TELCOSEC
LEARNING PATH :: UEBB

Mobile Device &
Baseband Security Analyst

Attack the subscriber device across the application processor, baseband modem, SIM and APN boundaries. This path is for security researchers who need hands-on exploit development against cellular user equipment.

  • 92.5 hours, self-paced online
  • Advanced level

// PATH OVERVIEW

What this learning path covers

This advanced path examines the subscriber attack surface across mobile application processors, UICC smart cards, APN routing boundaries and cellular baseband firmware. You will reverse-engineer baseband images, audit Android telephony stacks, analyse pre-authentication NAS parsers, and exploit lower-layer modem parsers through hands-on labs.

Prerequisites

  • Binary reverse engineering and firmware analysis (ARM/AArch64, Ghidra/IDA/GDB)
  • Cellular protocol architecture (NAS, RRC, ASN.1 PER)
  • Software Defined Radio experience (USRP/BladeRF, srsRAN/Osmocom)
  • Android internals (ADB, binder, HAL/RIL)
  • Smart card protocols and cryptography (APDU, UICC, Milenage)
  • IP packet routing and data bearers (APN, GTP-U)

Credential

No certification of its own

// WHAT YOU WILL LEARN

  • Reverse-engineer cellular baseband firmware and ASN.1/RRC message parsers
  • Audit pre-authentication NAS signalling state machines and AP/baseband shared-memory bridges
  • Analyze USIM file structures, APDU handling and Milenage key derivation
  • Inspect eUICC architecture and Remote SIM Provisioning trust chains
  • Evaluate APN perimeter boundaries and PDP/DNN isolation mechanisms
  • Reverse-engineer Android telephony infrastructure including RIL and diagnostic interfaces
  • Synthesize over-the-air attack scenarios using SDR suites and rogue eNodeB/gNodeB cells

What completing the path earns

This certification validates technical proficiency in reverse-engineering cellular baseband firmware, auditing UICC security controls and discovering memory-corruption vulnerabilities in NAS protocol parsers. Graduates possess the practical capabilities required of an RF and Hardware Security Researcher to execute full-stack subscriber attack-surface assessments across modern user equipment.

Access and pricing

All courses in this path are free on the Recruit plan. Courses are taken on the TelcoSec platform after signing in.

START LEARNING [→] VIEW PLANS