Modding the Asus EEE 4G Surf for an External Antenna


Here at Security Weekly we have this thing for wireless of all kinds. Wireless cards, cables, antennas, 802.11, RFID…the list goes on. We’re always on the lookout for something neat and useful. We found that in the Asus EEE line of netbooks. They are small, usually feature Atheros wireless cards, and have a huge modding community. The small form factor is also something that works well for wireless assessments, whether covert or sanctioned. The size is conducive to easy transport in a small space or as a second laptop while traveling.
To those aims, the Asus 4G Surf (amongst others in the EEE family) works well, however the small internal wireless antennas don’t offer much flexibility or range. We need to take some cues from the EEE modding community and extend the hardware to support a better antenna. So, here’s how to add an external RP-TNC antenna connector to the Asus EEE 4G Surf.
Tools and parts you will need:

  • A small Phillips screwdriver
  • Electrical tape
  • A drill and appropriately sized drill bits
  • A flat instrument for gently prying the case apart (such as a plastic putty knife or a fingernail)
  • A u.FL to RP-TNC pigtail (about 6 inches works well)
  • First, we need to get this little machine open. To do that we need to remove the memory door cover on the underside by removing two small Philips screws.

    Memory door screws

    Then we need remove the rest of the screws on the underside of the case. While we are there, remove the battery and set it aside.

    6 screws on the outside edge

    Once removed, we need to remove the keyboard to access the screws underneath. To do this, loft the rear of the keyboard and push in the 3 small retaining tabs (near the screen). The keyboard should lift up from the rear allowing you to carefully disconnect the ribbon cable in the front.

    Be careful!

    Removing the keyboard will reveal several screws on the metal plate underneath the keyboard.

    9 screws. This will void your warranty.

    Separate the top section of the case from the bottom; start at the bottom right and work your way around to the screen and down the left hand side. Once you reach the left hand side, rotate the top of the case slightly in a counter clockwise direction in order for the case to make it past the ethernet and sound ports.
    Once the top has been separated, remove the main board from the case to access the underside of the board and wireless card. Next, remove the several small cables to separate it from the case.

    Display connector
    Fan connector
    Last but not least, the speaker

    Last but not least, remove the microphone from the case. It should pop out easily and stay attached to the board.

    Speak to me!

    All that is left holding the board hostage in the case are three small clips at the front edge of the laptop. Pushing the tabs aside with your finger will liberate the board.

    There are 3 of these tabs along the front edge…

    In order round the corner on our hack, we will also need to separate the display from the base. This will allow for safety while drilling the hole for the RP-TNC connector and allow us to wedge it all back together. The display can be removed by removing one screw from the outer edge of each hinge and then it should lift straight out.
    I found an interesting place for the RP-TNC connector. At the right hand edge of the laptop, what appears to be the “hinge”, there is a small silver disc. This disc is just a sticker; peel it off and we are left with a spot that looks as if it was made for the connector. I used my handy drill press in the workshop to create an appropriate hole where the sticker used to be (I believe that it was 5/16ths of an inch). This could certainly be accomplished with a hand drill as well.

    Episode IV – A New Hole

    Due to the cramped quarters in this section of the case, I had to route the pigtail connector for the external RP-TNC connector through the right hand display hinge. Fortunately, this is also how cables are passed into the display form the main compartment.

    Pigtail through the hinge

    At this point we can start the reassembly process. I found that it was easiest to attach the RP-SMA external connector to the case first, and then reinstall the display.

    Almost like it was meant to be there…
    Display reinstalled

    The final step before reassembly is to attach the u.FL end of our pigtail to the wireless card. I elected to leave one of the internal antennas attached, and placed a small piece of electrical tape over the other, and disconnected internal antenna connector. We don’t want this nice conductive connector inside of the case causing a short!

    Connected and ready to rock

    In order to complete the reassembly (just follow the disassembly steps in reverse, yes it is that easy), we need to modify the top half of the case in order to accommodate the internal parts of the RP-TNC connector. On the underside of the hinge cover, we need to remove a small bit of plastic. I did this with my Dremel and a small grinding stone.

    Remove this little bit right here

    Reassemble, and we are done! Attach an appropriate RP-SMA antenna of your choice and begin your assessments, now with more power!

    All done! Now we need an antenna…

    As a bit of an update, I quickly discovered that the location of the external connector was just a bit too tight. It pushed out the side of the case a little bit and as a result, compromised the connection on the inside of the connector. This quickly failed.
    I added some additional space to the outside of the case with a new connector, utilizing the same location. I added a spare dome shaped piece, with an extra large hole drilled on the inside to accommodate the flange on the external connector. Fasten the connector to the dome, and a little two part epoxy later and we have a solid connector with plenty of room. Here’s a look at the final result:

    Almost looks like it belongs…
    It doesn’t change the footprint too much.

    Now, any idea where the dome shaped piece came from? Glad you asked! It was a plastic foot that was supposed to be affixed to the bottom of some piece of furniture. It met with all sorts of power tools in the workshop for holes, trimming and finishing. Now, what to use the three other feet on…?
    Enjoy! Let us know how your hacks turn out.
    – L


  • EEE 4G Surf from Asus:
  • EEE User Forums:
  • FAB Corp u.FL to RP-TNC Pigtail
  • Larry Pesce

    Larry’s core specialties include hardware and wireless hacking, architectural review, and traditional pentesting. He also regularly gives talks at DEF CON, ShmooCon, DerbyCon, and various BSides. Larry holds the GAWN, GCISP, GCIH, GCFA, and ITIL certifications, and has been a certified instructor with SANS for 5 years, where he trains the industry in advanced wireless and Industrial Control Systems (ICS) hacking. Larry’s independent research for the show has led to interviews with the New York Times with MythBusters’ Adam Savage, hacking internet-connected marital aids on stage at DEFCON, and having his RFID implant cloned on stage at Shmoocon. Larry is also a Principal Instructor and Course Author for the SANS Institute for SEC617: Wireless Penetration Testing and Ethical Hacking and SEC556: IoT Penetration Testing. When not hard at work, Larry enjoys long walks on the beach weighed down by his ham radio, (DE KB1TNF), and thinking of ways to survive the impending zombie apocalypse.

    Get daily email updates

    SC Media's daily must-read of the most current and pressing daily news

    By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.