Slashdot Mirror

Original Forum Post
People posting writeups of how to use it a year later
I actually never did do a write-up of this particular exploit, so this is a first. It was also while I worked fast food, and before I had any idea how professional technical world worked, so I didn't ever make source available either. I was 23 at the time. My later work was much better and more publicly documented.

Well, I didn't break RSA's encryption, of course. I'm no mathematician or cryptanalyst.
But back in 2006, RSA signed firmware images (for phones at least) was in its infancy, and there weren't a lot of people attacking them, so a lot of mistakes were made.
In the case of the RAZR, the ARM7 in it was attached to some NOR flash, and had some mask rom on the CPU.
The mask rom had the exception vectors pointed to the main firmware of the device.
Older versions of the phone had a bootloader that was not protected, and allowed arbitrary reads from memory space, so I was able to get a dump of address space of the device by borrowing a friend's phone.
One could flash the main firmware without signature on the newer bootloader, but it wouldn't execute if it wasn't valid.
The bootloader was simple, and required sending of a binary payload (called a RAM downloader) to initiate the actual flashing process. This payload also needed to be signed for the bootloader to execute it.
The RAM downloader payload had a pointer within it pointing to the signature. The validity of this pointer was not checked.
This means that I have control of the access violation exception vector (since it pointed to flash that I could write, but not execute), and the ability to trigger an access violation (because pointer to the signature for the RAM downloader was not checked), all within unsigned code (even if I can't execute it during the normal boot process)
I then wrote a small program to relocate a modified RAM downloader (just offset long references) to the position in the firmware that would be jumped to when an access violation happened.
With the modified bootloader in place, and able to be executed, I was able to overwrite the main bootloader with one from an earlier firmware load of the phone that did not have signature verification.

This was actually my first time using an ARM processor, and they didn't really have tools widely available for working with them. I did my reverse engineering, as well as my modifications to the unprotected exploit bootloader with the actual ARM docs. It was also my first time dealing with assembly language at all. I'd say deciding I was going to free that phone changed my life. Since then, I have made tons of money breaking security in other phones, been offered to speak at national conferences, and offered jobs as a security researcher. I guess I developed a passion for freeing the hardware I had purchased from shithead companies that tried to lock us out of them.

Netflix is the server; The client (s) are the web browsers requesting domain name resolution.

You couldn't be more correct- and since the client (web browser/netflix) did actually make the request to the glibc nss mechanism, the glibc nss mechanism also allowed it, and forwarded it off to the systemd-resolve daemon, who also allowed it, tossed it through its punycode IDNA library, and then forwarded it to its system-configured resolver, everyone in that chain agreed it was perfectly valid. libidn2 simply had a bug where it removed the underscore. This bug is acknowledged.
You've defeated your own fucking argument so many times everyone here has lost count. You are not a very literate person. I suspect that could be corrected with a little effort on your part.

Nothing new here, even with the iPhone 7, the variant with the Intel modem is slower. Heck, the iPhone 6S had two different CPU suppliers, and battery life differences cropped up over that. Oh yeah, and the original iPhone had some LCD screens with a negative black issue.

I'm sure the faithful will still line up to play the iPhone 8 lottery. Do you feel lucky?

You do need to disable the 30Minute auto shutoff but thats easy to do from the webmenu at least for the $20/mo option att is selling right now.
http://www.howardforums.com/showthread.php/1894167-Stand-alone-AT-amp-amp-T-Unlimited-ZTE-Mobley-Hotspot-now-only-20!!!!!/

Speed Test on unactivated SIM

https://productforums.google.c...
http://www.howardforums.com/sh...

Verizon requires you to have a data plan to even use (e.g.) an iPhone. Even if you never use the data service. If Verizon considers your phone a "Smart Phone", they require you to have and pay for a data plan to use it. My understanding is that the other carriers have the same policy. The people that are buying these phones are paying these monthly fees.

The environment is more complicated since the last time you looked into cell phone plans. I don't blame you, because you have better things to do, but you might be able to save money with a smartphone, now.

There's decent activity in Mobile Virtual Network Operators (MVNO), companies that rent capacity on the carriers' networks. Most of them have conventional plans that work with any phone from that carrier. If your usage falls into particular patterns, those plans can be cheaper than the carriers' own plans. But with a smartphone, a company can offer radically different plans:

Republic Wireless has plans starting at $10, or $5 if you have good WiFi and don't need to do calls away from your home/work/car hotspot, ever. Their cheapest phone is only $149, so it doesn't take long to start saving money compared to a typical carrier. Republic Wireless is what I use.

FreedomPop has plans starting at $0, as long as you don't use more than 200 minutes a month, or $10.99 for unlimited voice and texts. Their cheapest phone is $99. I'm not confident in their service quality, and I don't like their overage-based business model, but it doesn't get any cheaper than free.

As others have stated, this is exactly how Apple's iCloud lock works. If the owner of the device remotely locks it or it is factory reset through iTunes, it will be useless except for displaying a screen prompting for the owner's Apple ID and password. So far, all it has really accomplished is giving some extra headache to businesses that accept phone trade-ins and slightly lowering the value of lost/stolen iDevices on eBay. We also already have a national IMEI blacklist, which mostly seems to have succeeded only in increasing the number of scam artists re-selling unusable phones to gullible people (in most cases, they're generally not stolen - the sleazy cell phone companies here in the US are happy to block a phone's serial number if the phone was associated with a service contract or handset financing plan and the previous owner defaulted on it).

Besides, what's to stop a thief from taking a page out of the trade-in services' books and simply demanding you turn off/sign out of your phone's remote kill switch feature? If they're threatening someone at gun/knife point, it's not exactly like the victim would have much choice in the matter.

If people are being robbed, your city has a crime problem that needs to be solved with good, old fashioned police work.

FYI, Cricket uses Verizon's network, at least in my area. However, their "unlimited" plan is limited to 2GB, then it drops to unusable speed.

http://www.howardforums.com/showthread.php/1507959-What-network-does-Cricket-piggy-back-on

Apparently, they have roaming agreements with all the CDMA providers.

http://www.howardforums.com/showwiki.php?title=General+Prepaid+Wiki:Prepaid+Rate+Plan+Comparison

T-Mobile still offers their "unlimited web & text with 100 minutes talk" plan through their web site. It was originally a Wal-Mart plan. I've been quite happy with it. Never needed more than 100 minutes, but if I do, it's only 10 cents per extra minute.

http://prepaid-phones.t-mobile.com/monthly-4g-plans

I get my prepaid refills from third party web sites that offer them at a slight discount. For example, $30 of refill value for $29.70 (or less with a coupon code). Here's one:

https://www.callingmart.com/

It's worth noting that, unlike most postpaid/contract plans, there are no additional tariffs or other fees to push a $30 plan up to $35 or so. I really do pay less than $30 per month.

There is a very useful table of prepaid plans over at Howard Forums. Since you have a GSM phone, you'll want one of the carriers that uses AT&T's or T-Mobile's network.

I'm pretty happy with T-Mobile's $30 monthly prepaid plan, since I rarely need many talk minutes and I'm willing to live with 2G data speeds until they refarm their 1900 MHz spectrum to support 3G later this year.

This really is a topic for mobile phone specific forum. My favourite is HowardForums. Here is a link to the US pre-payed/MVNO forums: http://www.howardforums.com/forumdisplay.php/325-US-Prepaid-MVNO-Discussion

There are lots of people there who know what's up with pre-paid and low-cost options.

Check out Page Plus: http://www.pagepluscellular.com/

They are prepaid reseller using Verizon network. There is a forum here: http://www.howardforums.com/forumdisplay.php/364-Page-Plus-Cellular

I would recommend:

http://www.howardforums.com/forums.php

Hard to fix a hardware problem with software.

This phone has provided me with no end of frustration. It's a $500 phone that I'm paying another eight bucks a month for warranty for over my two year contract, meaning I'll wind up paying a total of $700 for a phone that doesn't work right. And t-mobile wants to give me a $150 clique in replacement.

Some links follow.

It's a hardware problem in a number of phones:

http://forum.xda-developers.com/showthread.php?t=878970

http://pocketnow.com/android/hardware-fix-for-vibrants-gps-problems

T-mobile did push out a patch:

http://pocketnow.com/android/samsung-vibrant-gps-fix-finally-being-pushed-out-by-t-mobile

But it didn't actually do the upgrade. No, you have to turn off your computer's firewall and virus protection to apply software patches to hardware problems...

http://www.samsung.com/us/support/SupportOwnersFAQPopup.do?faq_id=FAQ00026061&fm_seq=26229

for a patch that doesn't work anyway...

http://forum.xda-developers.com/showthread.php?t=988076

http://www.howardforums.com/showthread.php/1661605-Vibrant-Problems-Please-post-all-here-so-Samsung-Google-Engineers-can-see-them/page4

Yeah, come back and talk to me when Wind is nationwide, maybe then I'll retract my statement. Vancouver, Calgary, Edmonton, Toronto, and Ottawa isn't even close to being all of Canada. I live in a major city and I've been waiting for Wind since they came to Canada. One more thing I should add is Wind has rural roaming agreements with the big three, so unless you stay in the city your whole life and never leave, you will end up using the services of these providers at some point. It's like me saying, "I don't use Bell, I got MTS!". Think about that one.

They have several boot modes. Here's an example: http://www.howardforums.com/showthread.php/1424826-E71-Hard-Reset-Is-there-any-difference-between-2-codes The first one is an unlock code, the second type has restored my phones even when they refused to boot due to errors during the flashing, I'd say that is bricked if it fails half-way during the flashing and the phone doesn't boot anymore.

Take a look at http://www.pagepluscellular.com/ - they are prepaid Verizon reseller that I've been using for years. They allow BYOD; you can use most of the Verizon phones (except BB, IPhone and Verizon prepaid phones) - I use Droid Incredible. I am on their "Pay-Per-Minute" plans because it fits me the best - my usage is quite small. There is a forum about PagePlus here: http://www.howardforums.com/forumdisplay.php/364-Page-Plus-Cellular

Yep, sure have. They support almost all of the Verizon programmed phones, except Blackberries and iPhones. Check out http://www.howardforums.com/forumdisplay.php/364-Page-Plus-Cellular for more information.

For Verizon, activate on Page Plus.

Has anybody here done this successfully? They only appear to support a few models of phones on their webpage. I like my phone, don't want to get a different one.

Yes, people have done this successfully.

The cell phone companies are way ahead of the curve on this one. They've been working on ways to screw us over for years now... and the more you know about making the sausage (from sites like HoFo), the more you know how bad you're getting it. Especially in the US.

Just a few days ago, I got a text message from T-Mobile saying, "Texas Recovery Fee now included on monthly bill." Oh for crying out loud. Does the grocery store charge me a "Municipal Services Recovery Fee" to get back the cost of their food service license? Even the tire store doesn't charge the "tire disposal fee" if I tell them to load 'em up in the back seat. I'd drop 'em in a minute if it weren't for two things: 1) Everyone else is just as bad or worse, and 2) T-Mo makes it easy and *cheaper* to stay *out* of a contract, which actually makes me *more* likely to stay.

most phone users do not really "own" they phones during the initial 2 years

You do own the phone (physically), but in consideration for the discount you got on it, the phone company pwns joo for a $350 early termination fee if you stop sending them their monthly ransom on the service contract. The phone is still yours to do with as you please.

Mobile phone carriers have just tried to give you the impression that you don't own the phone, by making the phone you own useless for doing anything other than connecting to their network and buying ringtones on their web portal that cost more than the full song download.

They do this through technical hindrance such as unique protocols (cdma vs GSM), unique frequencies (3G on 1900MHz vs 2100MHz), carrier SIM lock (or no sim at all), or vendor-specific firmware (see CDMA phones), auto-jamming your phone with their service books and restriction software (i.e. put the carrier's SIM card into the unlocked Blackberry you bought outright [don't even need to connect to their network] and your phone's wi-fi & GPS mapping software is disabled so they can sell it back to you for $10-$30/mo), and by black-listing the device's IMEI if they didn't like how you left their service.

QNC.

Gold mine. Thanks for setting me off in the right direction.

When T-Mobile released the "T-Mobile Tap" -- manufactured by Huawei -- I bought it the first week. It was cheap, had a huge screen, and counted as a "dumbphone" so it wasn't subject to the smartphone data plan upcharge.

I've regretted that purchase every single day since.

I posted a litany of woes over on the HoFo forum. I have never had a phone that provided me with such daily reminders of why I don't buy new products.

The interface is clunky and inconsistent -- it's clear that one dev team built the dialer, another dev team built the text message system, and another one built the contacts. All of those reference things like typing and phone number entry, but they all do it in different ways! And, they all suck. In fact, none of the functions play well together. All of the built-in apps can be dragged onto the "desktop", but most of them go away every time you power-cycle.

And the hardware is cheap. Every time a sound plays (like a ringtone) on the external speaker, there's an audible "pop" as the speaker gets power and another "pop" when the sound completes and the speaker powers down. And the processor often bogs down during complex tasks, such as entering a phone number. :P Of course, it's a sub-$200 touchscreen, so I didn't expect top-notch hardware -- if that's all that sucked, I'd be happy.

The worst part is just cropping up now, though. Random software issues are killing the digitizer. I'm quite certain it's not hardware, because it typically happens after running a Java app (such as the built-in Google Maps, or the Opera Mini I downloaded but can barely use because the phone only gives it a data connection half the time). Also, strange behavior occurs when the digitizer is wonky, like when the text message notification bar goes away or the options at the bottom of the screen disappear and leave the background visible.

Maybe it's not just bad software... maybe these are indications that the Chinese government is monitoring my calls and text messages. Maybe I got on their bad side by using Google Voice? If that's the case, they're getting a whole lot of messages like "I'll have to call you back, my phone is crapping out again".

I learned one lesson, at least. If the manufacturer isn't willing to put their name on it, don't buy it! T-Mobile should follow that advice, instead of tarnishing their name by associating it with this piece of crap Tap.

Please mod parent up: He's completely correct, and his simple methodology is a good example of best practices.

However, there are more impromptu ways to accomplish similar feats:

One obvious possibility is the test mode built into many (perhaps all) cell phone handsets. These will typically display a number of different datapoints, such as signal strength and error rate. If the asker is troubleshooting only troubleshooting GSM or CDMA (so that switching carriers does not necessarily entail switching radios, antennas, etc), and isn't interested in the accuracy or automation of doing GPS-based maps of cellular coverage, this might work just fine -- perhaps even for free.

All it would take is a map, a pencil, a copilot, and (ideally) an external antenna, to chart this stuff the old fashioned way.

With a quick Google search, I found a concise list of procedures for entering field test mode on a number of handsets. Other handsets, past and present, are likely to have information available at places like HowardForums.

And, indeed: Good luck. I've charted my share of wireless systems, and it is (at best) tedious to get good results.

No, really?

Have you seen their coverage maps? They make AT&T look good.

I <3 T-Mobile, but their coverage has always been an unattractive shade of Suck. Even in Dallas -- home of Texas Instruments, y'all -- my cheap touchscreen is constantly switching from 3G to EDGE, or dropping data altogether. Hearing that Nexus One users are having trouble with T-Mobile's 3G network is like hearing that bears have been discovered crapping in the woods.

Take a look at Page Plus Cellular, a Verizon MVNO with pre-pay plans. They allow you to use just about any CDMA phone and can even port existing Verizon numbers to their service.

You can find more information about them on Howard Forums.

Boost mobile discussion

Howardforums are the best for various cellphone discussion, tons of subgroups there

WiMAX beats your 10/10mbit line throughput wise, and is capable of more.

Current users are getting 16Mbps/6Mbps. Latency as low as 40ms (portland to Seattle WA).

What others are getting.

"which means 10.5Mbps in either direction"

Wrong! Sprint 4G users currently getting 16Mbps down and 6Mbps up.

See for yourself.

Just to add my 2 cents, I completely agree. If you go on HowardForums @ http://www.howardforums.com/forumdisplay.php?f=330 you can get all sorts of input on the phones and service. I paid $100 for one years service and 1300 minutes. At my usage that is approx. $8 a month and since I don't talk on the phone or text that much (I still have 900 minutes left with 5 months to go on the contract) it works out much better for me than a monthly $50 bill.

With that said, I think my family is going to move to a Verizon family plan this Christmas. It is going to suck paying $100 a month (+ taxes and fees) for 4 phones with my work discount.

I knew squat about how badly my AT&T cell phone was locked down. Until the day when I installed Google maps and got annoyed that it 1) did not use the built-in GPS on the phone, and 2) continually asked me if it could access the internet. How crippled is that? I looked up how to fix these problem (hooray internet!) and I found some kind person's instructions on how to debrand my W760 phone. I realized that this would also fix several other problems with the phone, such at the limit that ring tones be less than 30 seconds long.

The bottom line is that I had *no clue* that my phone was so crippled by AT&T! My ignorance was stunning. I had avoided buying an iPod because I thought Apple was "insanely controlling," but now realize that AT&T is just as bad.

Here are some of the things that AT&T did:

1. They restrict access to the built-in GPS so that you can only use applications that AT&T sanctions and makes you pay a monthly service fee for.
2. They do not allow ring tones of MP3 files longer than 30 seconds. (33, actually?)
3. They do not allow you to delete the ugly trialware applications that come installed on the phone.
4. They do not let you run more than 1 application at a time + the media player.
5. They do not let you configure an application as trusted to access the internet without asking *every* access. (This ruins many applications.)
6. They force the browser's home page to their spammy advertising site.

I'm sure there are other evil things. I'm *much* happier with my phone now, and it will become a much bigger part of my life now that I have "debranded" it. I am still a customer, but I now have no loyalty to a company that would pull that crap on me.

(I am not affiliated in any way with this site which seems to have lots of good information on cell/mobile phone debranding.)

There is already an effort to get the Pre working on Verizon in fact - see here: http://www.howardforums.com/showthread.php?t=1487090&page=1&pp=15&highlight=palm+pre

I don't have your phone, so I can't guarantee it'll work, but this thread seems to have the answers you need: http://howardforums.com/showthread.php?t=1331924

See,

i can make any mods i like (well, im not the only one)

If it was me running that company, I'd be pimping it to these guys. Give them a phone you can mod the shit out of, you'll get sales.

Now, in order to do so, you'd have to realize those guys aren't developers. They know just enough programming to get into trouble. Therefore, "open source" isn't what they want. They just want an easy way to bling their phone or run some program their cell phone company won't let them. That is their pain, and something like OpenMoko could have cured it.

Granted, if you ever wanted to expand outside that niche market, you'd have to cure pain felt by a lot of people. Most people don't mod their phone. However, I'd bet a lot of people are dissatisfied with how restricted their service seems. You'd have to do something to lessen that pain.

its open. (read it again)

This is a means to an end. You don't sell people on the fact it is "open", you sell them on the fact you can use any wallpaper you want. You sell them on the fact they can install games the mobile provider doesn't want them to.

There is at least 1 major falsehood in your post, probably two.

1. AT&T having unlimited data. The data is not unlimited it is capped at 5GB, but they of course don't really advertise this.

2. Your Canadian data plan being restricted in any way other than a very boldly stated cap.

I pay $30 for 6GB (better than the 'unlimited' in the USA you'll notice). They don't offer this anymore, but at the time it was available for any smartphone, including iPhone and Blackberry. Tethering and using every bit right up to your 6GB cap in any way you would like is totally allowed.

While we on Rogers with iPhones no longer have the option of the 6GB/$30, the way it is gone about by Rogers is much better than AT&T I find. The cap is stated right there in the name of the plan rather that hidden in some ToS, just like everyone says ISPs should do it. And the plan is unrestricted as to use types, which is ideal.

Go to http://rogers.howardforums.com/ for much more info regarding Rogers in Canada, their plans, and just about anything else you can think of.

Here is the link I was looking for: http://howardforums.com/showthread.php?t=824482 For the most part it looks like they should work, but *shrugs*

This covers that

http://howardforums.com/showthread.php?t=1397733

The iphone 3g, it's broken in the bad sense.

I realize that you're probably being facetious, but take a look at Sprint's SERO plan.

In a nutshell, if you sign up for a two-year contract through the right avenues, for $30/month you can get 500 minutes, free nights and weekends that start at 7 pm, unlimited in-network calling, unlimited roaming, unlimited text messaging and 3G data, and a few other perks that I don't really use. You can probably also get a pretty hefty chunk off of whatever phone you're planning to buy; I got $350 off of a Mogul.

For what it's worth, you may not be able to replace your home internet. Tethering is officially not allowed, although I've been connecting my Mogul to my laptop via Bluetooth for mobile 'net access for several months now and nobody seems to have noticed.

He's probably on the old Cingular Media Max data plan. For an extra $20 a month added to your account, you can get unlimited data access.

This data plan is/was intended for regular phones, not smart phones or PDA phones. And no tethering is allowed either. But many users do it anyways. They're just extra careful not to use too much data that might set off some red flags.

I guess the S&D got retracted. More info here. Damn! Just when you think there's going to be a good fight! What I want to know, now, is how does someone become the President of an Internet media company and still think a forum is a web sight.

I guess the S&D got retracted. More info here. Damn! Just when you think there's going to be a good fight! What I want to know, now, is how does someone become the President of an Internet media company and still think a forum is a web sight.

Quote: Howard, great catching up today. Again, we're big fans of the sight and our intention was never to bring your entire sight down or to "censor the Internet" like we're being accused. The irony is that is quite the opposite type of company we are and as one of the leaders in new media, we couldn't be more supportive of the rights of sights like yours. Please know that our first priority is always to fix any security issues with our system and we're doing that. Additionally, we also have a responsibility to our content and carrier partners to reduce the impact of any breaches to the system once they occur and that was really the basis for the correspondence you had with our legal team.
I look forward to continuing to find interesting and vibrant insights from HowardForums.
Best regards, Paul Scanlan Cofounder, President

So I guess everything is okay now. Thank you all for your support!

Once you get to Gold Rewards status, all your minutes last a year, but you need 1000 minutes for that. If you just get the smaller denominations, they expire after 90 days. It's on that page, and here:

http://wiki.howardforums.com/index.php/Refills_and_Gold_Rewards

I know about the firmware flashes, there is a very active mod group that I follow over at Howard Forums as well. I used their how-tos to re-enable a bunch of the features on my Moto e815. Unfortunately the Razr belongs to my wife and if she were to end up with a pretty pink paperweight thanks to my l337 f0n3 h4xor sk1llz, I'd be a dead man!

I finally broke with Verizon and switched to T-Mobile, partly because the Verizon phones are impossible to hack without breaking through the wall of Get It Now. Verizon's entire business model would seem to be antithetical to Google's stated desire (with $billions behind it) to open up the wireless spectrum to any device, and to put the device owner in control.

In fact, it's not surprising that the article notes that "Google had already made significant progress in recent months with" T-Mobile. While not perfect (my daughter's phone won't let her use anything but $2 downloads for ringtones), T-Mobile is at least based on a more open technology (from what I understand). The surprise is that Verizon would even talk to Google at all. Maybe they aren't -- the article is based on "people familiar with the matter". Those "people" could be from Google, trying to kick-start talks with Verizon by putting the news on the CEO's front porch via the WSJ.

Verizon for sure disables many of the bluetooth (and other) features of their phones. If you are feeling brave, you can go to howardforums.com, look up your make/model of phone and see if they have instructions as to how to enable these features. You do run the risk of bricking your phone, you most certainly will void your warranty, and Verizon will not even look at the phone if you bring it into the shop, but you can hack the phones to turn on all the features that they disable.

They don't disable the USB capabilities. Apparently you need to do a "seem edit" to be able to copy ringtones to the V3m (link), but it connects via USB and communicates with the PC just fine.

That's interesting you would list those features... since Sprint's SERO (google it, wealth of information on http://www.slickdeals.net/ http://www.fatwallet.com/ http://www.howardforums.com/ provides just that kind of cellphone service for those who sign-up with Sprint's not so secret discount plan.

My SERO Plan:
$30/month
Unlimited data, EVDO rev. 0, rev. A when it is out. (I bought the HTC Mogul)
Unlimited text (promotion until 9/29, probably extended).
500 minutes, 7PM nights & weekends

I did play the upgrade game from the PPC 6600 to the HTC P4000 which is basically just an updated PPC 6600 (Telus Mobility). Is the P4000 just a Trinity wearing a funny hat & WM5?

After frying my first PPC6600 I actually found a XV6600 cheap on ebay and worked some magic (Thanks Howard forums!!) to replace the PPC6600.