RadioGuard: Zero-Trust Cellular Defense Sub-Service for Android

RadioGuard is an open-source, production-ready Android security application and background sub-service. It actively detects rogue cell towers (IMSI-catchers / Cell-Site Simulators / SMS Blasters), identifies hostile 2G/4G cellular manipulation, and deploys cryptographic safe-routing quarantine to protect mobile devices on untrusted cellular links.

---

Table of Contents

1. Threat Model & Why RadioGuard Exists
2. Core Architecture & Components
3. Key Features
4. Memory Safety & Buffer Overflow Guarantees
5. Adversarial Stress Test & Vulnerability Hardening
6. Anti-Tamper & Subprocess Hijack Protections
7. User Interface & Dashboard Layout
8. Automated Verification & Test Suite
9. Building from Source

---

Threat Model & Why RadioGuard Exists

Cellular networks (2G, 3G, and 4G LTE) suffer from foundational protocol weaknesses:

• Pre-Authentication Identity Leaks: Handsets reveal permanent IMSI and IMEI identifiers over raw cleartext before mutual authentication is established (3GPP TS 24.008 / TS 24.301).
• Unilateral 2G Authentication: GSM towers never authenticate themselves to phones, allowing fake towers to force null-ciphers (A5/0) or crack A5/1 encryption in real time.
• 4G LTE User-Plane Integrity Gap (aLTEr Attack / CVE-2018-18544): While 4G control signaling has integrity checks, user-plane IP packets lack integrity protection, allowing active bit-flipping attacks on DNS lookups.
• SMS Blasters: Portable SDRs emit high-power 2G signals to push phishing texts directly into phones without carrier involvement.

The RadioGuard Philosophy: Treat the cellular link like an untrusted public network (Zero-Trust Radio). Instead of hoping the tower is legitimate, the phone autonomously monitors cellular telemetry and encapsulates traffic inside authenticated cryptographic tunnels.

---

Core Architecture & Components

┌─────────────────────────────────────────────────────────────────────────────┐
│                       RadioGuard Architecture Topology                      │
├─────────────────────────────────────────────────────────────────────────────┤
│  [ UI Layer (Jetpack Compose) ]                                             │
│    • DashboardScreen: Real-time threat gauge, active telemetry, controls    │
│    • Device Integrity Banner: Displays kernel/root compromise warnings      │
│    • Forensic Incident Exporter: Generates JSON evidence dumps              │
├─────────────────────────────────────────────────────────────────────────────┤
│  [ Core Service Layer ]                                                     │
│    • RadioGuardService: Foreground sentry monitoring TelephonyCallback      │
│    • Telemetry Liveness Watchdog: Polls modem every 5s to defeat RIL freeze │
│    • Emergency 911/112 Fail-Safe: Auto-suspends killswitch during calls     │
│    • SafeTunnelVpnService: Native VPN killswitch (TunnelCrack hardened)     │
│    • ShizukuRadioBridge: Privileged non-root band locker & airplane pulse   │
├─────────────────────────────────────────────────────────────────────────────┤
│  [ Analytical Engine ]                                                      │
│    • AnomalyEngine: Normalized Bayesian multi-factor anomaly scoring        │
│    • Macro-Cell Shadow Clone Detector: Step-gradient Delta-RSRP tracking    │
│    • Hysteresis Buffer: 2-sample window filters Carrier Aggregation flits   │
│    • SmsFilterHelper: PDU inspector catching Type-0 Silent SMS pings        │
├─────────────────────────────────────────────────────────────────────────────┤
│  [ Storage & Integrity Layer ]                                              │
│    • TowerDatabase (Room SQLite): Local OpenCelliD / BeaconDB baseline      │
│    • Circular Storage Pruning: Caps incident log to 1,000 to prevent DoS   │
│    • AppIntegrityValidator: Runtime SHA-256 APK signing cert verification   │
│    • RuntimeAntiHijackGuard: Anti-ptrace & /proc/self/maps hook scanner     │
│    • DeviceIntegritySentry: Hardware TEE, SELinux, and rootkit auditor      │
└─────────────────────────────────────────────────────────────────────────────┘

---

Key Features