Part 7: Security Reflections and Wrap-Up

The RG2100 turned out to be a very hackable little hotspot. This final part collects the security lessons and summarises the full chain.

What went wrong with the design

This was an enjoyable device to work on, but it has some obvious security problems.

SIM unlock. The unlock code should not be derived from public device fields with a static string and SHA-1. Anyone with the IMEI and model can generate it.

Hidden web interfaces. Passwords for engineering and service pages should not be static strings buried in binaries.

ADB exposure. ADB should not be one USB mode change away from a passwordless root shell.

Update signing. Recovery should not contain the private key used to validate update packages. If the signing key is extractable from the device, the signature is not a meaningful trust boundary.

Packaging robustness. Recovery’s FOTA scripts should handle filenames robustly. A single AppleDouble sidecar file was enough to derail the whole update flow before the updater-script even ran.

SSH if intended. If SSH is meant to exist on these devices, it should use modern host keys and a properly managed authentication flow, not legacy Dropbear binaries and ssh-rsa.

The full chain

1. Find command execution in the web firmware upload endpoint via shell expansion in the uploaded filename.
2. Use logger and callback HTTP requests to turn that into a practical command-output channel.
3. Turn the same bug into a reverse shell.
4. Use the web shell to change the USB composition and expose root ADB.
5. Dump and inspect the filesystem.
6. Reverse the SIM unlock code path in QCMAP_Web_CLIENT.
7. Apply the model-aware SHA-1 unlock formula.
8. Carefully debrand with fti_factory_reset.sh DEFAULT perm,all,reboot.
9. Analyse recovery, FOTA, PAC packing, encryption, and signatures.
10. Reuse Dropbear from an older Franklin firmware.
11. Build a small signed OTA that installs only an SSH service and runtime files.

Practical takeaway

The OTA system is script-driven. A carefully built package can add or replace a small number of files without flashing full images or touching the modem or boot partitions. That makes controlled modifications possible, but it also means the integrity model is only as strong as the key handling. On this firmware, the key handling is not strong.

Series index