2 ms·

Thanks for the 44con invite. It looks like fun, but I'm nowhere near there. Also, your BlackHat presentation was excellent, and surprisingly, I'm actually plani

by jcr 14y ago

Thanks for the 44con invite. It looks like fun, but I'm nowhere near there. Also, your BlackHat presentation was excellent, and surprisingly, I'm actually planing on watching it again to lift the details. I'm curious if you've touched any of the Verizon "MiFi" devices? I've started mildly poking at a MiFi4620LE (4G LTE "jetpack") recently, but not very seriously --It's not mine personally and its on a corporate account so I've been promised (read: threatened) to not mess with it too much. ;-) It's extremely fast but the double (p)NAT'ing is annoying i.e. it provides access to client devices via NAT to priv address space, but it's upstream interface is also NAT'ed by the carrier and in priv address space. So far I've figured out how to talk to it over USB, but I want to get it into "stupid" mode and talk directly to its internal modem. I want it to just be a dumb modem with a public address(es). I'm fairly sure there's a way to do it, but I just need to figure out how to do it. If I can get at the serial port, then it's game over.

iuguy 14y ago
The MiFi4620LE is actually from the Novatel 4620L family and looks similar from what I can discern to the Novatel 3352 that I have. Novatel are horrible to deal with. They close their platform, don't release any firmware updates whatsoever and ship broken kit based almost entirely on open source software while never releasing the source they're legally obliged to provide. You need to avoid these guys if possible. The double NATing might be the 4G network. It's not uncommon to go from RFC1918 (you to device) to P2P device - mobile infrastructure to RFC1918 to boundary and onto the Internet. If you take the case apart you should find a set of 5 blobs or holes usually in a row that might indicate a JTAG interface, and with a bit of kit you should be able to get your serial port. I've not looked at my 3352 yet because the case doesn't come apart easily and I've mainly been playing with a much more hackable TP-Link device (the WR-703N). If it's like the 3352 it'll run a custom 'MifiOS' that has a ton of useless little api calls to feed javascript widgets on the web interface for things like geolocation and other pointless things.

by jcr 14y ago

iuguy 14y ago

The MiFi4620LE is actually from the Novatel 4620L family and looks similar from what I can discern to the Novatel 3352 that I have. Novatel are horrible to deal with. They close their platform, don't release any firmware updates whatsoever and ship broken kit based almost entirely on open source software while never releasing the source they're legally obliged to provide. You need to avoid these guys if possible. The double NATing might be the 4G network. It's not uncommon to go from RFC1918 (you to device) to P2P device - mobile infrastructure to RFC1918 to boundary and onto the Internet. If you take the case apart you should find a set of 5 blobs or holes usually in a row that might indicate a JTAG interface, and with a bit of kit you should be able to get your serial port. I've not looked at my 3352 yet because the case doesn't come apart easily and I've mainly been playing with a much more hackable TP-Link device (the WR-703N). If it's like the 3352 it'll run a custom 'MifiOS' that has a ton of useless little api calls to feed javascript widgets on the web interface for things like geolocation and other pointless things.