This has been a really cool project to work on. As the MediaTek Baseband uses rather arcane Mips16e2 and DSP instructions, we (Daniel Klischies tinkered with me on this) added tooling support in Ghidra and Qemu to understand and get the Basebands up and running.

I am experimenting with receiving SMS in LTE (via NAS messages, not via IMS), sent via srsRAN. Works fine for Mediatek-based phones. However, Huawei and Samsung modems seem to only receive/forward one message per Minute to the AP (while still sending an RP-ACK). Does sb know why?

Humbled and grateful that our paper Fuzztruction received a Distinguished Paper Award and was the runner up to the Internet Defense Prize USENIX Security #usesec23 Find the paper at usenix.org/conference/use… Thanks Moritz Schloegel, Tobias Scharnowski, Nico Schiller, Thorsten Holz

Excited to announce that we will present our latest work on baseband fuzzing at Black Hat USA this year! Join Dyon and me on a journey of fuzzing layer 2 and finding multiple critical OTA vulnerabilities! More info: blackhat.com/us-24/briefing… See you in August!

🚀 Check out the #RuhrSec 2025 program! 💡 14 expert talks are waiting for you. 🎟️ Don’t miss out—get your ticket now and join us! 👉 ruhrsec.de/2025/tickets.h… #itsecurity #itsicherheit #cybersecurity #cybersicherheit #itsecurityconference #bochum #NRW

I gave an introductory talk on baseband security, focusing on root-causes of vulnerabilities, at this year's RuhrSec – IT Security Conference conference. Recording now available: youtube.com/watch?v=APByR2…

Our OffensiveCon talk on stateful baseband emulation (and how improper string handling led to baseband RCE) is available on YouTube: youtu.be/zoAITq7jUM8. It has been a pleasure; awesome conference, brilliant people. Slides and paper: danielklischies.net/research/baseb…