Cellular Network Reconnaissance & Baseband Security

While mobile OS security has improved, the cellular interface remains a significant blind spot. Every mobile device communicates over the air using complex protocols (GSM, LTE, 5G) that are often poorly implemented or inherently vulnerable. Our network reconnaissance services provide a deep audit of how your devices interact with the cellular world.

We specialize in identifying 'Invisible' threats like IMSI catchers (often called Stingrays), which impersonate legitimate cell towers to intercept traffic, track locations, or downgrade encryption. For high-risk individuals and organizations, understanding the security of the radio environment is critical.

Our team of radio frequency (RF) experts uses Software Defined Radio (SDR) and custom baseband analysis tools to monitor for anomalies in the cellular handshake that indicate interception or surveillance.

Modern IMSI catchers have evolved to be nearly undetectable to standard mobile phones. They exploit the fact that phones will naturally connect to the strongest available signal and that 2G/3G protocols lack mutual authentication.

We deploy specialized sensors that monitor the local radio spectrum for signature 'false base station' behaviors, such as:

1. Silent Downgrade: Forcing a 4G/5G phone down to an unencrypted 2G connection.

2. Abnormal Cell Selection: Towers that lack the standard neighbor lists or have suspicious LAC/CID configurations.

3. Paging Anomalies: Unusual patterns in how the network identifies and 'calls' devices.

We provide real-time alerting and historical mapping of cellular interception threats in specific geographic areas.

The baseband processor (the chip that handles radio communication) is a separate computer inside your phone with its own proprietary OS. It often has direct access to the phone's RAM and peripherals via DMA (Direct Memory Access).

We perform deep audits of baseband implementations (Qualcomm, Samsung Shannon, MediaTek) to find remote code execution (RCE) vulnerabilities. A successful baseband exploit can allow an attacker to compromise the entire phone over-the-air, without the user ever clicking a link.

Our services include the reverse engineering of baseband firmware and the fuzzing of protocol stacks (RRC, NAS, MAC) to identify vulnerabilities before they are exploited in the wild.

Beyond the local radio link, the global cellular backbone (SS7 for 2G/3G and Diameter for 4G/5G) is riddled with decades-old vulnerabilities. These allow attackers to track your location anywhere in the world or intercept SMS 2FA codes just by knowing your phone number.

We perform audits of your organization's cellular identity security, testing if your numbers are vulnerable to location tracking or SMS interception via international carrier roaming interconnects.

As we transition to 5G, new security features like encrypted IMSIs (SUCI) are being introduced, but new vulnerabilities are also emerging. Our team remains at the forefront of cellular security research, ensuring your communications remain private in an increasingly monitored spectrum.