[Hardware Hacking General] videshii:
Hi everyone,

Without wanting to give away too many details, I work for a company that recently purchased some of these Huawei B882-66 LTE routers, as we have some clients who need to get on the internet in areas where it's not easy to get a real line. We set one up recently along with a laptop we provisioned for them - and there are some crazy download/upload values happening over the LTE data that are not only costing a lot - they should be impossible. I just came into this position, this having been done before my time.

Basically, ~6gigs is being downloaded over a course of 10 minutes without any activity being done on the laptop itself, there are no other connections to the router (wifi disabled, hard line), and since metering is enabled... I'm at a loss. The IP is charging for this data - so it's real data, not just some bizarre UI issue.

So here's what they did, basically:

Laptop:

- Laptop has Windows 10. Fully updated before provisioning, though another update dropped a few days later.

- Only Chrome and Firefox installed. No McAfee, no Office - nothing else. Windows 10, Chrome, Firefox. That's it. Bare bones.

- Metering set on the ethernet. So: Win 10 updates shouldn't be happening.

Shouldn't.

Router:

- Wifi totally disabled. Hard line only.

- SIM card purchased by user through the IP. Administrative access to the account given to two other people - and we have been assured that their accounts were not migrated, their devices are not connected to this particular account. The only device on this account is this router, according to the IP... Whom, admittedly, I doubt.

- This router was purchased by a third party vendor and NOT through the IP. So, knowing Huawei's security issues, I'm raising one of my eyebrows very high in suspicion.

I don't have a lot of access here, because I'm not the IT guy, I just happen to know my way around. I would love to packet-sniff what this router is up to, but I basically don't have the time, and it's not my network so I don't want to step on toes. So I did pretty much the only thing I have access to right now - I took an old DLink we're not using, hooked it up to the WAN port of the B882, used an old laptop that I can safely wipe to get into the DLink's wifi, and watched the traffic over the hard line. There is NO SIM card installed at all. So, there is no chance for it to attempt to send over cell data.

It's attempting to send 1.52kb-2.10kb every 30 seconds through the WAN port, constantly. Now, I figured this is a "hello, where am I?" attempt or handshake... but there's no SIM card and no device connected to it, so doesn't that seem like a high amount of data to essentially contact nowhere, for no reason? Again - I'm not an expert. That's why I'm asking the forum where I found a hacking guide for a previous Huawei router.

Either way - the router we provisioned is sucking up cell data at an unbelievable rate. Their cap was 7gigs, and that was reached in 10 minutes through an already-updated bare-bones laptop. Nothing else is connecting to that router, period. Metering is enabled... But perhaps it's being ignored?

My worry is that those large chunks of mysterious data are Bitcoin blocks, or something to that effect. It's also sending at roughly 1/5 the rate it's downloading... To where, and why, I have no idea. Can I get some opinions on this? I think I'm just going to return and work with other routers, or maybe some simple USB sticks, but I would love some opinions.