If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!
Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.
Cellular modems are not only present in smartphones, tablets and laptops, but these days also in many M2M and internet-of-toilets (IoT) applications. Long gone are the days where those modules were GSM/GPRS/EDGE only with ancient ARM7TMDI or ARM926EJS cores and a relatively small-sized firmware in the range of kilobytes to very few megabytes, like on the famous OsmocomBB supported phones.
Modern cellular modems re-use the cellular chipsets of smartphones one or two generations ago, like the MDM9615 used in the iPhone 5. As those chipsets contain plenty of processors and are quite sophisticated SoCs on their own, one can even find (undocumented) Linux or Android in some modems, which of course makes them a very attractive target for further exploration or running your own code inside the modem.
We will give a short overview about the current market of cellular modems, the major chipset suppliers and chipset families and then pick one or two examples and show the methods used for reverse engineering them to a point where they can be used for much more than the AT command or QMI interface officially documented/supported by the manufacturer. This includes the execution of custom code inside modems, as well as protocol tracing of the air-interface. We'll also look at the FOTA (Firmware Update Over The Air) features, and perform a security analysis of our findings.
This talk understands itself following the tradition of various baseband processor related talks at many CCC events of the past decade, including <a href="https://events.ccc.de/congress/2008/Fahrplan/events/3008.en.html">25C3: Anatomy of smartphone hardware</a> and <a href="https://events.ccc.de/congress/2011/Fahrplan/events/4735.en.html">28C3: Reverse-engineering a Qualcomm baseband</a>.
Both speakers (Harald Welte and Holger Freyther) have been working on Free Software related to cellular telephony for more than a decade, including projects like <a href="http://openmoko.org/">Openmoko</a>, <a href="http://openbsc.osmocom.org/">OpenBSC</a>, <a href="http://bb.osmocom.org/">OsmocomBB</a> and many other <a href="http://osmocom.org/">Osmocom</a> projects.