Lukas Arnold

@lukasarnld
196 Followers
260 Following
28 Posts
Researching iOS' Cellular Protocol Stack @ SEEMOO | Studying CS @ TU Darmstadt
homepagehttps://lukasarnold.de

Do you know where your child is?
Are you sure?

Come join me explore the security of children's smartwatches (including evil witches, clothespins, and the secret to teleportation)
Tomorrow / Monday at #39c3 and online, 13:50 Hall Zero.

seemoo.de/s/c3-xplora

I just published the slides of my #OBTS v8.0 talk about Apple's #C1 baseband. Our C1 #binja loader is now available on GitHub, and you can find a recording on YouTube.

https://lukasarnold.de/posts/obtsv8-talk/

OBTS v8.0: Diving into C1

Learn more about my talk “What’s at the Bottom of the Sea, One Baseband? - Diving into the C1” at eight edition of the Objective by the Sea conference.

Lukas Arnold
Thanks for joining my #OBTSv8 talk about Apple's novel #C1 & #C1X basebands. I'm glad to be back at this awesome conference. We'll release the slides and tooling in the coming days.

I‘m glad to be back at #OBTS v8.0 with a talk about Apple‘s #C1 baseband and carrier profiles

https://objectivebythesea.org/v8/talks.html#Speaker_14

#OBTS v8.0: Talks

Conference Talks

The Apple Watch has a closed down ecosystem, only compatible with the iPhone. @trusted_device reverse engineered its interfaces and opened it up for compatibility with Android! ✨ WatchWitch ✨ allows you using your Apple Watch ⌚ on Android devices, interpreting your health data, answering messages on the Watch and more.

Demo video: https://www.youtube.com/watch?v=dHz8NHMhtLY
Read the full paper: https://arxiv.org/abs/2507.07210

Very interesting applied security research into the #GSMA #eSIM universe, specfically the use of the JavaCard VM with its questionable security architecture depending on an off-card bytecode verifier in the context of the eUICC which inherently contains eSIM profiles of different [competing] mobile operators, each of which can install arbitrary Java applets into the same eUICC. #GSM #3GPP #cellular #simcards
https://security-explorations.com/esim-security.html
Security Explorations - eSIM security

We've released CellGuard 1.6.0, our iOS app, to make use of the iPhone's internal baseband communication. The update enhances support for dual SIM, adds new #C1 packet types, automatic navigation to sysdiagnoses, and much more.

Install CellGuard with TestFlight or download the special build for jailbroken devices on our website.
https://cellguard.seemoo.de/docs/changelog/

Changelog

Changelog # 1.6.0 # CellGuard now supports dual SIM setups. When two SIM cards are activated simultaneously, the app can distinguish between their connected cells and packets. We’re working on extracting even more useful information from baseband packets in the future. This version includes breaking changes for our database structure. Once you upgrade to 1.6.0, you cannot downgrade to older builds. We recommend creating a backup (Settings → Advanced Settings → Export Data) before upgrading. If you use a jailbroken iPhone, you also have to update the associated CapturePacketsTweak and install the new RotateKeysDaemon. However, you can uninstall the CaptureCellsTweak as it is no longer required.

CellGuard
How Roaming Agreements Enable 5G MitM Attacks

media.ccc.de

Jiska's first lighting talk at #38c3 will show you how to get started with CellGuard to detect fake base stations

https://chaos.social/@jiska/113726897436942989

jiska 🦄:fairydust: (@[email protected])

I will give two lightning talks at #38c3 🎉 Both on day 3, stage Huff, around 11:30am. Detecting Fake Base Stations with CellGuard on iOS 📶 https://cfp.cccv.de/38c3-lightningtalks/talk/8RRHKT/ iOS Inactivity Reboot 📲 https://cfp.cccv.de/38c3-lightningtalks/talk/B83MXJ/

chaos.social
You can find the recording of my #OBTS talk about iPhone basebands and Apple Location Services on YouTube: https://youtu.be/DqOOggWDtes
#OBTS v7: Unraveling the iPhone’s Baseband Architecture to Defend Against Cellular Attacks. L Arnold

YouTube