Poking At The Femtocell Hardware In An AT&T Microcell

April 12, 2012 by Mike Szczys 52 Comments

Here’s a picture of the internals of an AT&T Microcell. This hardware extends the cellular network by acting as its own cell tower and connecting to the network via a broadband connection. So if you don’t get service in your home, you can get one of these and hook it up to your cable modem or DSL and poof, you’re cellphone works again. [C1de0x] decided to crack one open and see what secrets it holds.

On the board there are two System-0n-Chips, an FPGA, the radio chip, and a GPS module. There is some tamper detection circuitry which [C1de0x] got around, but he’s saving that info for a future post. In poking and prodding at the hardware he found the UART connections which let him tap into each of the SoCs which dump data as they boot. It’s running a Linux kernel with BusyBox and there are SSH and ROOT accounts which share the same password. About five days of automated cracking and the password was discovered.

But things really start to get interesting when he stumbles upon something he calls the “wizard”. It’s a backdoor which allow full access to the device. Now it looks like the developers must have missed something, because this is just sitting out there on the WAN waiting for someone to monkey with it. Responses are sent to a hard-coded IP address, but a bit of work with the iptables will fix that. Wondering what kind of mischief can be caused by this security flaw? Take a look at the Vodafone femtocell hacking to find out.

GSM Modem Means Wireless Serial Connections

April 6, 2012 by Brian Benchoff 33 Comments

By now, most of us have seen have seen one of those GSM to wi-fi hotspot bridges. They’re interesting devices, and being able to carry a small wireless router with you at all times is very handy. Surprisingly, we haven’t seen many builds featuring these portable wireless hotspots, something probably due to the effort in breaking out a serial connection on these devices. The people at Open Electronics decided to build their own small serial-enabled cell phone modem, a boon to someone wanting a serial connection to any place with a cell tower.

The Open Electronics GSM/GPRS/GPS modem includes a header for an FTDI USB serial chip and a GSM module. Plug one into your computer and after a few short commands into a terminal, you’ve got a serial connection to nearly anywhere in the world.

The cost of the setup is a little high – around 80€ or $100 USD – and you probably should buy more than one so you can also receive data. While it is more expensive than the XBee wireless boards we see often, this GSM modem isn’t limited to the 300 foot range of the XBee. We’ll probably see this in a high altitude balloon before too long.

Recorder Controlled Snake Game Played On A Nokia 6110

April 3, 2012 by Mike Szczys 7 Comments

Dig out an old cell phone, hit the dollar store for some plastic recorders, and build this sound controlled snake game for your next party. The project will be a snap for those comfortable working with microcontrollers, and a great learning experience if you’re looking to try your first Arduino project.

[László] and his friend call the project the Snake Charmer. As shown in the clip after the jump it uses music notes to direct the path of the solid line in the classic cellphone game of snake. But this isn’t just some PC-based rip-off. They’re playing on the actual cellphone. A camera points at the screen to project it for the enjoyment of spectators. The control scheme uses relays soldered to the pads of the four directional buttons. The pitches are being detected by a Max/MSP program, with the corresponding commands pushed to the Arduino via USB. Yep, it’s overkill but the point was to get this up and running quickly and with a minimum of work. We’d say they succeeded.

Actually, now that we think of it, this isn’t a two player game. Perhaps the recorder control concept needs to be applied to a more modern version of the game.

Continue reading “Recorder Controlled Snake Game Played On A Nokia 6110” →

Resurrecting A Cellphone With Blown USB Circuitry

March 27, 2012 by Mike Szczys 13 Comments

[Script] is pretty lucky. One of the engineers who designed his cellphone included over-voltage protection in the circuit. Of course you probably wouldn’t know about this if there wasn’t a service schematic available. But a bit of searching around let him resurrect the fried USB segment of his Nokia N900.

Now [Script] has been experimenting with portable solar power like the system featured at 25C3 a few years back. Unfortunately he made an error which routed 12V into the USB connector’s 5V rail. After this unfortunate mistake the phone would not longer connect via USB, or charge the battery. Luickly the N900 is a favorite with the hacker community (you can see all kinds of N900 related projects here at Hackaday) and [Script] found his way to their N900 Schematic page. Digging into page four he found part F5300 which is labeled 2.0A. He removed the PCB and shielding, and tested the part with a multimeter to confirm it was blown. A quick wire bridge got the phone charging again, but [Script] plans to position a new fuse as soon as he can source the part.

Who says these devices aren’t user serviceable? If we could just get our hands on more service schematics perhaps our gear would last longer.

Accelerometer-based Game Control Using An IOS Device Courtesy Of HTML5

March 26, 2012 by Mike Szczys 14 Comments

This game of Space Invaders is played by tilting your iPhone to the left or right. It’s a demonstration of HTML5 used to link devices in-browser. The only setup that’s required is for the base device to load up a webpage, then the control device scans a QR code (or just types in a link) to connect with the game. You can give it a try right now if you want.

It only works with iOS devices but we believe that’s because mobile Safari has the ability to poll accelerometer data and other browsers do not. If this was using on-screen buttons rather than the tilt controls it would work on any device that implements HTML5. The connection is facilitated by Node.js and Socket.IO. The QR code that is generated by the host machine’s page includes a unique ID which allows the control device to link with it. Once loaded, commands from the controller are sent via Socket.IO to the node on the host machine.

As with this HTML5-based sensor data application, we think this method is important because it allows control without the need for a standalone application. We’re hoping to see a lot of this in embedded projects in the future. By serving data to a smart phone or other device you remove to need for a physical user interface in your projects, which means you can make great things while spending less.

[via Reddit]

Heads-up Display Mounts On Brim Of Your Cap

March 21, 2012 by Mike Szczys 14 Comments

[Matt Kwan] says that coming up with a personal heads-up display wasn’t that hard. Well that’s because he made design choices that make all the difference.

The goal here was to add some augmented reality to his field of vision. He went with a baseball cap because it’s a pretty easy way to strap something to your head. You can’t see it from this angle, but the setup requires you to cut a rather large hole in brim. The image from a smartphone (HTC Desire Z in this case) which is situated with the screen pointing toward [Matt’s] forehead. The screen reflects off of a small mirror, guiding the image down through a Fresnel lens mounted in the hole of the brim. The image is reflected a second time by the plastic in front of his eyes which is coated with a slightly mirrored material. Since the image is reflected twice it appears right-side up, and the use of the Fresnel lens places the image out about 20 cm in front of his view. He tried to get some images of the effect, but we think you’ve got to see it in person before passing judgement.

This does away with the need to track head movement (there’s a few hacks for that out there though). Augmented reality software is used to turn the view from the smartphone camera into overlay data for the display.

[Thanks Tom]

Arduino Shield Includes Everything But The Kitchen Sink

March 21, 2012 by Mike Nathan 18 Comments

arduino-3g-shield

The crew at Cooking Hacks in Zaragoza wrote in to share a new shield they developed for the Arduino platform. There are a hundred different shields out there that do this and that, but we think their 3G/GPRS shield looks pretty slick.

The base shield contains a WCDMA and HSPA compatible 3G modem as well as a GPS receiver. The modem can be used with an Arduino, or plugged directly into a computer via USB, allowing it to be used any way you like it. The more advanced kit offered by the Cooking Hacks crew features a VGA video camera, as well as an audio kit that can both play and record audio.

One neat feature they were quick to point out is that not all network communications need to be handled by the Arduino. Simple transactions (HTTP/FTP/POP3/SMTP) can all be carried out by sending standard AT commands to the modem.

Now, the kits don’t come cheap, but we can’t help but be interested in seeing what applications people dream up with this shield at the helm. Cooking Hacks is a division of Libelium Communcations, but as they are the company’s “Open Hardware Division” there are schematics available should you be interested in rolling your own 3G modem instead.