Catch You Cause I Can: Busting Rogue Base Stations using CellGuard and the Apple Cell Location Database

Mobile phones connect to the Internet and receive phone calls using a cellular baseband chip. Basebands pose a substantial attack surface, as they do not only process but also decrypt personal data. Cellular attackers usually force a phone to connect with a, e.g., to record identity information and locations, intercept or manipulate traffic, or execute arbitrary code by exploiting vulnerabilities in the baseband stack. s are stealthy, as smartphones attempt to connect to nearby base stations and do not display any indicators of compromise to the user. While their detection with Software-defined Radios (SDRs) is possible, usability and scalability are limited.

We research and expose the baseband interface on recent iPhones for Intel and Qualcomm chips to detect attacks. We integrate these findings into a user-friendly app called CellGuard. Detection even works on non-jailbroken iPhones with the latest security updates and Lockdown mode. We enhance detection by utilizing Apple’s internal database with highly accurate cell tower information and in-depth reverse engineering of Apple’s baseband interface protocols to find further indicators of compromise. During multiple weeks of evaluation, we collect data on various devices using CellGuard and evaluate the results, along with measurements from our own setup. Our baseband analysis framework BaseTrace will be helpful beyond detection, as it can interact with the baseband and decode any management information exchanged, including satellite communication in the iPhone 15.