Verizon CDMA femtocell
Verizon Samsung SCS-2U01 is a very famous target for many hackers,while as Harald said in 32C3,none of them even thought about running a local network upon it.Verizon is phasing out its CDMA network,it's time to play with these valuable blackbox
It looks like the IS95 core network is a bit simpler than 3GPP network,however,there is no project about IS95 at all,Neither the data PDSN nor the IS95 MSC.
The procedure here seems to be ok.
The console is located on the HDMI connector at the bottom. Tx on R202, Rx on R198. TTL 3.3V, 115200,8,N,1
There is no antitamp.