Gateways to Chaos: How We Proved Modems Are Cellular Backdoors
Reveals critical baseband and firmware vulnerabilities in popular cellular modems that allow remote over-the-air exploitation and device takeover.
Summary
The Cellular Baseband Attack Surface
Cellular modems embedded in laptops, routers, and IoT gateways process complex over-the-air radio signaling stacks independently of host operating systems.
Reverse Engineering Modem Firmware
Researchers reverse engineer proprietary baseband RTOS firmware, uncovering memory corruption vulnerabilities in cellular radio resource control (RRC) and SMS message parsing engines.
Over-the-Air Remote Code Execution
Transmitting malformed cellular packets from a software-defined radio base station triggers unauthenticated remote code execution on the modem core, establishing persistent backdoors beneath host OS visibility.
Securing the Cellular Edge
Protecting cellular devices requires modem vendors to implement memory-safe baseband parsers, enforce secure boot on cellular microcontrollers, and isolate baseband buses via hardware IOMMUs.
Related talks
Main Stage·27 min
Edward Warren
Discloses multiple pre-authentication remote code execution and arbitrary SMS vulnerabilities across popular consumer and industrial 4G/5G cellular routers.
Main Stage·21 min
Noam Moshe
Demonstrates remote code execution and edge compromise across Axis enterprise IP cameras, turning surveillance devices into offensive pivot points.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.