Mobile networks have many disparate types of devices. You can probably guess what some of them are, or even go to the provider’s store or kiosk and get a list. But there are going to be more devices out there. So why not scan the IP addresses on your subnet?
Well, the access points for mobile networks generally don’t allow promiscuous access. So you may have to go to ARIN and other lists in order to start getting some ranges to check. You can also check access logs of a Website to find visitors with mobile devices. (Of course, there is always the NATting that the providers do, not to mention DHCP, and the fact that most mobile devices don’t run servers or services.)
Colin Mulliner did manage to find a fair amount of interesting stuff. Windows Mobile tended to be a useful source of open ports and services (usually open FTP services on mobile devices). He also found and was able to identify a number of specialized devices that were identifiable from responses to probes. Some of the most interesting were mobile access points: connecting to the mobile networks and then providing local wifi for computers. Others were HTTP servers for surveillance cameras. (Others were GPS tracking devices which, oddly, had no security against “guest” login :-)
