SFR femtocell This wiki is about the SFR Home 3G femtocell.

The purpose of this wiki is to allow others to verify our research, enable more security testing, and provide tools for further research in the 3G/UMTS field. It would also be great to be able to use this device for your own telecommunication network, similar to OpenBSC, even though this is unlikely to happen for various reasons.

All the findings only cover the first SFR femtocell (as depicted on the right), which uses the G2 board from Ubiquisys.

Product Description

Numerous GPL software is used. The operator fails to mention it on the product or provide the source, but the vendor was kind enough to hint us to their repository.






  • using the database for configuration
  • using the web interface and the html pages provided by Ubiquisys


  • short description and download of our tools

Presentation Material

NDSS 2012

Troopers 2011

Black Hat 2011

Demo Videos

You can find the videos of the demonstration presented in the conferences.


If you would like to send us bug reports, comments, questions, please contact us at via email.

The same is valid if you want to contribute to this wiki and need an account.


  • To flash the device we used the fact that the recovery rootfs (V2.1.1-DLG1_DLG1,2009-04-08 15:56:18) does not verify the recovery cert cert. This is not possible anymore though because the new recovery rootfs (V2.6.12.2,2011-07-20 14:49:28) does verify the certificate (using an included CA). In order to flash, you will have to provide the old recovery rootfs.
  • The remote root uses a stack buffer overflow in wsal from ubiqfs V2.0.23.1. This has been fixed with ubiqfs V2.0.24.1 as the code is not reachable any more (PUT request is prohibited).
  • Apparently the new recovery rootfs (V2.6.12.2,2011-07-20 14:49:28) or image locks the flash to prevent changing the main public key. This has not been verified yet.

Related Projects/Information


start.txt · Last modified: 2012/04/03 18:46 by femto
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 3.0 Unported
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki