TL;DR: We reversed default WPA2 password generation routine for UPC UBEE EVW3226 router. This blog contains firmware analysis, reversing writeup, function statistical analysis and proof-of-concept password generator.

Parts: • • • • • • • • • Updates: •: data set analyzed •:,. •: Hypothesis rejection diagrams improved, link to presentation added. Introduction This work was motivated by the work of. Several months ago he published the algorithm ( ) generating candidate default WPA2 passwords for UPC WiFi routers using just SSID of the router. Vulnerable routers used just router ID to generate default WiFi password and WiFi SSID.

Algorithm goes through all possible router serial IDs and if SSID matches, it prints out candidate WiFi passwords (cca 20). To our surprise it worked pretty well in our city, where 6 out of 10 UPC WiFi around were vulnerable. But it didn’t work for newer router models and for my own. So we decide to look at this particular model if we were lucky to find the same vulnerability in it. Our modem is UBEE EVW3226.

Buy TECHNICOLOR TC8715D CABLE MODEM WIRELESS ROUTER GATEWAY TWC ONLY: Electronics - Amazon.com FREE DELIVERY possible on eligible purchases.

As I don’t want to experiment on my own home router I bought one from the guy selling exactly the same model. There are guys who managed to get root access to the router by connecting to the UART interface of the router. I recommend going through this article:. Lucky for us, we didn’t have to mess with the UART interface of the router even though I was looking forward to it. Just a day before I bought my UBEE router for experiments, Firefart on how to get a root on the router just by inserting a USB drive with simple scripts.

Tl;dr: If USB drive has name EVW3226, shell script.auto on it gets executed with system privileges. With this script you start SSH server, connect prepared USB drive to the router and enjoy the root.

Firmware Extraction With this I managed to dump the whole firmware on the mounted USB drive. The script we use to start SSH daemon and to dump the firmware is below. Infinite Undiscovery Xbox 360 Ntsc Downloads on this page. Note: for detailed instructions on preparing USB drive please refer to the original. Interface=ath0 bridge=rndbr1 dump_file=/tmp/hostapd.dump ctrl_interface=/var/run/hostapd ssid=UPC2659797 wpa=3 wpa_passphrase=IVGDQAMI wpa_key_mgmt=WPA-PSK Great, we have SSID and PASSPHRASE stored here. Something must have generated this configuration file. Firmware Analysis For more experiments, we use router-image-root.tar, extract it on local file system to look around. With this we find interesting binaries that have something to do with secath0 file.

Note this is naive approach, the thing you try first. Binaries might have been obfuscated so the strings won’t reveal anything. In this case, we were lucky. Sprintf ( buff1, '%2X%2X%2X%2X%2X%2X52415345', mac [ 0 ], mac [ 1 ], mac [ 2 ], mac [ 3 ], mac [ 4 ], mac [ 5 ]); It seems like there is a MAC used to derive multiple different outputs (SSID, PASSPHRASE) in the code, so to differentiate it for different uses, a different suffix is added to it. Free Download Pass4sure Registry Hack Programs For Minecraft. In fact, converted to ASCII it says UPCDEAULTPASSPHRASE. Sprintf magic string This resulting string got MD5 hashed: MD5 Hashing Just in case the hashed string had too much entropy, guys decided to do another sprintf, but cutting it down using 3 bytes of entropy at maximum (buff2 contains the MD5 hash). MAC + hex(UPCDEAULTPASSPHRASE) sprintf ( buff1, '%2X%2X%2X%2X%2X%2X52415345', mac [ 0 ], mac [ 1 ], mac [ 2 ], mac [ 3 ], mac [ 4 ], mac [ 5 ]); // 2.

MD5 hash the string MD5_Init ( & ctx ); MD5_Update ( & ctx, buff1, strlen (( char * ) buff1 ) + 1 ); MD5_Final ( buff2, & ctx ); // 3. Take 3B of the result, build a new string sprintf ( buff3, '%.02X%.02X%.02X%.02X%.02X%.02X', buff2 [ 0 ] & 0xF, buff2 [ 1 ] & 0xF, buff2 [ 2 ] & 0xF, buff2 [ 3 ] & 0xF, buff2 [ 4 ] & 0xF, buff2 [ 5 ] & 0xF ); // 4. MD5 hash the string MD5_Init ( & ctx ); MD5_Update ( & ctx, buff3, strlen (( char * ) buff3 ) + 1 ); MD5_Final ( hash_buff, & ctx ); // 5.

With Technicolor’s cable, telco and LTE modems and gateways INNOVATION IN OUR DNA Consistently first-to-market with innovative Connected Home technologies and services, Technicolor is working to deliver the technology of tomorrow in all our devices. Technicolor high performance wireless and ultra-broadband (DOCSIS 3.1, LTE, G.Fast and Fiber) technologies helps Service Providers deliver the connectivity to fuel new, bandwidth intensive content experiences. QUALITY & ON-TIME DELIVERY With powerful sourcing capabilities and efficient operations, Technicolor Connected Home offers a full array of best-practices in project execution and program management. Customers everywhere can depend on our flexible, scalable supply chain to ensure quality and on-time delivery. PARTNERSHIP PLEDGE As a committed partner in every technology transition, we are fully dedicated to our customers’ success.

As thought leaders, we are uniquely qualified to help Service Providers make the right decisions and map the right strategies. With key relationships and expertise at every stage in the value chain -- from content creation to consumption -- we offer the best partner ecosystem to extend Service Provider’s reach.