I'd like to safely analyze and test a T-Mobile UMG366 USB cellular modem. Clearly I'd like to know about this specific device, but more generally I've no idea how to deal with a complex USB dongle that may be compromised.

Do I just use a throw-away OS install/PC for the job and try to keep a close eye on what happens? Or is there a specific way to start out with a basic command set and work my way up?

Need I mention the device most likely contains a SIM card with a 56-bit key?


Yes, in general you'd use an air-gapped system that is specifically used for analysis (and not your daily machine for writing reports etc.).

There are many methods: Use a Virtual Machine, run the analysis OS from read-only media, run the analysis OS on write-blocked media, or re-image the analysis machine after use. What you use will depend greatly on the resources available to you, and your technical knowledge.

An easy way is to boot from a Linux CD or similar to do the analysis (disconnect physical drives and network interface devices if you feel that would be necessary).

If you're concerned about remote connectivity via cellular network, contain the modem inside anything that can serve as a Faraday cage to block the signal.

Finally, cellular modems are pretty cheap these days compared to the cost of your time required to analyze it. If you suspect it is compromised, and your objective is to have a good, working cellular modem, consider just buying a new one.

  • Wow, so simple, I'd been thinking some of this but hadn't put it all together. Definitely if there could be an untamed cell tower around I'll want to put it in a tin can or wrap it in tinfoil. But your summation is spot on. New hardware is the only way to go in this case. Even if it were pristine I can't protect it from future attacks with that SIM in it. – ebyrob Aug 14 '13 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.