Overcoming State - Finding Baseband Vulnerabilities by Fuzzing Layer-2

Explore a 36-minute Black Hat conference talk that delves into discovering baseband vulnerabilities in mobile phones through Layer-2 fuzzing techniques. Learn how researchers approached GSM attack surfaces by developing fuzzing harnesses within the FirmWire framework, leading to the discovery of critical security flaws in modern Samsung and Google phones. Understand the methodology behind emulating baseband firmware, analyzing Layer-2 data frames, and how this approach simultaneously tested Layer-3 tasks. Follow along as the speakers detail their findings, including an in-depth analysis of two vulnerabilities, modern baseband defenses, and their process of verifying zero-day vulnerabilities over-the-air in recent smartphones, including a flagship device just one week after launch. Gain insights from independent researcher Dyon Goos and University of Birmingham Assistant Professor Marius Muench about the continuing relevance of GSM stacks in current mobile devices and their associated security implications.