Method for detecting an attack on a baseband processor of a mobile device, being a mobile phone with cellular network connectivity, which comprises the baseband processor and an application processor, which may or may not be integrated in a single chip, wherein the baseband processor manages all radio functions of the mobile device, and the baseband processor and the application processor communicate and exchange information caused by the applications running on the application processor, wherein the mobile device, comprises a baseband monitor component, an application monitor component, an evaluator component, a defense component, the method comprises the steps: a) monitoring by the baseband monitor component the behavior of the baseband processor by using features available on the respective mobile device, b) monitoring by the application monitor component the behavior of the application processor by keeping a record of the parameters, execution time or execution duration of legitimate software or user activities on the application processor that cause normal baseband activities as intended by the user; c) correlating by the evaluator component the baseband processor behavior with application processor behavior in order to distinguish between legitimate and suspicious/illegitimate baseband activities, d) initiation by the defense component of countermeasures designed to ward off the suspicious/illegitimate baseband activities; wherein the monitoring by the baseband monitor comprises one or more of the following: - collecting information on audio path configuration, - collecting information on the response time to normal service requests from the application processor to the baseband processor; - collecting information obtained from the baseband processor's debugging output; and/or wherein the evaluator component flags the presence of a rogue base station that does not belong to the legitimate mobile network and the defense component warning the mobile device's user that a rogue base station (a so-called "IMSI catcher") has been detected and/or the defense component shutting down the baseband processor in order to prevent exploitation, and preferably wherein the evaluator component flags the presence of a rogue base station that does not belong to the legitimate mobile network using one or more of the following information: - cell identification, distance, and signal strength, - signal growth/attenuation, - forced network change from 3G to 2G network, - unusual changes in the list of neighboring cells, - unusual configuration parameters of the mobile base -station designed to make it appear more 'attractive' to the targeted mobile device(s), - network parameters not consistent with the mobile device's location and/or the currently selected mobile network operator a) monitoring by the baseband monitor component the behavior of the baseband processor by using features available on the respective mobile device, b) monitoring by the application monitor component the behavior of the application processor by keeping a record of the parameters, execution time or execution duration of legitimate software or user activities on the application processor that cause normal baseband activities as intended by the user; c) correlating by the evaluator component the baseband processor behavior with application processor behavior in order to distinguish between legitimate and suspicious/illegitimate baseband activities, d) initiation by the defense component of countermeasures designed to ward off the suspicious/illegitimate baseband activities; - collecting information on audio path configuration, - collecting information on the response time to normal service requests from the application processor to the baseband processor; - collecting information obtained from the baseband processor's debugging output; - cell identification, distance, and signal strength, - signal growth/attenuation, - forced network change from 3G to 2G network, - unusual changes in the list of neighboring cells, - unusual configuration parameters of the mobile base -station designed to make it appear more 'attractive' to the targeted mobile device(s), - network parameters not consistent with the mobile device's location and/or the currently selected mobile network operator