Alcatel 9961 T-Mobile 4G CellSpot V1¶
Alcatel 9961 femtocell branded by T-Mobile. It supports UMTS and LTE.
Supported Bands: WCDMA B2, LTE B4.
Main SOC is Qualcomm FSM9950.
Power management: PMF9900
eMMC: THGBMBG5D1KBAIT 4GB
RAM: 4x H5TC4G63AFR-PBA
Ethernet switch: QCA8334
This device has tamper sensor. Looks like the tamper sensor is photodiode.
It is located on back side of PCB under power management IC.
To bypass this sensor covering it with black tape should be enough.
Under eMMC chip there are testpoints that may allow us to read and modify eMMC without desoldering it.
Network activity¶
All ports on WAN and LAN ethernet ports are closed.
After connecting device to network it tries to connect to ipsec tunnel initial-ipsecrouter.smallcell.t-mobile.com
IPsec CA certificate is:
Certificate: Data: Version: 3 (0x2) Serial Number: 3 (0x3) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = TMOBILE-USA, CN = TMOBILE-ROOT-GLINDA-MS-FAP-v01 Validity Not Before: Jun 8 23:02:09 2015 GMT Not After : Jun 7 23:02:09 2017 GMT Subject: C = US, O = TMOBILE-USA, CN = TMOBILE-SUB-CMS-GLINDA-MS-FAP-V02 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:9e:5b:fe:00:f3:98:c6:70:54:1e:cd:43:f8:ed: e1:1a:cc:c5:d2:ee:26:60:4e:9e:4a:74:20:cb:b5: 24:8d:34:df:13:d0:d3:e5:1a:23:07:29:45:9b:da: 2a:84:fc:10:d3:7e:d7:c9:01:19:fd:a3:ed:4e:11: 02:e6:ea:e7:0c:54:1a:48:bc:af:3d:c3:23:21:9a: f4:62:01:76:48:0f:30:63:e4:8b:2c:79:00:21:35: 52:cd:44:8d:17:6e:b5:2b:b0:93:75:3a:59:9b:98: f1:ce:33:ca:a7:ec:2d:a2:99:df:4b:8d:6e:75:92: 13:40:ae:22:c1:ac:b0:87:b1:1a:10:2d:68:22:2c: 8e:17:52:7b:fa:62:e0:8b:97:25:2d:7e:bd:f6:1e: 7e:bd:12:54:35:e9:27:14:5b:8e:e5:a0:b6:9b:80: 23:37:49:2a:59:6f:8f:11:3e:36:bb:55:83:9d:4e: 36:4b:56:ea:44:83:fd:1b:dc:c0:05:34:e7:cb:98: 84:9a:8e:0f:0d:12:77:ef:3d:95:1c:13:40:8e:a7: e3:55:b1:30:59:20:a8:53:cb:0d:8c:8b:9f:10:40: 02:10:14:81:6a:cd:74:3c:44:81:c0:53:10:70:66: 11:00:fa:f4:76:a8:b5:8e:68:f9:86:32:df:8f:8f: ca:c6:cd:77:df:18:4c:3f:6a:df:40:1e:70:3d:c7: 16:d3:7d:b6:2d:5c:59:25:5c:f1:40:99:8c:b2:79: aa:6d:86:69:cd:f2:44:bd:9b:f2:bf:66:1f:62:e0: 0b:97:6d:a8:12:bd:a6:61:49:78:04:ee:bc:09:11: a8:79:e5:00:44:ad:ac:53:33:0f:1d:d8:f3:03:63: a3:b6:eb:a3:1b:03:db:74:2a:1f:eb:4f:fc:0a:ab: 25:05:42:08:55:d3:11:12:31:f9:c4:41:1c:75:30: cd:8d:1f:c7:fd:2e:b9:82:cf:3f:ad:ec:51:11:61: bd:ae:3b:b9:2e:4f:c0:39:73:f3:60:b3:d9:81:c1: da:ff:35:e9:31:0a:19:b3:97:ce:e2:5c:bf:e6:ac: 3c:f7:15:2e:af:25:f0:aa:8f:8d:28:5c:85:52:19: 8a:7e:f1:1c:d2:b8:8c:09:af:e3:51:e2:12:13:b3: cd:79:67:63:01:f4:d3:4e:28:e5:61:97:52:95:ee: 82:06:16:c7:1d:52:e0:d2:36:a2:4f:fa:77:0e:49: d0:f2:f2:e0:11:60:4a:ee:ce:be:8b:79:6e:3e:0f: 8d:ce:1d:0c:83:99:6a:77:cc:00:e9:ed:b7:d3:f4: 7a:9d:3f:4d:14:49:a0:ca:1d:bc:52:20:79:6b:bd: 6e:82:d1 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment, Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 83:93:E0:B5:3A:1A:1A:87:00:4D:6F:43:66:32:16:EF:39:F6:4C:3C X509v3 Authority Key Identifier: 8F:65:22:FF:69:6A:00:E3:00:E9:E0:11:49:13:88:5F:5A:5C:80:08 X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 X509v3 Certificate Policies: Policy: X509v3 Any Policy Signature Algorithm: sha256WithRSAEncryption Signature Value: 80:c4:af:ae:ae:b4:ad:ad:d6:44:c3:47:25:87:5e:c2:0f:91: 94:9f:e0:9a:b5:f8:42:7b:00:d8:83:6b:4f:0d:ac:10:7a:34: cc:fd:2b:6e:de:ac:b4:03:64:61:56:05:01:fa:b0:82:e8:05: 24:92:ee:ce:24:d6:34:4f:44:79:f0:9f:16:d8:2c:bb:18:55: 11:93:92:d9:79:8c:7d:45:a2:d7:1d:1f:75:be:7d:35:e8:36: d8:dd:bc:ce:c0:c1:a2:29:5f:11:d7:a3:3a:72:61:f1:d5:26: b4:84:fb:cf:f0:a8:c5:81:b4:38:d6:89:ae:81:be:39:22:fc: fe:3e:a3:15:74:4b:7b:91:65:f0:0c:fa:06:b2:f2:0c:34:6f: 29:ec:29:27:57:ba:3d:0a:6e:ea:61:53:04:38:89:55:b2:a7: 24:ac:97:05:90:6f:f5:b9:6d:3b:06:c1:59:0d:33:85:4f:63: 6e:47:d9:d2:89:27:9c:1a:8a:f8:a1:ac:34:8c:da:1a:7a:ff: c6:09:61:9c:e7:54:ed:3e:23:dd:e5:e6:bc:90:2a:8b:36:2a: 1b:eb:f2:f0:04:5b:40:e5:1c:5b:60:88:73:1a:6a:67:0a:74: 7a:a4:e5:77:a8:60:b6:3a:f7:33:00:8f:66:66:23:31:45:6a: b1:3f:3a:42:87:80:de:58:8c:06:7c:28:d8:36:e1:c4:9c:2f: 29:0f:8f:c8:88:60:ac:c5:f0:5c:1b:6d:ca:98:01:71:67:bb: 1d:a9:e1:1d:cc:33:f1:68:b4:42:81:cd:18:23:38:66:18:28: 27:f7:31:8b:de:ad:e6:21:77:4a:53:c9:97:08:73:88:35:d5: 56:b9:c0:e2:8b:7e:a6:be:87:c5:b2:75:7f:23:ec:94:13:78: 67:77:4e:1d:15:ef:be:46:85:99:3c:b7:6a:6e:97:c0:51:03: 8b:9c:de:5f:27:35:aa:f6:51:f5:13:6b:e0:be:e1:4c:c4:53: 9d:ef:fd:bb:33:30:4b:5d:79:4d:56:3f:6f:82:d1:d5:63:39: fb:d7:3f:c6:97:a5:92:41:e8:bf:a5:eb:b6:9b:2b:f5:a7:a7: 4a:84:3d:a0:40:36:6d:cb:07:ba:6e:3b:68:5b:be:33:81:a3: 4e:7d:bf:b2:0f:9d:f4:85:5f:e8:8b:08:a3:ca:9e:60:ca:6b: b2:22:96:9a:51:7c:c5:ef:17:71:4d:10:64:51:6f:5b:52:ca: e2:54:25:15:e4:65:37:5d:b8:02:89:30:32:99:8b:7e:72:8f: f1:33:df:41:8f:f8:a2:36:b8:d9:82:0d:35:41:95:39:9d:ce: 3a:75:ae:22:52:c0:6a:25 -----BEGIN CERTIFICATE----- MIIFjzCCA3egAwIBAgIBAzANBgkqhkiG9w0BAQsFADBMMQswCQYDVQQGEwJVUzEU MBIGA1UECgwLVE1PQklMRS1VU0ExJzAlBgNVBAMMHlRNT0JJTEUtUk9PVC1HTElO REEtTVMtRkFQLXYwMTAeFw0xNTA2MDgyMzAyMDlaFw0xNzA2MDcyMzAyMDlaME8x CzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtUTU9CSUxFLVVTQTEqMCgGA1UEAwwhVE1P QklMRS1TVUItQ01TLUdMSU5EQS1NUy1GQVAtVjAyMIICIjANBgkqhkiG9w0BAQEF AAOCAg8AMIICCgKCAgEAnlv+APOYxnBUHs1D+O3hGszF0u4mYE6eSnQgy7UkjTTf E9DT5RojBylFm9oqhPwQ037XyQEZ/aPtThEC5urnDFQaSLyvPcMjIZr0YgF2SA8w Y+SLLHkAITVSzUSNF261K7CTdTpZm5jxzjPKp+wtopnfS41udZITQK4iwaywh7Ea EC1oIiyOF1J7+mLgi5clLX699h5+vRJUNeknFFuO5aC2m4AjN0kqWW+PET42u1WD nU42S1bqRIP9G9zABTTny5iEmo4PDRJ37z2VHBNAjqfjVbEwWSCoU8sNjIufEEAC EBSBas10PESBwFMQcGYRAPr0dqi1jmj5hjLfj4/Kxs133xhMP2rfQB5wPccW0322 LVxZJVzxQJmMsnmqbYZpzfJEvZvyv2YfYuALl22oEr2mYUl4BO68CRGoeeUARK2s UzMPHdjzA2OjtuujGwPbdCof60/8CqslBUIIVdMREjH5xEEcdTDNjR/H/S65gs8/ rexREWG9rju5Lk/AOXPzYLPZgcHa/zXpMQoZs5fO4ly/5qw89xUuryXwqo+NKFyF UhmKfvEc0riMCa/jUeISE7PNeWdjAfTTTijlYZdSle6CBhbHHVLg0jaiT/p3DknQ 8vLgEWBK7s6+i3luPg+Nzh0Mg5lqd8wA6e230/R6nT9NFEmgyh28UiB5a71ugtEC AwEAAaN5MHcwDgYDVR0PAQH/BAQDAgGmMB0GA1UdDgQWBBSDk+C1OhoahwBNb0Nm MhbvOfZMPDAfBgNVHSMEGDAWgBSPZSL/aWoA4wDp4BFJE4hfWlyACDASBgNVHRMB Af8ECDAGAQH/AgEAMBEGA1UdIAQKMAgwBgYEVR0gADANBgkqhkiG9w0BAQsFAAOC AgEAgMSvrq60ra3WRMNHJYdewg+RlJ/gmrX4QnsA2INrTw2sEHo0zP0rbt6stANk YVYFAfqwgugFJJLuziTWNE9EefCfFtgsuxhVEZOS2XmMfUWi1x0fdb59Neg22N28 zsDBoilfEdejOnJh8dUmtIT7z/CoxYG0ONaJroG+OSL8/j6jFXRLe5Fl8Az6BrLy DDRvKewpJ1e6PQpu6mFTBDiJVbKnJKyXBZBv9bltOwbBWQ0zhU9jbkfZ0oknnBqK +KGsNIzaGnr/xglhnOdU7T4j3eXmvJAqizYqG+vy8ARbQOUcW2CIcxpqZwp0eqTl d6hgtjr3MwCPZmYjMUVqsT86QoeA3liMBnwo2DbhxJwvKQ+PyIhgrMXwXBttypgB cWe7HanhHcwz8Wi0QoHNGCM4ZhgoJ/cxi96t5iF3SlPJlwhziDXVVrnA4ot+pr6H xbJ1fyPslBN4Z3dOHRXvvkaFmTy3am6XwFEDi5zeXyc1qvZR9RNr4L7hTMRTne/9 uzMwS115TVY/b4LR1WM5+9c/xpelkkHov6Xrtpsr9aenSoQ9oEA2bcsHum47aFu+ M4GjTn2/sg+d9IVf6IsIo8qeYMprsiKWmlF8xe8XcU0QZFFvW1LK4lQlFeRlN124 AokwMpmLfnKP8TPfQY/4oja42YINNUGVOZ3OOnWuIlLAaiU= -----END CERTIFICATE-----
Device certificate is:
Certificate: Data: Version: 3 (0x2) Serial Number: 543956 (0x84cd4) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = TMOBILE-USA, CN = TMOBILE-SUB-CMS-GLINDA-MS-FAP-V02 Validity Not Before: Oct 20 21:17:33 2016 GMT Not After : Jun 7 23:02:09 2017 GMT Subject: O = Alcatel Lucent, CN = F83094020023595E.hnb.alcatel-lucent.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c5:71:f6:4c:a0:c6:a7:07:bf:44:09:0e:d4:70: 63:c5:98:8a:36:4f:98:f5:4d:20:75:d1:f7:95:fa: 20:6f:67:11:07:08:ca:1b:42:70:c5:92:d3:f4:3e: 81:49:d9:99:b2:df:7f:64:77:2e:b3:8e:c7:16:9a: a3:7b:8f:2c:4a:36:d0:f8:3b:5a:2e:32:3d:75:14: 89:36:80:22:dc:11:74:87:7a:c1:87:4a:85:fd:ff: ad:65:07:4c:5e:75:a7:4b:67:04:ed:eb:44:e8:ce: ea:4b:0e:57:25:e8:76:8b:e5:27:77:e3:98:38:0d: 86:59:fa:7f:74:c2:00:2e:cd:c3:0e:62:9c:e1:76: 3c:67:2e:6f:dd:45:e2:db:00:ce:04:7c:0c:77:2a: ee:45:5c:59:34:a2:c6:73:70:11:b2:07:c6:ee:af: 5b:aa:91:47:f2:9e:f2:32:54:1c:16:04:c3:ed:1e: 52:a5:ab:cb:13:5f:fc:e9:b7:37:6c:2a:47:2f:a7: 06:85:0a:9d:32:91:fc:24:9c:c9:06:0c:c7:d7:c0: c4:51:e3:b9:ec:f5:ee:b1:24:37:71:87:4d:c2:28: d2:f7:fb:fb:b1:09:e2:5e:5e:a6:84:70:75:3a:a1: 87:16:b4:30:37:42:38:e7:16:b4:a3:b5:d5:b0:d0: 71:2b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Alternative Name: DNS:F83094020023595E.hnb.alcatel-lucent.com, DNS:F83094020023595E.id1.hnb.alcatel-lucent.com, DNS:F83094020023595E.id2.hnb.alcatel-lucent.com, DNS:F83094020023595E.id3.hnb.alcatel-lucent.com X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Certificate Policies: Policy: X509v3 Any Policy X509v3 Basic Constraints: CA:FALSE X509v3 Authority Key Identifier: 83:93:E0:B5:3A:1A:1A:87:00:4D:6F:43:66:32:16:EF:39:F6:4C:3C X509v3 Subject Key Identifier: 55:48:7B:55:EA:71:B5:B1:C7:F4:69:22:37:F8:68:DA:E6:28:E7:D3 Signature Algorithm: sha256WithRSAEncryption Signature Value: 50:6b:5c:dd:ed:bb:79:67:2c:a4:26:e1:87:9a:fa:e9:e4:31: da:1c:be:e7:89:41:06:54:f2:15:58:79:75:96:80:99:3a:d1: 9a:59:2f:13:05:e0:3e:6c:9f:b4:0c:d3:5c:e8:78:af:24:3c: 9d:dc:62:a7:7d:3f:2f:3b:ed:58:d3:9a:0c:a8:15:b1:76:c1: 4e:ca:41:e0:dc:e1:42:c8:c3:8d:5e:31:5b:50:d1:f3:b8:b0: 0a:e7:98:a9:06:c7:62:39:a3:d1:04:a4:36:f8:90:12:11:5c: cd:77:4e:b7:e2:92:d4:6a:6f:8b:0c:7e:69:7b:2b:31:7c:30: ef:07:98:bc:06:20:bb:25:c8:a2:fc:66:a5:bf:9d:77:f6:d2: 0d:47:f0:87:03:a8:d0:66:63:dd:c7:e7:55:ec:98:61:a4:85: 62:98:79:40:c4:f5:bc:92:eb:95:23:49:df:f8:4b:d4:b1:7f: 7f:4c:42:7f:3e:bc:d6:91:ff:20:68:6c:12:05:69:56:c0:7f: 2c:a6:3e:05:aa:f2:c1:b7:e9:80:92:ba:87:9c:0c:66:87:4e: db:f4:fd:d7:b7:27:80:d0:85:6d:eb:70:7f:8c:5f:e1:56:ec: 9c:fa:eb:3c:72:78:ae:df:78:14:aa:49:aa:36:ec:ff:ea:b4: 41:fd:64:e0:81:2c:d3:27:15:ca:1e:8d:9d:50:8c:22:de:8e: 4e:50:4f:c4:b5:16:c3:09:b3:ec:1a:00:83:37:82:96:11:ca: fd:5a:e0:15:fc:d3:73:8e:de:e6:65:ec:56:d9:99:8e:17:98: 31:2c:21:6d:cd:16:4c:a7:b4:cb:4f:f8:56:88:03:f7:04:99: 82:c0:70:8e:a1:5c:70:83:2b:b2:11:24:f9:ae:df:de:8a:cf: 3f:98:8a:2b:da:ac:f5:7e:fa:f3:77:06:56:b7:bb:75:f5:35: a3:01:1d:40:c0:15:ca:29:0f:67:d9:d6:02:6f:74:6b:e5:86: 45:a9:f1:d6:e5:f6:92:7c:b9:14:b8:17:02:fd:a0:7a:b4:cd: 77:12:3f:a7:b4:44:83:c1:74:be:8a:94:54:bd:4d:02:70:a5: 45:d4:48:3c:86:fb:58:63:04:bb:d7:90:8a:5f:d7:8f:38:26: 43:3c:95:31:e5:a1:73:ae:45:d8:12:22:bf:f2:d5:da:c0:77: 0b:67:65:87:74:b5:ff:5e:64:52:90:69:a6:b4:e5:b2:82:9d: 43:3d:73:c8:7c:3c:5f:97:d8:cc:20:9b:e6:c4:38:8b:2b:d3: ca:3b:c5:54:03:41:de:c9:80:d7:f8:55:b4:68:7a:1c:b1:b0: 50:f0:a9:47:62:43:e7:f2 -----BEGIN CERTIFICATE----- MIIFRzCCAy+gAwIBAgIDCEzUMA0GCSqGSIb3DQEBCwUAME8xCzAJBgNVBAYTAlVT MRQwEgYDVQQKDAtUTU9CSUxFLVVTQTEqMCgGA1UEAwwhVE1PQklMRS1TVUItQ01T LUdMSU5EQS1NUy1GQVAtVjAyMB4XDTE2MTAyMDIxMTczM1oXDTE3MDYwNzIzMDIw OVowSzEXMBUGA1UECgwOQWxjYXRlbCBMdWNlbnQxMDAuBgNVBAMMJ0Y4MzA5NDAy MDAyMzU5NUUuaG5iLmFsY2F0ZWwtbHVjZW50LmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAMVx9kygxqcHv0QJDtRwY8WYijZPmPVNIHXR95X6IG9n EQcIyhtCcMWS0/Q+gUnZmbLff2R3LrOOxxaao3uPLEo20Pg7Wi4yPXUUiTaAItwR dId6wYdKhf3/rWUHTF51p0tnBO3rROjO6ksOVyXodovlJ3fjmDgNhln6f3TCAC7N ww5inOF2PGcub91F4tsAzgR8DHcq7kVcWTSixnNwEbIHxu6vW6qRR/Ke8jJUHBYE w+0eUqWryxNf/Om3N2wqRy+nBoUKnTKR/CScyQYMx9fAxFHjuez17rEkN3GHTcIo 0vf7+7EJ4l5epoRwdTqhhxa0MDdCOOcWtKO11bDQcSsCAwEAAaOCAS4wggEqMIG7 BgNVHREEgbMwgbCCJ0Y4MzA5NDAyMDAyMzU5NUUuaG5iLmFsY2F0ZWwtbHVjZW50 LmNvbYIrRjgzMDk0MDIwMDIzNTk1RS5pZDEuaG5iLmFsY2F0ZWwtbHVjZW50LmNv bYIrRjgzMDk0MDIwMDIzNTk1RS5pZDIuaG5iLmFsY2F0ZWwtbHVjZW50LmNvbYIr RjgzMDk0MDIwMDIzNTk1RS5pZDMuaG5iLmFsY2F0ZWwtbHVjZW50LmNvbTAMBgNV HQ8EBQMDB6AAMBEGA1UdIAQKMAgwBgYEVR0gADAJBgNVHRMEAjAAMB8GA1UdIwQY MBaAFIOT4LU6GhqHAE1vQ2YyFu859kw8MB0GA1UdDgQWBBRVSHtV6nG1scf0aSI3 +Gja5ijn0zANBgkqhkiG9w0BAQsFAAOCAgEAUGtc3e27eWcspCbhh5r66eQx2hy+ 54lBBlTyFVh5dZaAmTrRmlkvEwXgPmyftAzTXOh4ryQ8ndxip30/LzvtWNOaDKgV sXbBTspB4NzhQsjDjV4xW1DR87iwCueYqQbHYjmj0QSkNviQEhFczXdOt+KS1Gpv iwx+aXsrMXww7weYvAYguyXIovxmpb+dd/bSDUfwhwOo0GZj3cfnVeyYYaSFYph5 QMT1vJLrlSNJ3/hL1LF/f0xCfz681pH/IGhsEgVpVsB/LKY+BarywbfpgJK6h5wM ZodO2/T917cngNCFbetwf4xf4VbsnPrrPHJ4rt94FKpJqjbs/+q0Qf1k4IEs0ycV yh6NnVCMIt6OTlBPxLUWwwmz7BoAgzeClhHK/VrgFfzTc47e5mXsVtmZjheYMSwh bc0WTKe0y0/4VogD9wSZgsBwjqFccIMrshEk+a7f3orPP5iKK9qs9X7683cGVre7 dfU1owEdQMAVyikPZ9nWAm90a+WGRanx1uX2kny5FLgXAv2gerTNdxI/p7REg8F0 voqUVL1NAnClRdRIPIb7WGMEu9eQil/XjzgmQzyVMeWhc65F2BIiv/LV2sB3C2dl h3S1/15kUpBpprTlsoKdQz1zyHw8X5fYzCCb5sQ4iyvTyjvFVANB3smA1/hVtGh6 HLGwUPCpR2JD5/I= -----END CERTIFICATE-----
Debug ports¶
There are many test points on board of this femtocell, but I didn't found UART it is probably disabled by default.
Board photos¶
Updated by bcm61670 about 2 months ago ยท 3 revisions