Project

General

Profile

Actions

Bug #5304

open

Verizon CDMA femtocell

Added by copslock over 2 years ago. Updated about 1 month ago.

Status:
New
Priority:
Low
Assignee:
-
Target version:
-
Start date:
11/10/2021
Due date:
% Done:

0%

Spec Reference:

Description

Verizon Samsung SCS-2U01 is a very famous target for many hackers,while as Harald said in 32C3,none of them even thought about running a local network upon it.Verizon is phasing out its CDMA network,it's time to play with these valuable blackbox

It looks like the IS95 core network is a bit simpler than 3GPP network,however,there is no project about IS95 at all,Neither the data PDSN nor the IS95 MSC.


Files

hdmi_internal.jpg View hdmi_internal.jpg 33.4 KB Jarobar, 01/06/2022 12:16 AM
picture807-1.png View picture807-1.png 884 KB copslock, 12/06/2022 06:15 PM
picture807-2.png View picture807-2.png 884 KB copslock, 12/06/2022 06:15 PM
picture227-1.png View picture227-1.png 1.31 MB copslock, 12/06/2022 06:17 PM
2650013279-1.png View 2650013279-1.png 1.02 MB copslock, 12/07/2022 03:32 AM
2650013279-2.png View 2650013279-2.png 1.12 MB copslock, 12/07/2022 03:32 AM
2650013279-3.png View 2650013279-3.png 546 KB copslock, 12/07/2022 03:32 AM
2650013279-4.png View 2650013279-4.png 490 KB copslock, 12/07/2022 03:32 AM
Actions #1

Updated by Jarobar over 2 years ago

Hi,
The procedure here seems to be ok.
https://www.inguardians.com/2017/01/18/somebody-is-securing-samsung-wireless-network-extenders/

The console is located on the HDMI connector at the bottom. Tx on R202, Rx on R198. TTL 3.3V, 115200,8,N,1
There is no antitamp.

Actions #2

Updated by copslock over 1 year ago

Jarobar wrote in #note-1:

Hi,
The procedure here seems to be ok.
https://www.inguardians.com/2017/01/18/somebody-is-securing-samsung-wireless-network-extenders/

The console is located on the HDMI connector at the bottom. Tx on R202, Rx on R198. TTL 3.3V, 115200,8,N,1
There is no antitamp.

Yes,It's applicable to older firmware ones but not the online updated ones

Actions #3

Updated by copslock over 1 year ago

Jarobar wrote in #note-1:

Hi,
The procedure here seems to be ok.
https://www.inguardians.com/2017/01/18/somebody-is-securing-samsung-wireless-network-extenders/

The console is located on the HDMI connector at the bottom. Tx on R202, Rx on R198. TTL 3.3V, 115200,8,N,1
There is no antitamp.

I have managed to find some completely out-of-factory ones and try to get some dump of it
Jarobar wrote in #note-1:

Hi,
The procedure here seems to be ok.
https://www.inguardians.com/2017/01/18/somebody-is-securing-samsung-wireless-network-extenders/

The console is located on the HDMI connector at the bottom. Tx on R202, Rx on R198. TTL 3.3V, 115200,8,N,1
There is no antitamp.

Actions #4

Updated by copslock over 1 year ago

Upload topic image

Actions #7

Updated by laforge about 1 month ago

would be great to get all this content converted into a wiki page below Femtocell-specific_information

Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)