Automated security analysis of baseband firmware
Various examples are provided related to automated security analysis of baseband firmware. In one example, a system includes a wireless front end and processing circuitry communicatively coupled to the wireless front end and a target device. The processing circuitry can generate mutated packets based upon a device state of the target device; provide the mutated packets for transmission to the target device; receive feedback information from the target device in response to reception of the mutated packets; and identify a firmware flaw associated with the target device in response to the feedback information. In another example, a method includes generating mutated packets based upon a device state of a target device; transmitting the mutated packets to the target device; receiving feedback information from the target device in response to reception of the mutated packets; and identifying a firmware flaw associated with the target device using the feedback information.
1. A system, comprising:
a wireless front end; and
processing circuitry communicatively coupled to the wireless front end and to at least one target device, the processing circuitry configured to:
generate mutated packets based upon a device state of the at least one target device;
provide the mutated packets to the wireless front end for transmission to the at least one target device;
receive feedback information from the at least one target device in response to reception of the mutated packets; and
identify a firmware flaw associated with the at least one target device in response to the feedback information.
2. The system of claim 1 , wherein the wireless front end is a cellular base station.
3. The system of claim 1 , wherein the wireless front end is a software defined radio (SDR).
4. The system of claim 1 , wherein the at least one target device comprises a cellular device.
5. The system of claim 4 , wherein the cellular device is a cellular telephone.
6. The system of claim 1 , wherein the mutated packets are generated by fuzzing GSM or GPRS Layer 3 message frames.
7. The system of claim 1 , wherein the processing circuitry is configured to obtain the device state of the at least one target device prior to generating the mutated packets.
8. The system of claim 1 , wherein the processing circuitry is communicatively coupled to the at least one target device via a wired connection.
9. The system of claim 1 , wherein the feedback information comprises logs, packets or a combination thereof.
10. The system of claim 1 , wherein the processing circuitry comprises a processor and memory, and a security analysis application executed by the processor causes the processing circuitry to generate the mutated packets, provide the mutated packets for transmission, and identify the firmware flaw.
11. A method, comprising:
generating mutated packets based upon a device state of at least one target device;
transmitting the mutated packets to the at least one target device;
receiving feedback information from the at least one target device in response to reception of the mutated packets; and
identifying a firmware flaw associated with the at least one target device based at least in part upon the feedback information.
12. The method of claim 11 , wherein the mutated packets are wirelessly transmitted by a cellular base station.
13. The method of claim 11 , wherein the mutated packets are transmitted by a software defined radio (SDR).
14. The method of claim 11 , wherein the at least one target device comprises a cellular user device.
15. The method of claim 11 , wherein the mutated packets are generated by fuzzing GSM or GPRS Layer 3 message frames.
16. The method of claim 11 , wherein the device state is determined prior to generating the mutated packets.
17. The method of claim 11 , wherein the feedback information from the at least one target device is received via a wired connection with the at least one target device.
18. The method of claim 11 , wherein the feedback information comprises logs, packets or a combination thereof.