Exploring Unanticipated Functionality in Cellular Devices and Networks

Telecommunication networks form the backbone of our connected society, enabling global voice and data communication. Yet, beneath their seamless operation lies a complex interplay of signaling protocols, legacy systems, and evolving technologies that have, over the decades, exposed both opportunities for innovation and significant security challenges. While these networks have changed over the past 50 years and complexity has migrated outwards to devices, one enduring challenge has been a lack of accessibility. In this talk, we will discuss some of our recent efforts to better understand functionality on mobile devices by examining command sets [3] and processors [2]. We also look at security assessment techniques and how they can expose vulnerabilities in core cellular infrastructure. A central focus of this talk is the application of fuzz testing-a powerful technique for discovering implementation flaws and specification ambiguities. Fuzzing involves generating random or mutated inputs and injecting them into target systems to observe unusual behaviors or crashes. In the context of telecom networks, a fuzzing campaign can target the message handling logic, permuting fields such as the Protocol Discriminator or Bearer Capabilities, causing ASN.1 decoders in some devices to fail, leading to denial-of-service or potentially more severe consequences [1]. Through case studies and demonstrations, the talk will reveal how seemingly innocuous fields in call setup messages can destabilize network components or user devices, while also examining how the analysis of messages rather than examining device behavior can lead to the detection of rogue elements [4] in a network.