Abstract:In modern mobile devices, baseband is an integral component running on top of cellular processors to handle crucial radio communications. However, recent research reveals significant vulnerabilities in these basebands, posing serious security risks like remote code execution. Yet, effectively scrutinizing basebands remains a daunting task, as they run closed-source and proprietary software on vendor-specific chipsets. Existing analysis methods are limited by their dependence on manual processes and heuristic approaches, reducing their scalability. This paper introduces a novel approach to unveil security issues in basebands from a unique perspective: to uncover vendor-specific baseband commands from the Radio Interface Layer (RIL), a hardware abstraction layer interfacing with basebands. To demonstrate this concept, we have designed and developed BaseMirror, a static binary analysis tool to automatically reverse engineer baseband commands from vendor-specific RIL binaries. It utilizes a bidirectional taint analysis algorithm to adeptly identify baseband commands from an enhanced control flow graph enriched with reconstructed virtual function calls. Our methodology has been applied to 28 vendor RIL libraries, encompassing a wide range of Samsung Exynos smartphone models on the market. Remarkably, BaseMirror has uncovered 873 unique baseband commands undisclosed to the public. Based on these results, we develop an automated attack discovery framework to successfully derive and validate 8 zero-day vulnerabilities that trigger denial of cellular service and arbitrary file access on a Samsung Galaxy A53 device. These findings have been reported and confirmed by Samsung and a bug bounty was awarded to us.

A Method to Export Baseband Tracing Data in Android System

Implementation of Remote Audio Acquisition System Based on Android Intelligent Mobile Terminal

Remote Data Acquisition System Based on SMS

New mobile medical system mode based on smart phone

Design of a Household ECG Based on Virtual Instrument Technology

THE DESIGN AND IMPLEMENTATION OF A WIRELESS DATA ACQUISITION/TRANSMITTING SYSTEM FOR EURO-BALISE

[Design of the Mobile ECG Monitoring System Based on Android 4.3].

Long-range Data Acquisition Based on Bluetooth Technology and GSM

BaseMirror: Automatic Reverse Engineering of Baseband Commands from Android's Radio Interface Layer

An Android-based distributed test data acquisition intelligent system for mobile network optimization

Design and implementation of real-time location monitoring system based on Android and SIM900A module

Design of Inquiry Experiment of Spectrum Analyzer Based on Android

Android Client for Dynamic ECG Monitoring System Based on BLE

Android Bluetooth Multi-Source Signal Acquisition for Multi-Parameter Health Monitoring Devices.

Design and implementation of ECG monitor integrate dinsmart mobile phone

Remote medical monitoring system based on Android

Design of Remote Monitoring System Based on Androids System for Die Casting Workshop

Non-Invasive Glucose Measuring Apparatus of the DSP and Android Software System Design

Design of GPS base-band processing platform based on FPGA and ARM

The Implementation of a High-efficiency SMS Query Software Based on Android

TraSt: A Traffic Statistic Framework for Evaluating 3G Charging System and Smart Phone Applications