Every carrier stores your location under data retention laws.
They call it national security. We call it mass surveillance.
Privacy is not a privilege. It is a right they chose to violate.
The problem
Your Mudi broadcasts four unique identifiers every second. Each one is a thread. Pull any thread and you unravel the user: IMEI ties them to a device, BSSID pins them on a map, MAC links their sessions, client DB inventories their contacts.
Attack surface
IMEI
Hardware serial. Persists across SIM swaps. Retained by carriers. Links all identities to one device.
BSSID
In every beacon frame. Indexed by WiGLE, Google, Apple. Passive collection = GPS coordinates.
WAN MAC
Visible to upstream APs. Static across reboots. Correlates sessions across locations.
Client DB
Every connected device logged to flash. Seizure = complete device inventory.
Carrier GPS
LPP/SUPL/RRLP: carrier silently requests your coordinates. Modem responds without user consent.
System logs
syslog, dmesg, shell history. Device seizure reveals full IMEI change history with timestamps.
Countermeasures
| Vector | Exposure | Action |
|---|---|---|
| IMEI | Carrier tracking | Band-aligned TAC prefixes + Luhn-valid serial (random.choices, 10^6 keyspace) |
| BSSID | Geolocation DBs | Randomized every boot |
| WAN MAC | AP logging | Randomized every boot |
| Client DB | Device seizure | Shredded + tmpfs (RAM only) |
| Carrier GPS | Silent location | GNSS engine off; LPP, A-GPS modes and the Qualcomm izatcloud XTRA beacon refused via Quectel-documented AT commands — validated on EM060K-GL, re-applied at boot |
| SUPL | User-plane location | Blocked at network level: iptables DROP on port 7275 in both modes (trade-off: kills IPsec NAT-T) |
| Logs | Forensics | syslog, dmesg, shell history wiped at boot, after IMEI change, and at shutdown |
| DNS | Session correlation | dnsmasq cache flushed after IMEI change |
Procedure
Control
Every boot behavior is individually switchable since v2.3.0: wipe_logs randomize_mac randomize_bssid iptables_block gps_hardening — all enabled by default, matching the historical behavior. Toggle with red-merle-ctl config <name> on|off, inspect in status. Disabled steps are honestly reported as [OFF] on the boot OLED; GPS hardening runs backgrounded and waits for the modem.
Identity
The IMEI the modem reports is only half the claim. Its first eight digits, the TAC, name a device model, and a carrier can resolve that against what the modem announces about itself at every attach — supported bands, UE category, aggregation combinations. Two fingerprints to compare, one database join.
So a TAC pool is only worth what its entries are worth. Every prefix shipped here is verified against a public allocation database of ~255k entries: the model named in each comment is what that TAC is genuinely registered to. An unallocated prefix resolves to nothing at all, which is louder than not spoofing. An earlier release shipped pools that had never been checked and were largely wrong; they were replaced wholesale.
Pool
42 verified prefixes per modem variant, weighted toward portable LTE hotspots — same device class as the Mudi, so months without a single voice call look normal. Fixed home routers and 3G-only devices are filtered out: one cannot travel, the other cannot camp on LTE.
Filters
Claim a class, a brand or a model:
imei type hotspot, imei brand apple, imei model "iphone 15".
Also in the dashboard, with the trade-off written next to the control.
Native
imei native claims a GL.iNet TAC, the only
claim coherent with what the modem reports. The cost is that the prefix never changes, so it
links every session — a certain link against a hypothetical flag. Narrow use only.
What it cannot do
No host-side change alters the capability report. This module advertises nine LTE bands no Galaxy S21 has, B14 among them. TAC choice defeats the cheap query, not full fingerprinting.
Camouflage
LuCI themes
luci-theme-red-merle ships redmerle (dark red) and redmerle-hacker (green CRT), selectable under System → Language & Style.
GL admin panel
"Red Merle" and "Red Merle Hacker" entries in the palette dropdown (top-right), applied across the stock GL.iNet interface.
GL-native dashboard
Since v2.5.0 the RED MERLE sidebar entry opens /redmerle/ — a self-contained control page that follows the active panel theme: full status, hardening/LTE-only/GNSS toggles, boot options, random IMEI, AT log. Its CGI bridge validates the Admin-Token session against gl-session before touching the modem (403 otherwise). Since v2.7.0 it also runs the complete SIM swap sequence — radio off, interim IMEI, modem reset cycle, post-swap IMEI, log wipe, GPS hardening and DNS flush — where the LuCI modal only ever did the first two steps.
Branding
Combined GL.iNet + ☢ logo, versioned Red Merle header link (theme-native styling), RED MERLE sidebar entry, Red Merle row in System Info, footer copyright.
SSH banner
Branded /etc/banner on login. Every element is re-applied by the package postinst after a firmware upgrade.
Deployment
Validated on GL-E750 V2 (Quectel EM060K-GL, GL firmware 4.3.26, modem EM060KGLAAR01A11M2G). Other 4.x firmwares should work but display a warning during installation. If a firmware upgrade reset the OpenWrt packages feed (GL 4.x is OpenWrt 22.03-based), add it back first: src/gz openwrt_packages https://downloads.openwrt.org/releases/22.03.4/packages/mips_24kc/packages
Field notes
| Question | Answer |
|---|---|
| SMS in hardening mode? | Works via SMS-over-SGs — the standard LTE delivery path, including 2FA and bank codes. SMS-over-IMS is disabled with IMS. |
| Voice calls? | Impossible in hardening mode: no VoLTE with IMS off, no 2G/3G fallback with LTE-only. Irrelevant on a data-only router SIM. |
| LTE-only blocks SIM registration? | No. LTE-only restricts radio technologies, not network attach. Provisioning SMS arrives via SGs. |
| No LTE coverage? | In 3G/2G-only zones the modem will not connect until you revert. |
| Full revert? | red-merle-ctl hardening off restores the persistent modem NV settings: AUTO RAT, IMS, XTRA. |
Lineage
Fork of blue-merle
(Security Research Labs, 2022)
Upstream stopped at June 2025. Issues answered here that are still open there: #1 TAC/band alignment (open since 2022; raises the cost of the cheap query, does not defeat capability fingerprinting — see the readme), #82 carrier GPS tracking, #38 DNS flush, #35 configurable behaviours, #22 one-shot IMEI change.
Defects fixed: IMEI entropy loss (random.sample without replacement), syslog IMEI leak, 14-digit IMEI validation, bash-only shell code, and the eSIM daemon storing a stale IMEI on disk.
1,129 → 3,291 lines · 16 → 49 band-aligned TACs · 0 → 9 configurable behaviours · 1 → 2 dashboards · a full control CLI