BaseSAFE：基带SANIZITITED FUZZZING通过仿真
BaseSAFE: Baseband SAnitized Fuzzing through Emulation
摘要：
流氓基站是一种有效的攻击媒介。蜂窝基带代表了智能手机安全的关键部分：它们甚至在认证之前就解析了大量数据。因此，它们可以为攻击者提供一种非常隐蔽的方式来收集有关已拨打电话的信息，甚至可以通过无线方式升级到主操作系统。在本文中，我们讨论了一种新的蜂窝模糊框架，旨在帮助安全研究人员发现蜂窝基带和类似的嵌入式系统中的关键错误。BaseSAFE允许对蜂窝基带进行部分重新托管，以便在设备外进行快速仪表化模糊检测，即使是闭源固件blob也是如此。BaseSAFE的清理drop-in分配器，能够快速发现基于堆的缓冲区溢出。使用我们的概念验证工具，我们模糊了各种解析器的核心RTOS为基础的联发科蜂窝基带，可从流氓基站访问。仿真器仪器经过高度优化，对于我们的复杂测试用例，每个核心上的执行速度达到每秒数百次，总共大约每秒15 k个测试用例。此外，我们还讨论了基带调制解调器的攻击向量。据我们所知，这是第一次使用基于仿真的模糊技术对商用蜂窝基带进行安全测试。BaseSAFE的大多数工具和方法也适用于其他低级内核和固件。使用BaseSAFE，我们能够发现内存损坏，包括堆越界写入，使用我们的概念验证模糊线束在联发科蜂窝基带。BaseSAFE、harness和大量LTE信令消息测试用例将在本文发布后开源发布。
英文摘要：
Rogue base stations are an effective attack vector. Cellular basebands represent a critical part of the smartphone's security: they parse large amounts of data even before authentication. They can, therefore, grant an attacker a very stealthy way to gather information about calls placed and even to escalate to the main operating system, over-the-air. In this paper, we discuss a novel cellular fuzzing framework that aims to help security researchers find critical bugs in cellular basebands and similar embedded systems. BaseSAFE allows partial rehosting of cellular basebands for fast instrumented fuzzing off-device, even for closed-source firmware blobs. BaseSAFE's sanitizing drop-in allocator, enables spotting heap-based buffer-overflows quickly. Using our proof-of-concept harness, we fuzzed various parsers of the Nucleus RTOS-based MediaTek cellular baseband that are accessible from rogue base stations. The emulator instrumentation is highly optimized, reaching hundreds of executions per second on each core for our complex test case, around 15k test-cases per second in total. Furthermore, we discuss attack vectors for baseband modems. To the best of our knowledge, this is the first use of emulation-based fuzzing for security testing of commercial cellular basebands. Most of the tooling and approaches of BaseSAFE are also applicable for other low-level kernels and firmware. Using BaseSAFE, we were able to find memory corruptions including heap out-of-bounds writes using our proof-of-concept fuzzing harness in the MediaTek cellular baseband. BaseSAFE, the harness, and a large collection of LTE signaling message test cases will be released open-source upon publication of this paper.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
