Help an idiot with a not working MoFi 4500

[Tim65]

Have had a MoFi 4500 for a year and a half or so, with a t and t for the service. Has worked great, have had to reset the module a time or two but for the most part worked flawlessly. Got to California set it up worked great, went to work and when I got back no connection at all. I have reset everything I can think to and done a factory reset with out any good results. Any advice? Any advice on what could be bought that would work better than this for gaming and some streaming?? I just want it working so I don’t lose my mind in my off time. Thanks!

[Didneywhorl]

What plan are you using for your service?

Does the device connect still, just no internet?

What signal stats are you getting?

Need more info.

[Tim65]

Still registered a signal but no internet, a decent signal if I remember correctly. It worked one evening and then nothing the next. I can jump and on it tonight and get actual numbers if that will help.

[BillA]

Still registered a signal but no internet, a decent signal if I remember correctly. It worked one evening and then nothing the next. I can jump and on it tonight and get actual numbers if that will help.

If you still have the old ATT tablet/iPad plan make sure the APN is set to "broadband" or alternatively "nxtgenphone".
There are lots of reports online that ATT is clamping down big time on router usage especially on their newer $65/$75 prepaid plans. As an alternative, you may want to choose another carrier from here > https://wirelessjoint.com/viewtopic.php?p=5790#p5790

[Chungus23]

If you still have the old ATT tablet/iPad plan make sure the APN is set to "broadband" or alternatively "nxtgenphone".
There are lots of reports online that ATT is clamping down big time on router usage especially on their newer $65/$75 prepaid plans.

If you got the APN down, the TTL changed, and the IMEI changed, can a carrier really do anything? They might only terminate your account on the basis of extreme usage but how would they be able to find out you're actually using a router device instead?

[BillA]

If you got the APN down, the TTL changed, and the IMEI changed, can a carrier really do anything? They might only terminate your account on the basis of extreme usage but how would they be able to find out you're actually using a router device instead?

FYI, they still know based on the excessive usage along with the UA of desktop browsers, and other modem parameters sent to the network besides the illegal imei change. With moderate usage it may fly under the radar, or it may not.

[Chungus23]

Can that UA detection be circumvented by going through a VPN? Either way, what are the chances they would detect past that and look at modem parameters? I dont think the average AT&T employee even has the tools to do that. It would be an issue if they did a serious investigation and idk how often that happens. Even when they shut down the $35 ipad plan, a lot of people using 1 tb+ didn't get shut down.

[Tim65]

I usually averaged around 700-800 gigabytes a month when we were not working 7 days a week but I did that for almost 2 years Soo idk maybe I got hit in part of this crack down hard to say. Has anyone used nolimitdata.net? They are somewhat cheaper than unlimited ville, also is unlimited ville all it claims to be or is it easier to just go get a Verizon SIM card or t moble or what ever and run that?? I hate to spend extra money I don’t need to

[56387f]

If you got the APN down, the TTL changed, and the IMEI changed, can a carrier really do anything? They might only terminate your account on the basis of extreme usage but how would they be able to find out you're actually using a router device instead?

Just to add a bit to BillA's answer.

Whether or not it is possible to identify a device attached to the network is not a question - ABSOLUTELY. If this a Windows computer then one can just look at DNS requests (i.e. no Deep Packet Inspection is required , just a DNS log unless something like DNSCrypt is in use but even then it will not help a lot - it will hide DNS requests/replies but IP addresses still will be in the log, therefore actual names of visited domains can be easily restored) and he will see immediately such things as "wdap.lan" "isatap.lan" "dns.msftncsi.com" "download.windowsupdate.com", all domain names related to Windows telemetry and much more.

For example the domain name "dns.msftncsi.com" is used by Windows to determine if Internet connection works and this is the first DNS request sent by Windows to the outer world.
https://www.techrepublic.com/blog/data- ... in-common/

or

https://www.pcworld.com/article/3105998 ... ised.html

The question is whether or not a particular provider will bother to deal with that at all. Like BillA's said in case of moderate usage it may fly under the radar otherwise they will figure our the truth in a minute either after checking the logs or just watching the live communication.

[56387f]

Now regarding MOFI.
This is not a silent device by any means also.
First thing it does after reboot it tries to resolve the domain name "router.mofinetwork.com" After that it tries to download 2 config files - one with the name "1.config" and the second one using MOFI ID as the name. They do it over plain HTTP and try to download the files and this is a silly but serious security threat / vulnerability because it can be misused in several ways.

The fact that the device is trying to download a config file with predefined name means that this is some sort of a global config file, i.e. all devices with the same firmware will try to get it after reboot (so much for a "personal device" ). And in case of DNS cache poisoning or something similar a malicious config file will be uploaded to all customers devices.
I turned off all MOFI business features (just don't need them) but MOFI still called home until I took some more drastic measures. I tried to contact MOFI customer support asking about this "feature" but did not get any reply - which is not surprising at all, all things considered.
Secondly, MOFI uses 3 hardcoded IP addresses of their data centers (i.e. not domain names but actual IP addresses). Therefore as long as one knows what to look at in the communication log of MOFI, the device can be easily identified.

[56387f]

And finally, regarding the 7455 modem in MOFI.
BTW, if one wants to see how MOFI interacts with the modem he can simply login to MOFI using SSH, open minicom session and use the MOFI GUI - all AT commands sent to the modem will be printed/echoed on the screen. But having an opened minicom session will add some delay to the exchange between the GUI and the modem therefore some features like "band scannig" will not work - the GUI will report on timeout because the modem tries to output a lot of information and it obviously extra consumes time.

I dont have the right equipment to monitor mobile WAN therefore the next statement is just my educated guess.
I can clearly see that MOFI periodically sends to the modem 2 AT commands:


AT+WDSC=3,15(15 minute)
AT+WDSS=1,1 (Sends initial heartbeat immediately

The first command is configuration of AirVantage Management Services.
https://source.sierrawireless.com/airva ... ime-ForAV/

If I understan it correctly it basically polls the remote network server. That server(s) can be easily identified and therefore if your device is periodically sets connection to the server then it means that this is Sierra Wireless modem and not your Samsung smartphone.

Now funny part, since someone mentioned IMEI.
Imagine that you changed IMEI of your modem (which is illegal in U.S.) but it still calls home every minute or so. I am pretty such S.W. has a log devices checking for firmware updates. And those modems with weird IMEI still checking for Sierra Wireless firmware updates will look more than just suspicious. Just a theory...

[bukzin]

If you still have the old ATT tablet/iPad plan make sure the APN is set to "broadband" or alternatively "nxtgenphone".
There are lots of reports online that ATT is clamping down big time on router usage especially on their newer $65/$75 prepaid plans. As an alternative, you may want to choose another carrier from here > https://wirelessjoint.com/viewtopic.php?p=5790#p5790

Is there a list of all (most) of the APN’s somewhere?

[BillA]

Is there a list of all (most) of the APN’s somewhere?

It's all over this forum, just search for it or google it.
For example "ATT APN" or "Verizon APN" etc.

[bukzin]

Gave that search a try but came up empty.

Since Mobley is an ATT hotspot product maybe a standard ATT APN would work?

Any thoughts?

[JimHelms]

Gave that search a try but came up empty.

Since Mobley is an ATT hotspot product maybe a standard ATT APN would work?

Any thoughts?

The AT&T Mobley plan uses the APN:

Code: Select all

broadband

Since your question is off topic to this post, please start another topic if you need more information.

[blee0518]

Now regarding MOFI.
This is not a silent device by any means also.
First thing it does after reboot it tries to resolve the domain name "router.mofinetwork.com" After that it tries to download 2 config files - one with the name "1.config" and the second one using MOFI ID as the name. They do it over plain HTTP and try to download the files and this is a silly but serious security threat / vulnerability because it can be misused in several ways.

The fact that the device is trying to download a config file with predefined name means that this is some sort of a global config file, i.e. all devices with the same firmware will try to get it after reboot (so much for a "personal device" ). And in case of DNS cache poisoning or something similar a malicious config file will be uploaded to all customers devices.
I turned off all MOFI business features (just don't need them) but MOFI still called home until I took some more drastic measures. I tried to contact MOFI customer support asking about this "feature" but did not get any reply - which is not surprising at all, all things considered.
Secondly, MOFI uses 3 hardcoded IP addresses of their data centers (i.e. not domain names but actual IP addresses). Therefore as long as one knows what to look at in the communication log of MOFI, the device can be easily identified.

None of what you said makes sense.... A public static ip is not a security issue.

[56387f]

None of what you said makes sense.... A public static ip is not a security issue.

Excuse my french but where did I say or imply that "A public static ip is a security issue" ????