-analyzing_cellular_basebands_with_firmwire","link":"https://pretalx.c3voc.de/camp2023/talk/TQXEN7/","description":"Last year, we released FirmWire to the public, an open-source baseband analysis platform.\nBut what even is a baseband and why do we want to analyze it? Hint: It’s a critical part of your phone and a first point of entry for attacks.\n\nThis talk will answer your questions and provide a hands-on introduction to our framework.\n\nThis talk will discuss cellular basebands and FirmWire, our open-source platform for baseband firmware. The platform allows researchers to emulate, dynamically debug, introspect, and interact with complex baseband firmware, providing insights about its inner workings in real-time.\n\nFirmWire’s integrated ModKit creates and injects custom tasks into the emulated baseband.\nWe leverage the ModKit for full-system fuzzing via AFL++ by creating custom fuzzing tasks interacting with the host, using special hypercalls.\nWith this setup, we uncovered several pre-authentication vulnerabilities in the LTE and GSM stacks of Samsung’s Shannon and MediaTek’s MTK baseband implementations, affecting billions of devices.\n\nFirmWire is the outcome of a more than two-year-long international research collaboration between the University of Florida, Vrije Universiteit Amsterdam, TU Berlin, and Ruhr-University Bochum.","original_language":"eng","persons":["nsr","domenukk"],"tags":["camp2023","57330","2023","Milliways",""],"view_count":912,"promoted":false,"date":"2023-08-17T10:30:00.000+02:00","release_date":"2023-08-18T00:00:00.000+02:00","updated_at":"2026-03-31T23:00:06.570+02:00","length":3176,"duration":3176,"thumb_url":"https://static.media.ccc.de/media/conferences/camp2023/57330-336838bc-dc14-5985-bb40-3ee424a68537.jpg","poster_url":"https://static.media.ccc.de/media/conferences/camp2023/57330-336838bc-dc14-5985-bb40-3ee424a68537_preview.jpg","timeline_url":"https://static.media.ccc.de/media/conferences/camp2023/57330-336838bc-dc14-5985-bb40-3ee424a68537.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/conferences/camp2023/57330-336838bc-dc14-5985-bb40-3ee424a68537.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/camp2023-57330-analyzing_cellular_basebands_with_firmwire","url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_title":"Chaos Communication Camp 2023","conference_url":"https://api.media.ccc.de/public/conferences/camp2023","related":[],"recordings":[{"size":null,"length":null,"mime_type":"application/x-subrip","language":"eng","filename":"DRAFT_camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire.en_DRAFT.srt","state":"todo","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2024-02-11T16:45:38.375+01:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/DRAFT_camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire.en_DRAFT.srt","url":"https://api.media.ccc.de/public/recordings/74642","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"},{"size":467,"length":3176,"mime_type":"video/webm","language":"eng","filename":"camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-08-18T08:09:39.740+02:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/webm-hd/camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/69007","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"},{"size":177,"length":3176,"mime_type":"video/webm","language":"eng","filename":"camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2023-08-18T02:14:43.885+02:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/webm-sd/camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/68981","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"},{"size":29,"length":3176,"mime_type":"audio/opus","language":"eng","filename":"camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2023-08-18T01:52:07.392+02:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/opus/camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_opus.opus","url":"https://api.media.ccc.de/public/recordings/68961","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"},{"size":48,"length":3176,"mime_type":"audio/mpeg","language":"eng","filename":"camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2023-08-18T01:51:08.939+02:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/mp3/camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/68960","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"},{"size":126,"length":3176,"mime_type":"video/mp4","language":"eng","filename":"camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2023-08-18T01:36:43.558+02:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/h264-sd/camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_sd.mp4","url":"https://api.media.ccc.de/public/recordings/68946","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"},{"size":403,"length":3176,"mime_type":"video/mp4","language":"eng","filename":"camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2023-08-18T00:45:33.911+02:00","recording_url":"https://cdn.media.ccc.de/events/camp2023/h264-hd/camp2023-57330-eng-Analyzing_Cellular_Basebands_with_FirmWire_hd.mp4","url":"https://api.media.ccc.de/public/recordings/68921","event_url":"https://api.media.ccc.de/public/events/336838bc-dc14-5985-bb40-3ee424a68537","conference_url":"https://api.media.ccc.de/public/conferences/camp2023"}]}