5 ms·

33C3 talk on dissecting cellular modems

105 points by BuuQu9hu 10y ago

leowinterde 10y ago
Video recording on yt https://www.youtube.com/watch?v=sq9chzNVoXg https://www.youtube.com/watch?v=sq9chzNVoXg
Sidnicious 10y ago
Here's the recording: https://media.ccc.de/v/33c3-8151-dissecting_modern_3g_4g_cellular_modems https://media.ccc.de/v/33c3-8151-dissecting_modern_3g_4g_cel... (I prefer media.ccc.de over YouTube because it lets you download the video in at least a couple of formats, and sometimes offers alternate streams/languages.)
- Cieplak 10y ago
  I quite like the ability to watch videos on YouTube at 1.5x or 2x speed. Note, one can do the same with ffmpeg: https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts http://stackoverflow.com/questions/30371346/whats-right-way-to-change-playback-speed-with-ffmpeg http://stackoverflow.com/questions/30371346/whats-right-way-...
  - lgeek 10y ago
    Most video players support changing the playback speed. In mplayer it's controlled with the '[' and ']' keys and in VLC it's set in the Playback -> Speed menu.
    - nitrogen 10y ago
      HTML5 video elements also usually have a playback speed property that can be changed in the JS console, so any site that streams fast enough can be sped up.
    - ago 10y ago
      The mplayer keys work in VLC too, BTW.
- holri 10y ago
  Related: The YouTube and stream dump problem https://events.ccc.de/2015/01/03/the-youtube-and-stream-dump-problem/ https://events.ccc.de/2015/01/03/the-youtube-and-stream-dump...
  - jamesbrownuhh 10y ago
    Wow, had been following a ccc account on YouTube for some years, had no idea it wasn't official. Now subbed to the real source - thanks. :)
    - secure 10y ago
      Just to make sure there are no misunderstandings: the mediacccde account is official: > To mitigate this we have decided to open an official media.ccc.de YouTube channel to at least make sure users don’t have to suffer advertisements, incorrect licenses and incomplete metadata. This account can be found on https://www.youtube.com/mediacccde https://www.youtube.com/mediacccde.
therein 10y ago
So can I really write AT+QLINUXCMD to my USB LTE Modem over tty-over-USB and execute arbitrary shell commands on the modem's internal linux installation as root?
- cnvogel 10y ago
  If I remember the talk correctly, then yes. But it was said that there are several distinct firmwares…
- dirkt 10y ago
  If your USB LTE Modem is a Quectel (or maybe Sierra Wireless) MDM9615 based modem, yes. Otherwise, no.
- ynezz 10y ago
  It's still present even in the latest EC20E firmware EC20EQAR02A09E2G from 2016-09-24: ynezz@ntbk:/opt/devel/flexisbc/quectel_ec20/EC20EQAR02A09E2G$ grep QLINUXCMD Binary file 9615-cdp-recovery-image-9615-cdp.yaffs2 matches Binary file dsp2.mbn matches Binary file 9615-cdp-usr-image.usrfs.yaffs2 matches Edit: formating
  - therein 10y ago
    Would Sierra Wireless 313U be a good candidate?
deleted 10y ago
[deleted]
dbalan 10y ago
system() is one of the most abused function in that code.

105 points by BuuQu9hu 10y ago

Video recording on yt https://www.youtube.com/watch?v=sq9chzNVoXg https://www.youtube.com/watch?v=sq9chzNVoXg

Here's the recording: https://media.ccc.de/v/33c3-8151-dissecting_modern_3g_4g_cellular_modems https://media.ccc.de/v/33c3-8151-dissecting_modern_3g_4g_cel... (I prefer media.ccc.de over YouTube because it lets you download the video in at least a couple of formats, and sometimes offers alternate streams/languages.)

Cieplak 10y ago
I quite like the ability to watch videos on YouTube at 1.5x or 2x speed. Note, one can do the same with ffmpeg: https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts http://stackoverflow.com/questions/30371346/whats-right-way-to-change-playback-speed-with-ffmpeg http://stackoverflow.com/questions/30371346/whats-right-way-...
- lgeek 10y ago
  Most video players support changing the playback speed. In mplayer it's controlled with the '[' and ']' keys and in VLC it's set in the Playback -> Speed menu.
  - nitrogen 10y ago
    HTML5 video elements also usually have a playback speed property that can be changed in the JS console, so any site that streams fast enough can be sped up.
  - ago 10y ago
    The mplayer keys work in VLC too, BTW.
holri 10y ago
Related: The YouTube and stream dump problem https://events.ccc.de/2015/01/03/the-youtube-and-stream-dump-problem/ https://events.ccc.de/2015/01/03/the-youtube-and-stream-dump...
- jamesbrownuhh 10y ago
  Wow, had been following a ccc account on YouTube for some years, had no idea it wasn't official. Now subbed to the real source - thanks. :)
  - secure 10y ago
    Just to make sure there are no misunderstandings: the mediacccde account is official: > To mitigate this we have decided to open an official media.ccc.de YouTube channel to at least make sure users don’t have to suffer advertisements, incorrect licenses and incomplete metadata. This account can be found on https://www.youtube.com/mediacccde https://www.youtube.com/mediacccde.

therein 10y ago

So can I really write AT+QLINUXCMD to my USB LTE Modem over tty-over-USB and execute arbitrary shell commands on the modem's internal linux installation as root?

cnvogel 10y ago
If I remember the talk correctly, then yes. But it was said that there are several distinct firmwares…
dirkt 10y ago
If your USB LTE Modem is a Quectel (or maybe Sierra Wireless) MDM9615 based modem, yes. Otherwise, no.
ynezz 10y ago
It's still present even in the latest EC20E firmware EC20EQAR02A09E2G from 2016-09-24: ynezz@ntbk:/opt/devel/flexisbc/quectel_ec20/EC20EQAR02A09E2G$ grep QLINUXCMD Binary file 9615-cdp-recovery-image-9615-cdp.yaffs2 matches Binary file dsp2.mbn matches Binary file 9615-cdp-usr-image.usrfs.yaffs2 matches Edit: formating
- therein 10y ago
  Would Sierra Wireless 313U be a good candidate?

deleted 10y ago

[deleted]

dbalan 10y ago

system() is one of the most abused function in that code.