DEMO: Recent Advancements in Detecting Cellular Attacks with CellGuard

Abstract

A viable remote attack surface of smartphones is the baseband chip, which handles the communication with cellular networks. One attack that is often conducted, e.g., to track users, is the deployment of Rogue Base Stations (RBSs). We built and actively maintain CellGuard, an iOS app that analyzes the interaction of an iPhone with its baseband chip to detect whether the phone connects to an RBS. In this demo, we showcase CellGuard's base functionality of dissecting baseband communication packets and assessing nearby cells for trustworthiness, as well as recent developments. We present the latest changes to the app, including support for Apple's new C1 and C1X baseband chips, architectural improvements, user interface enhancements, and additional notifications for suspicious baseband activity.