But late that night, her laptop’s firewall logged an outbound ARP probe to a non-local address. Source IP: the S3 AC2100. Destination: a dormant IP that had just woken up for 0.3 seconds.

She downloaded the latest firmware from S3’s support site: S3_AC2100_v2.1.8.bin . The file size was 18.3 MB—slightly larger than the previous version. She fired up binwalk , the firmware extraction tool, in her Ubuntu VM.

Maya isolated the router from her network and spun up a packet capture. Within three minutes of booting, the router sent a UDP packet to that domain—resolved locally via a hardcoded IP in China’s Telecom backbone.

The payload? A 44-byte string containing the router’s MAC address, firmware version, and a surprisingly precise geolocation guess from surrounding Wi-Fi SSIDs.

She ran strings on it. Among the usual libc calls, one line stood out:

Her heart rate ticked up.