Hacking the Verizon Network Extender

Ok! Here’s my first big post! LOL

We live in Canada, and I’m sure it’s not hard to believe that where we are located there is no cell phone service of any kind!

And if you didn’t understand what I just said I’ll say it again, WE DON’T HAVE ANY C ELL PHONE SERVICE OF ANY KIND!

Over the last year I have been keeping track of the OpenBTS project, but the hardware was rather pricey coming in at about $1200. (But it sounds like some lower cost hardware is on the way GAPfiller)

Anyways when I first saw the verizon network extender for $250 I was very interested!

But as I read through the spec I found one thing that just wasn’t going to work.

The Verizon Network Extender has a very nice little GPS unit built right in, Here’s what Verizon has to says

Why does a Network Extender require Global Positioning Satellite (GPS) service?

The Network Extender uses GPS service to obtain time and the device location information. Location information is used to support Emergency (E911) service.
Well if it stopped there it would be fine with me! But there’s more!
Can I take my Network Extender with me when I travel?
Yes. The Network Extender will operate anywhere Verizon Wireless offers wireless service, provided that there is a compatible broadband Internet connection. Refer to the Verizon Wireless coverage maps for details.
Well there’s just one little problem there “Verizon Wireless offers wireless service” well Verizon doesn’t offer service here or I wouldn’t be doing this! LOL
Opening it up!
So as soon as it arrived I went straight to hacking it:)
Here are a few things that amazed me!
  1. There was nothing saying not to modify this device!
  2. There was not warranty voiding sticker!
  3. The antenna used an SMA plug!

There are more things but I’m not going to talk about them yet.

When I got it open I found that the GPS was made by Trimble… Well despite that good luck I couldn’t find any information on the internet about it.

Three calls later Trimble told me that what I had was a Res-SMT

And that what it used to interface was TTL-Level NMEA or TSIP.

I also learned that the interface speed could be changed to what ever the programmer wanted!

Anyways to make a long story short, I managed to get some wires attached to the microscopic traces one the PCB,

but  I couldn’t ever get my TTL serial interface to give me any thing more then rubbish.

At this point I got my brother involved, he’s a very experienced C programmer and hacker!


He went right to work with a computer and an AVR.

Unfortunate for him,  he couldn’t get the precise timing correct without some better equipment.

So after some serious googleing  he found the “Best low cost logic analyzer” THE Saleane Logic analyzer

A few days later he was holding one of the cutest little devices ever!

After a few late nights of hacking/programing he had a AVR re-creating the GPS serial signals as it was in the US!

But bringing it back to Canada we found that there was more then just GPS blocking there was some IP biased blocking…

I guess you’ll have to wait until our next update to find out what happens!


21 Responses to “Hacking the Verizon Network Extender”

  1. Alex Says:

    This is very interesting. It seems like you were able to get pretty far with this, so kudos for all your work. I look forward to seeing if you can completely overcome all of the blocking and access Verizon from Canada.

    Best of Luck!

    • va7drm Says:

      Thanks for you comment!
      As you can see we get allot of fun out of hacking these kind of things! LOL
      I was just wondering how you found my blog! Has google already got me! 🙂 LOL
      I’ve got another update coming as soon as I have time to write it:)

  2. Alex Says:

    I was actually looking around on Google for someone who had hacked the network extender out of curiosity and I found your post on page two. It was actually exactly what I was looking for and super detailed with pictures too.

    Can’t wait to see what happens with that update.

  3. va7drm Says:

    Ok, I’ll try to do it soon!
    BTW Why do you always give a fake email address?
    I’d like to email you.

  4. Alex Says:

    Haha, you didn’t like fakeemail@fakeidtyfakefakes.com? Sorry about that, I guess its just a habit, but I used my actual one this time and in your other post too.

  5. Chris Says:

    I’m curious if you tried to use this before hacking it? I took mine to Dubai UAE and it worked great. Verizon certainly doesn’t offer service there, so I’m inclined to believe that either its a ‘north american’ ip block or something similar, rather than a GPS location check.

    • va7drm Says:

      Thanks for the comment! So you have it working right now?? That’s the same conclusion that we came to, so if I ever get some extra time I’m going to set up a proxy/VPN to the US.

  6. Zach Says:

    Hey there, could you help me out? I have a office in a underground cave complex, so there is no GPS down there… please email me at zmann7@gmail.com


  7. Tomasz Helenowski Says:

    This hack is exactly what I need. I frequently work in basements (radiation oncology centers) without a cell signal so I bought the unit to be able to use my cell phone since we have high speed internet access there. These are all in the USA where Verizon provides service if you stand outside. Of course, there is no GPS signal in the shielded basement either, so the unit becomes worthless.

  8. John Says:

    If there is a easy way to modify mine to take to Europe on vacation, I want to do it. I would never dial 911 from my hotel room (15-30′ from my network extender) If needed. we would just use the land line on the night stand!

  9. william Says:

    rage against the machine. You guys are patriots!

  10. Scott N. Says:

    I am taking mine to Germany un-hacked today… I will report back once I get there and plug it up.

  11. Danny Kesler Says:

    Were you ever able to successfully pass fake GPS serial data in to it? Also, which model of the samsung network extender were you using?
    I’d be happy to set you up with a permanent VPN link to the US if you’re still interested.

    • va7drm Says:

      Hello Danny,
      We did fake the GPS signal, but we still ran into problems including that the network extender checks the time against the server time, and if it’s off it won’t allow it to run. Also there’s some kind of IP blocking. Another interesting thing is that on the bottom there’s a serial port which we were able to gain access to the linux OS through, I didn’t want to take the time to really do stuff in it, but I’m sure it could all be done with software!

  12. Jacob Says:

    va7drm, have you been able to confirm if a us IP address via a VPN/Proxy with NAT will make this device work overseas?

  13. Harvey Says:

    I live in Miami and my extender is deep in building with any gps signal. would your fix work for me?

  14. Crus Says:

    I am curious if you gained any more progress on this project? What was the default IP and is there login credentials to login to the linux o/s?



  15. how to boost cell phone signal at home Says:

    Just as its name said, cell phone signal booster is used to boost the
    weak signals when you get into the weak situation. Power – MP3 on your Nokia E63 can download album information and
    art for each song it plays. Our system is also capable of running on ANY
    of our machines in our shop, as we are commonizing our holding throughout our enterprise.

  16. john Says:

    Why not just use a VPN proxy showing a US IP and connect the extender to that?

  17. Dustin Says:

    You could use a US based VPN service and a router with OpenVPN to force the web route through a US IP. The GPS hack plus the VPN should net you a little dome of US Verizon signal…

  18. Hbilt Says:

    I only just need the gps hacked since I am using in USA . I am in interior space and cannot get gps signal

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: