ARIstoteles -- Dissecting Apple's Baseband Interface

• URL: http://arxiv.org/abs/2604.23457v1
• Date: Sat, 25 Apr 2026 22:11:50 GMT
• Title: ARIstoteles -- Dissecting Apple's Baseband Interface
• Abstract summary: We reverse-engineer and fuzz-test the Apple Remote Invocation (ARI) interface on iOS.<n>Our Ghidra scripts automatically generate a Wireshark dissector, called ARIstoteles, by parsing closed-source iOS libraries.<n>By releasing ARIstoteles open-source, we also aim to facilitate similar research in the future.
• Score: 8.84250777643946
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Wireless chips and interfaces expose a substantial remote attack surface. As of today, most cellular baseband security research is performed on the Android ecosystem, leaving a huge gap on Apple devices. With iOS jailbreaks, last-generation wireless chips become fairly accessible for performance and security research. Yet, iPhones were never intended to be used as a research platform, and chips and interfaces are undocumented. One protocol to interface with such chips is Apple Remote Invocation (ARI), which interacts with the central phone component CommCenter and multiple user-space daemons, thereby posing a Remote Code Execution (RCE) attack surface. We are the first to reverse-engineer and fuzz-test the ARI interface on iOS. Our Ghidra scripts automatically generate a Wireshark dissector, called ARIstoteles, by parsing closed-source iOS libraries for this undocumented protocol. Moreover, we compare the quality of the dissector to fully-automated approaches based on static trace analysis. Finally, we fuzz the ARI interface based on our reverse-engineering results. The fuzzing results indicate that ARI does not only lack public security research but also has not been well-tested by Apple. By releasing ARIstoteles open-source, we also aim to facilitate similar research in the future.

Related papers

• Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers [5.464858737467414]
  Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE)<n>This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices.<n>We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware.
  arXiv  Detail & Related papers  (2026-06-19T03:32:52Z)
• Too Private to Tell: Practical Token Theft Attacks on Apple Intelligence [9.964425648424017]
  Apple Intelligence is a generative AI (GenAI) service provided by Apple on its devices.<n>We present our investigation into this token issuance mechanism with a goal to reveal possible vulnerabilities.<n>Specifically, we present the first practical cross-device token replay attack against Apple Intelligence.
  arXiv  Detail & Related papers  (2026-04-17T02:32:29Z)
• WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch [50.89778047875175]
  We reverse-engineer the Apple Watch's wireless protocols.<n>With WatchWitch, we break out of Apple's walled garden.<n>We thus pave the way for more consumer choice in the smartwatch ecosystem.
  arXiv  Detail & Related papers  (2025-07-09T18:33:58Z)
• BaseMirror: Automatic Reverse Engineering of Baseband Commands from Android's Radio Interface Layer [34.9710368289623]
  This paper introduces a novel approach to unveil security issues in basebands from a unique perspective. We have designed and developed BaseMirror, a static binary analysis tool to automatically reverse engineer baseband commands from vendor-specific RIL binaries. Our methodology has been applied to 28 vendor RIL libraries, encompassing a wide range of Samsung Exynos smartphone models on the market.
  arXiv  Detail & Related papers  (2024-08-31T15:14:56Z)
• WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models [66.34505141027624]
  We introduce WildTeaming, an automatic LLM safety red-teaming framework that mines in-the-wild user-chatbot interactions to discover 5.7K unique clusters of novel jailbreak tactics. WildTeaming reveals previously unidentified vulnerabilities of frontier LLMs, resulting in up to 4.6x more diverse and successful adversarial attacks.
  arXiv  Detail & Related papers  (2024-06-26T17:31:22Z)
• Weak-to-Strong Jailbreaking on Large Language Models [92.52448762164926]
  Large language models (LLMs) are vulnerable to jailbreak attacks.<n>Existing jailbreaking methods are computationally costly.<n>We propose the weak-to-strong jailbreaking attack.
  arXiv  Detail & Related papers  (2024-01-30T18:48:37Z)
• Evil from Within: Machine Learning Backdoors through Hardware Trojans [51.81518799463544]
  Backdoors pose a serious threat to machine learning, as they can compromise the integrity of security-critical systems, such as self-driving cars.<n>We introduce a backdoor attack that completely resides within a common hardware accelerator for machine learning.<n>We demonstrate the practical feasibility of our attack by implanting our hardware trojan into the Xilinx Vitis AI DPU.
  arXiv  Detail & Related papers  (2023-04-17T16:24:48Z)
• AirGuard -- Protecting Android Users From Stalking Attacks By Apple Find My Devices [78.08346367878578]
  We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices.
  arXiv  Detail & Related papers  (2022-02-23T22:31:28Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.