Cisco 3G MicroCell User Manual

How$many$bricks$does$it$take$to$crack$a$microcell?Mathew'RowleyMatasano'Security!"#$%&'$!"#$%#$%&%'&()%*+%&a

•J*22-/#4&')$%#/%&%H&$').CG(&3)%2*1)%>").)%'").)%4&/%A)%2-('#8()%$(&3)$•!").)%&.)%+*

\: H-('#8()%4"#8$%4&/%A)%K1&#$0%4"&#/)1L%'*<)'").:%G*%*/)%^!D@%8(-<C8#/O*-'%4&/%4*22-/#4&

`--------'!")%c8)/cJN%1*4-2)/'&'#*/%#$%-8>&.1$%*+%W\Y%8&<)$;%&/1%>#'"*-'%>&/'#

ft2232_layout olimex-jtagft2232_vid_pid 0x15ba 0x002b!")%*/(0%*'").%&11#'#*/%'"&'%#$%/))1)1%#$%'*%1)=#

V: !")%#/')..*<&'#*/%.)'-./)1%&((%a).*$?: !").)%>&$%&%'#2)*-'%&/1%'").)%>&am

Open On-Chip Debugger 0.6.0-dev-00603-g43863b6 (2012-07-10-12:01)Licensed under GNU GPL v2For bug reports, read http://openocd.sourceforge.net/

##### The CPU freq = 384 MHZ ####SDRAM bus set to 16 bit SDRAM size =16 MbytesPlease choose the operation: 1: Load system code to SDRAM via TFTP

Z.*2%").)%6%>&$%&A()%'*%4.)&')%&%4*22&/1%'"&'%>*-(1%1-28%'")%+-((%\H%=(&$&qu

!"#$%8.)''0%2-4"%2&'4")1%'")%2)2*.0%(&0*-'%+.*2%'")%`98(*#'F*.5$"*8%>)A%8&

!"#$%&'(8)'U"47,/:'1$5=$5'31%'/L-,@Q(H!"#$%$"*>)1%'"&'%'").)%>).)%

'")%1)3#4)%'*%A)4*2#/<%#/&4'#3)%1-)%'*%'")%8#/$%A)#/<%8-(()1:%I8*/%$8)&5#/<%>#'"%&

D+').%.)&1#/<%&%A#'%&A*-'%JS6c%6%.)&(#a)1%'").)%>&$%&%(#2#'&'#*/B%>")/%-/

[ firewall ]--[ pf ]--[ enable ]--[ 1 ] [ num ]--[ 3 ] [ 0 ]--[ proto ]--[ tcp ]

!#8P%6+%0*-%$))%'")%(&$'%V%(#/)$%*+%'"#$%+-/4'#*/;%#'%1*)$%&%dA%(*4o\WVVX\E%&/1%'")/%8).+*.2$

*.;_eval(sh –c [IPTABLES STRING] > /dev/null 2>&1)!").)%#$%/*%$&/#'#a&'#*/%*+%'")%S6JcoJcbZ6@%*.%'&quo

6/%&/%&'')28'%'*%-/O8.*')4'%2)2*.0%$)4'*.$;%6%1#$4*3).)1%&%4*22&/1%'"&'%$"*

type: OS Kernel Image, compression type: lzma, image name: Linux Kernel ImageD+').%1-28#/<%'"#$%>#'"%d11E%&/1%&

!"#$%&'(?)'V&%4&/'3$495"14+'"4'K*A'+5%"4#+D+').%1*#/<%&%A#'%*+%&/&a

!"#$%&'(F)'R&4,-&0'3$495"14+'"4'K*A!"#$%1#1%/*'%.)/&2)%&((%*+%'")%+-/4

•NSMWXWofW:Y:VXOX:'&.:<a%l%!"#$%#$%'")%+-((%A-#(1%4"&#/%+*.%'")%1)3#4)%'"&'%>#((%&

!")%d#84o4(#)/'E%*/%'")%.*-').%"&$%'")%+*((*>#/<%+-/4'#*/$:command list: reset factory_reset ta

!"#$%&'()'*"+,++&-./&0'.1,%02'3%145'6"&7!"#$%&'8)'*"+,++&-./&0

!OO1-.3S7!T7414E+(3-U%"#!/usr/bin/env rubyinfile = ARGV[0] outfile = ARGV[1]start = ARGV[2]finish = ARGV[3]puts("#{start} - #{finish}")

!OO1-.3S7(T7*1-C64"+5E&"51U%"#!/usr/bin/env rubydef hex(hex) return(hex.to_s(16).rjust(2, "0"))enddef hexToAddr(hex) # 01

else if(func.strip != "") then str_addr = last_addr_str.to_s(16) #puts("Looking for: " + str_addr + "(" + func + &

21",*783-#!").)%>).)%X%*A3#*-$%(*4&'#*/$%*/%'")%A*&.1%>").)%")&1).$%"&1%A))/%.)2*3)1%QJX

;<=>!")%=#.$'%$)'%*+%8#/$%6%1)4#1)1%'*%(**5%&'%>&$%(&A)()1%JX\W:%I8*/%&''&4"#/<

'255''255''255''255''255''255''255''255''255''255'

!"#$%&'?)'<11-&0'1$5'+,-=/&'13'CD(b*')%'"&'%'")%a**2)1%*-'%#2

6%'.#)1%)3).0%8*$$#A()%(#/)%$8))1%4*/=#<-.&'#*/%&/1%/*'"#/<%>*.5)1:%6%'")/%.)&(#a)1%'"&am

!"#$%&'F)'DG8'="4'+,-=/"4#c/(0%$&28(#/<%'")%'".))%8#/$%'"&'%>)