33C3 talk on dissecting cellular modems | Hacker News Reader

33C3 talk on dissecting cellular modems

laforge.gnumonks.org

105 pointsBuuQu9hu15 comments

Here's the recording:

https://media.ccc.de/v/33c3-8151-dissecting_modern_3g_4g_cel...

(I prefer media.ccc.de over YouTube because it lets you download the video in at least a couple of formats, and sometimes offers alternate streams/languages.)

I quite like the ability to watch videos on YouTube at 1.5x or 2x speed.

Note, one can do the same with ffmpeg:

https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts

http://stackoverflow.com/questions/30371346/whats-right-way-...

Most video players support changing the playback speed. In mplayer it's controlled with the '[' and ']' keys and in VLC it's set in the Playback -> Speed menu.

HTML5 video elements also usually have a playback speed property that can be changed in the JS console, so any site that streams fast enough can be sped up.

The mplayer keys work in VLC too, BTW.

Related: The YouTube and stream dump problem

https://events.ccc.de/2015/01/03/the-youtube-and-stream-dump...

Wow, had been following a ccc account on YouTube for some years, had no idea it wasn't official. Now subbed to the real source - thanks. :)

Just to make sure there are no misunderstandings: the mediacccde account is official:

> To mitigate this we have decided to open an official media.ccc.de YouTube channel to at least make sure users don’t have to suffer advertisements, incorrect licenses and incomplete metadata. This account can be found on https://www.youtube.com/mediacccde.

So can I really write AT+QLINUXCMD to my USB LTE Modem over tty-over-USB and execute arbitrary shell commands on the modem's internal linux installation as root?

If I remember the talk correctly, then yes. But it was said that there are several distinct firmwares…

If your USB LTE Modem is a Quectel (or maybe Sierra Wireless) MDM9615 based modem, yes. Otherwise, no.

It's still present even in the latest EC20E firmware EC20EQAR02A09E2G from 2016-09-24:

  ynezz@ntbk:/opt/devel/flexisbc/quectel_ec20/EC20EQAR02A09E2G$ grep QLINUXCMD
  Binary file 9615-cdp-recovery-image-9615-cdp.yaffs2 matches
  Binary file dsp2.mbn matches
  Binary file 9615-cdp-usr-image.usrfs.yaffs2 matches

Edit: formating

Would Sierra Wireless 313U be a good candidate?

system() is one of the most abused function in that code.

Video recording on yt https://www.youtube.com/watch?v=sq9chzNVoXg

Reply on news.ycombinator.com