Ever wonder how LTE-based IoT devices communicate over the internet? I modified a Chinese GPS tracker that is in common use in the US and got the cell modem to communicate with internet systems other than the GPS tracker's cloud servers.

first video in series:

Our original tracking devices used SMS to communicate their location. It was basically a Nokia 5110, a GPS module and board in between to get the location data and then communicate it using AT commands via the Nokia!

Me and a @CarlotaBindner have been doing research in this area also, we released a white paper and spoke at @BlackHatEvents We will be releasing a white paper soon on weaponization of cellular for RSAC26 Keep up the good work !

Hot damn. Bet the comments in that firmware are *chef's kiss* "TODO: fix this later" - 2015

Years ago a Chinese tracking manufacturer sold thousands of units, problem is they all used the same either IMSI or ICCID ( can’t remember which ) as to avoid costs. Phone network caught on and disabled that one number, suddenly thousands of units stopped working.

Where software meets hardware, a new frontier opens: endless customization, building exactly what *we* need. Never been a more exciting time to be alive

Love your work, do Flock Camera next

depending on the model it might be possible to get it running with if you want to run your own reporting server or interface it with home assistant

Some tracking devices mobile comms you end up just NAT’d with internet access. Some just connect in to a private network with no internet access at all.

I always wondered if the bootloader on these devices has a hidden firmware that still calls home even if you flash with a custom firmware like you did. Thoughts?

TCP IP over GSM / UMTS / LTE networks

Mine just connects to T-Mobile that I pay monthly for. Keeps a warehouse online.

I don't get it? Your bypassing the modem? I just use a wave share 7060 with ESP32 and for SIM. Costs $30 and I have global HTTP, TCP, SMS connectivity. Is this just proof of concept ?

This is so cool

Is the device registered on a cellular plan? Also does it have a data plan?

love this. reverse engineering these trackers is always a rabbit hole. did you have to wrangle AT commands or did it speak some weird custom protocol?

Wait who pays the LTE bill?

Really enjoyed this !

You need t practice getting to the point far more quickly

@CapeCellular esim usb?

Ok now that is freaking cool. For a newbie like me - do you care to explain the hardware/software tool chain you are using?

Interesting

@pbeyssac