2 years ago I did a PoC to run #rust 🦀 in the #pixel modem
Today it shipped in millions of devices!
They grow up to fast! 🥲
security.googleblog.com/2026/04/brin...
#rust #security #smartphone #baseband
Today it shipped in millions of devices!
They grow up to fast! 🥲
security.googleblog.com/2026/04/brin...
#rust #security #smartphone #baseband
Bringing Rust to the Pixel Baseband
Posted by Jiacheng Lu, Software Engineer, Google Pixel Team Google is continuously advancing the security of Pixel devices. We have been f...
security.googleblog.com
April 11, 2026 at 8:08 PM
2 years ago I did a PoC to run #rust 🦀 in the #pixel modem
Today it shipped in millions of devices!
They grow up to fast! 🥲
security.googleblog.com/2026/04/brin...
#rust #security #smartphone #baseband
Today it shipped in millions of devices!
They grow up to fast! 🥲
security.googleblog.com/2026/04/brin...
#rust #security #smartphone #baseband
Very interesting - these devices require a separate wifi hotspot. Mobile phone cellular modem baseband/firmware is notoriously fragile security-wise and absolutely something peer states have 0days in. WiFi hotspot never sees any plaintext, even if you hacked it. Clever. bsky.app/profile/forb...
March 24, 2025 at 11:08 PM
Very interesting - these devices require a separate wifi hotspot. Mobile phone cellular modem baseband/firmware is notoriously fragile security-wise and absolutely something peer states have 0days in. WiFi hotspot never sees any plaintext, even if you hacked it. Clever. bsky.app/profile/forb...
Can somone tell Why about this
March 6, 2026 at 2:19 PM
Can somone tell Why about this
It's pretty wild that there's two OS's on this baseband chip. One is Android and the other is QuRTOS.
So in total this router has 3 OS's running simultaneously 🖤
So in total this router has 3 OS's running simultaneously 🖤
December 1, 2024 at 5:40 PM
It's pretty wild that there's two OS's on this baseband chip. One is Android and the other is QuRTOS.
So in total this router has 3 OS's running simultaneously 🖤
So in total this router has 3 OS's running simultaneously 🖤
Building with drone-runner 17.8.3 (690ce25c)
on baseband-trusted0 udQR4Z66, system ID: s_09d6b4ed0797.
on baseband-trusted0 udQR4Z66, system ID: s_09d6b4ed0797.
February 22, 2025 at 3:11 AM
Building with drone-runner 17.8.3 (690ce25c)
on baseband-trusted0 udQR4Z66, system ID: s_09d6b4ed0797.
on baseband-trusted0 udQR4Z66, system ID: s_09d6b4ed0797.
The Pixel 10 smartphones released last year are the first phones to use Rust for its modem firmware in an attempt to narrow the phone's baseband attack surface
security.googleblog.com/2026/04/brin...
security.googleblog.com/2026/04/brin...
Bringing Rust to the Pixel Baseband
Posted by Jiacheng Lu, Software Engineer, Google Pixel Team Google is continuously advancing the security of Pixel devices. We have been f...
security.googleblog.com
April 12, 2026 at 11:42 AM
The Pixel 10 smartphones released last year are the first phones to use Rust for its modem firmware in an attempt to narrow the phone's baseband attack surface
security.googleblog.com/2026/04/brin...
security.googleblog.com/2026/04/brin...
"Why does my car need a cellular baseband?" remains the number 1 question for the car industry in the 21st century.
June 25, 2026 at 3:34 PM
"Why does my car need a cellular baseband?" remains the number 1 question for the car industry in the 21st century.
Our OffensiveCon talk on stateful baseband emulation (and how improper string handling led to baseband RCE) is available on YouTube: youtu.be/zoAITq7jUM8. It has been a pleasure; awesome conference, brilliant people. Slides and paper: www.danielklischies.net/research/bas...
OffensiveCon25 - Daniel Klischies and David Hirsch
YouTube video by OffensiveCon
youtu.be
May 28, 2025 at 11:21 AM
Our OffensiveCon talk on stateful baseband emulation (and how improper string handling led to baseband RCE) is available on YouTube: youtu.be/zoAITq7jUM8. It has been a pleasure; awesome conference, brilliant people. Slides and paper: www.danielklischies.net/research/bas...
they're only properly called video games if you play them over baseband composite mustard jack video
December 28, 2024 at 2:01 PM
they're only properly called video games if you play them over baseband composite mustard jack video
your phone could be able to talk and text with other phones outside of cellular coverage. the tech is there with 5G NR PC5 interface for "sidelinking," and was there with LTE too. but handset and baseband manufacturers have grown fat and lazy suckling at the consumer tit, and all innovation is gone
September 4, 2025 at 4:32 PM
your phone could be able to talk and text with other phones outside of cellular coverage. the tech is there with 5G NR PC5 interface for "sidelinking," and was there with LTE too. but handset and baseband manufacturers have grown fat and lazy suckling at the consumer tit, and all innovation is gone
There are very strange cellular radio chips designed for use with Windows including both an actual cellular baseband running typical baseband firmware and a CPU next to it running a proprietary fork of an ancient Android version. They do this to use Android drivers for Windows.
April 27, 2025 at 8:29 PM
There are very strange cellular radio chips designed for use with Windows including both an actual cellular baseband running typical baseband firmware and a CPU next to it running a proprietary fork of an ancient Android version. They do this to use Android drivers for Windows.
Hackers could spy on cellphone users by abusing 5G baseband flaws, researchers say
Hackers could spy on cellphone users by abusing 5G baseband flaws, researchers say
Security researchers found a dozen vulnerabilities in 5G baseband chips found in phones made by Google, OPPO, OnePlus, Motorola, and Samsung.
© 2024 TechCrunch. All rights reserved. For personal use only.
tcrn.ch
August 7, 2024 at 3:34 PM
Hackers could spy on cellphone users by abusing 5G baseband flaws, researchers say
Can an alternative mobile OS ever break out as long as modern baseband modems and camera stacks remain locked down? The open question is whether projects like Nura can ever cross into practical daily-driver territory without vendor cooperation. #tech 4/4
September 28, 2026 at 6:00 AM
Can an alternative mobile OS ever break out as long as modern baseband modems and camera stacks remain locked down? The open question is whether projects like Nura can ever cross into practical daily-driver territory without vendor cooperation. #tech 4/4
Vigilant’s Amat Cama speaking about baseband hacking at offensivecon
May 19, 2023 at 4:26 PM
Vigilant’s Amat Cama speaking about baseband hacking at offensivecon
Hängt von der Software (Betriebssystem, Treiber fürs Baseband Chipset) ab, also letzten Endes vom Hersteller.
Ich weiß, das zumindest Nokia Handsets damals™ weiter gefunkt haben, wenn sie "aus" waren.
Kein Akku = kein Funk. Kein Handy = keine Position.
Ich weiß, das zumindest Nokia Handsets damals™ weiter gefunkt haben, wenn sie "aus" waren.
Kein Akku = kein Funk. Kein Handy = keine Position.
January 30, 2025 at 1:06 PM
Hängt von der Software (Betriebssystem, Treiber fürs Baseband Chipset) ab, also letzten Endes vom Hersteller.
Ich weiß, das zumindest Nokia Handsets damals™ weiter gefunkt haben, wenn sie "aus" waren.
Kein Akku = kein Funk. Kein Handy = keine Position.
Ich weiß, das zumindest Nokia Handsets damals™ weiter gefunkt haben, wenn sie "aus" waren.
Kein Akku = kein Funk. Kein Handy = keine Position.
Yay, we got a student who is gonna research github.com/FirmWire/Fir...
GitHub - FirmWire/FirmWire: FirmWire is a full-system baseband firmware emulation platform for fuzzing, debugging, and root-cause analysis of smartphone baseband firmwares
FirmWire is a full-system baseband firmware emulation platform for fuzzing, debugging, and root-cause analysis of smartphone baseband firmwares - FirmWire/FirmWire
github.com
November 28, 2024 at 8:05 PM
Yay, we got a student who is gonna research github.com/FirmWire/Fir...
That's not what this says at all, though.
This is saying that they're not _banning_ the use of AI tooling, not that they're _mandating_ it.
(Also, most contributors DO depend on closed source in some places. Baseboard/baseband controllers, processor microcode, etc. is usually proprietary code.)
This is saying that they're not _banning_ the use of AI tooling, not that they're _mandating_ it.
(Also, most contributors DO depend on closed source in some places. Baseboard/baseband controllers, processor microcode, etc. is usually proprietary code.)
July 16, 2026 at 1:10 PM
That's not what this says at all, though.
This is saying that they're not _banning_ the use of AI tooling, not that they're _mandating_ it.
(Also, most contributors DO depend on closed source in some places. Baseboard/baseband controllers, processor microcode, etc. is usually proprietary code.)
This is saying that they're not _banning_ the use of AI tooling, not that they're _mandating_ it.
(Also, most contributors DO depend on closed source in some places. Baseboard/baseband controllers, processor microcode, etc. is usually proprietary code.)
Pictured:
A female RAF Cyberspace Engineering Technician testing the 'SNAPPER' supporting Operation (Op) SHADER. The SNAPPER is a baseband/IP communication devices, connected to the Vislink Mantis satellite terminal
A female RAF Cyberspace Engineering Technician testing the 'SNAPPER' supporting Operation (Op) SHADER. The SNAPPER is a baseband/IP communication devices, connected to the Vislink Mantis satellite terminal
September 9, 2026 at 9:00 AM
Pictured:
A female RAF Cyberspace Engineering Technician testing the 'SNAPPER' supporting Operation (Op) SHADER. The SNAPPER is a baseband/IP communication devices, connected to the Vislink Mantis satellite terminal
A female RAF Cyberspace Engineering Technician testing the 'SNAPPER' supporting Operation (Op) SHADER. The SNAPPER is a baseband/IP communication devices, connected to the Vislink Mantis satellite terminal
Leave your phone ON at HOME
Your phone's baseband IC may still respond to pings even when off or in airplane mode. Even if it doesn't respond when off, SEEING the phone go dark near the protest could help infer participation.
If you MUST have a phone at the protest, use a properly acquired burner
Your phone's baseband IC may still respond to pings even when off or in airplane mode. Even if it doesn't respond when off, SEEING the phone go dark near the protest could help infer participation.
If you MUST have a phone at the protest, use a properly acquired burner
February 3, 2025 at 7:29 PM
Leave your phone ON at HOME
Your phone's baseband IC may still respond to pings even when off or in airplane mode. Even if it doesn't respond when off, SEEING the phone go dark near the protest could help infer participation.
If you MUST have a phone at the protest, use a properly acquired burner
Your phone's baseband IC may still respond to pings even when off or in airplane mode. Even if it doesn't respond when off, SEEING the phone go dark near the protest could help infer participation.
If you MUST have a phone at the protest, use a properly acquired burner
📢 Excited to announce that the results on BaseBridge, our project on improving cellular baseband emulation, are going public this week. Dyon will present at IEEE S&P on Monday 3pm, while David and I will be on stage at @offensivecon.bsky.social on Saturday 11am with even more details! 1/6
May 11, 2025 at 10:23 AM
📢 Excited to announce that the results on BaseBridge, our project on improving cellular baseband emulation, are going public this week. Dyon will present at IEEE S&P on Monday 3pm, while David and I will be on stage at @offensivecon.bsky.social on Saturday 11am with even more details! 1/6
ISP's network (BGP routing through who knows how many autonomous systems) -> hits a Tailscale DERP relay server -> cell tower -> your carrier's backhaul network -> more routing -> another cell tower -> radio waves -> your phone's antenna receives them -> baseband processor demodulates the signal
April 5, 2026 at 4:49 AM
ISP's network (BGP routing through who knows how many autonomous systems) -> hits a Tailscale DERP relay server -> cell tower -> your carrier's backhaul network -> more routing -> another cell tower -> radio waves -> your phone's antenna receives them -> baseband processor demodulates the signal
« […] research focused on the baseband has highlighted a consistent lack of exploit mitigations in firmware. […] This suggests baseband bugs may potentially be abundant and/or not too complex to find and exploit, and their prominent inclusion in the marketplace demonstrates that they are useful. »
November 20, 2024 at 8:28 PM
« […] research focused on the baseband has highlighted a consistent lack of exploit mitigations in firmware. […] This suggests baseband bugs may potentially be abundant and/or not too complex to find and exploit, and their prominent inclusion in the marketplace demonstrates that they are useful. »
I just published the slides of my #OBTS v8.0 talk about Apple's #C1 baseband. Our C1 #binja loader is now available on GitHub, and you can find a recording on YouTube.
lukasarnold.de/posts/obtsv8...
lukasarnold.de/posts/obtsv8...
OBTS v8.0: Diving into C1
Learn more about my talk “What’s at the Bottom of the Sea, One Baseband? - Diving into the C1” at eight edition of the Objective by the Sea conference.
lukasarnold.de
October 27, 2025 at 3:48 PM
I just published the slides of my #OBTS v8.0 talk about Apple's #C1 baseband. Our C1 #binja loader is now available on GitHub, and you can find a recording on YouTube.
lukasarnold.de/posts/obtsv8...
lukasarnold.de/posts/obtsv8...
i bought an iphone 6 and an iphone 7 when i was younger and they both eventually got faulty baseband chips. the iphone 7 also had the audio ic issue that wasn’t eligible for a warranty replacement like the baseband ones
February 13, 2026 at 2:04 AM
i bought an iphone 6 and an iphone 7 when i was younger and they both eventually got faulty baseband chips. the iphone 7 also had the audio ic issue that wasn’t eligible for a warranty replacement like the baseband ones
Really enjoyed speaking at the inaugural edition of @re-verse.io!
You can find Tomasz' and my slides on tricks with SIMs and interposers here: tinyurl.com/reverse25-si...
You can find Tomasz' and my slides on tricks with SIMs and interposers here: tinyurl.com/reverse25-si...
March 5, 2025 at 5:41 PM
Really enjoyed speaking at the inaugural edition of @re-verse.io!
You can find Tomasz' and my slides on tricks with SIMs and interposers here: tinyurl.com/reverse25-si...
You can find Tomasz' and my slides on tricks with SIMs and interposers here: tinyurl.com/reverse25-si...