FirmWire: Transparent Dynamic Analysis for Cellular Baseband Firmware

—Smartphones today leverage baseband processors to implement the multitude of cellular protocols. Basebands execute firmware, which is responsible for decoding hundreds of message types developed from three decades of cellular standards. Despite its large over-the-air attack surface, baseband firmware has received little security analysis. Previous work mostly analyzed only a handful of firmware images from a few device models, but often relied heavily on time-consuming manual static analysis or single-function fuzzing. To fill this gap, we present F IRM W IRE , the first full-system emulation platform for baseband processors that executes unmod-ified baseband binary firmware. F IRM W IRE provides baseband-specific APIs to easily add support for new vendors, firmware images, and security analyses. To demonstrate F IRM W IRE ’s scalability, we support 213 firmware images across 2 vendors and 9 phone models, allowing them to be executed and tested. With these images, F IRM W IRE automatically discovers and bridges internal baseband APIs, allowing protocol messages to be injected with ease. Using these entry points, we selected the LTE and GSM protocols for fuzzing and discovered 7 pre-authentication memory corruptions that could lead to remote code execution – 4 of which were previously unknown. We reproduced these crashes over-the-air on real devices, proving F IRM W IRE ’s emulation accuracy. F IRM W IRE is a scalable platform for baseband