LTECruiser: An Extremely Low Cost LTE Experimentation Framework

LTECruiser turns a 14€ LTE USB dongle into a firmware experimentation platform for cellular protocols and baseband security research. In this talk, we show how the ML307A, an inexpensive USB LTE Cat. 1 modem sold for IoT use by ASR Microelectronics, can be repurposed into a practical research platform through public firmware artifacts, an exposed diagnostic port, existing vendor tools and AT command interfaces. Starting from the ELF firmware with debugging data available on GitHub, we document the internal code structure of the LTE modem by analyzing its boot phase and the related paths for handling received/transmitted data from the layer 1 co-processor, we then build a cross-platform userspace framework for Linux and Windows to communicate with the modem through AT commands, dump memory, patch live firmware and inject custom ARM32 code at runtime. We then use these primitives to explore the baseband code and demonstrate how this ultra low cost device can be pushed far beyond its intended role, showing the implementation of a LTE sniffer through firmware patching in a controlled environment. The result is an extremely cheap, widely available and practical platform for LTE security research based on commodity off-the-shelf (COTS) hardware.