Practical Baseband Exploitation


Instructor:  Pedro Ribeiro and Nitay Artenstein
Dates:    June 23 to 26 2025
Capacity:  24 Seats




Baseband exploitation is often considered the cream of the offensive security field. In the last decade, only a handful of such exploits were publicly released. As a result, many researchers view the ability to silently achieve code execution on a victim's device by emulating a GSM (2G), 3G, LTE (4G), or 5G base station as a difficult objective.

In reality, baseband exploitation is not that challenging! By following a simple list of steps, a baseband platform can be quickly unlocked for research, debugging and exploitation.

In this course, students will learn our systematic approach to baseband security research: from setting up a fake base station using SDR and open-source BTS software, to obtaining and analysing mobile phone firmware and crash dumps, modifying BTS code to trigger bugs and deliver a payload, and finally reverse engineering radio protocols, hunting for vulnerabilities and exploiting them.

By the end of this heavily hands-on course, students will become familiar with two extremely common baseband platforms, Shannon and MediaTek, gain the skills to debug these and other baseband platforms, and learn about previously discovered bugs in basebands, and how they have been exploited.

Each student will be provided with a Software Defined Radio (SDR) board to emulate a base station, and a modern mobile phone to serve as a target.


KEY LEARNING OBJECTIVES





AGENDA


Session 1: Introduction, initial analysis and debugging


Introduction to communication processors (CP):




Code extraction and initial analysis:




Understanding baseband Real Time Operating Systems (RTOS):




Debugging:




Session 2: Cellular protocols and static analysis


Introduction to 2G, 3G, 4G and 5G:



Shannon: Static analysis and an architecture overview:



MediaTek: A comparison with Shannon:



Setting up a rogue BTS:



Session 3: Finding bugs in Shannon and MediaTek


2G and 3G sub-protocols:



Vulnerability research in 4G and 5G:



Finding Shannon bugs:



Finding MediaTek bugs:



Session 4: Exploiting a Shannon n-day


Modifying BTS source code code to deliver the exploit payload



Exploit primitives:



Achieving code execution:



Baseband emulation for vulnerability research



Escalating to the Application Processor (AP) and Android - an introduction



Pre-requisites:



Hardware Requirements:



Software Requirements:



Bio

Pedro Ribeiro is a vulnerability researcher and reverse engineer with over 16 years of experience. Pedro has found and exploited hundreds of vulnerabilities in software, hardware and firmware. He has over 160 CVE ID attributed to his name (most of which related to remote code execution vulnerabilities) and has authored over 60 Metasploit modules which have been released publicly. He also regularly competes in Pwn2Own as part of the Flashback Team, winning the coveted Master of Pwn in 2020.

Besides his public vulnerability research activities, he is the founder and director of a penetration testing and reverse engineering consultancy based in London (Agile Information Security), with a variety of clients worldwide.

More information about Pedro's publicly disclosed vulnerabilities can be found at github.com/pedrib/PoC. Flashback Team's YouTube channel can be found at youtube.com/@FlashbackTeam.



Nitay Artenstein is a senior security researcher and the leader of an international research group. He has been a speaker at various security conferences, including Black Hat and Recon, and has conducted training sessions in Linux kernel exploitation and baseband research. He suffers from a severe addiction to IDA Pro (at least until he gets used to Ghidra's GUI), and generally gets a kick out of digging around where he's not supposed to.

To Register

Click here to register.