Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 22

Thread: Sky router WPA algorithm available

  1. #11
    Junior Member
    Join Date
    Feb 2010
    Posts
    33

    Default

    Resurrecting this post

    Just some info.. here im Portugal, we have a new provider (a big one) "meo" how is now one of my greatest friends they only use those thomson routers, and their tecnicians (who do the installation in most of the cases) do not change the default wpa key.

  2. #12
    Senior Member ShadowKill's Avatar
    Join Date
    Dec 2007
    Posts
    908

    Default

    Quote Originally Posted by Krazy_Kaos View Post
    Resurrecting this post

    Just some info.. here im Portugal, we have a new provider (a big one) "meo" how is now one of my greatest friends they only use those thomson routers, and their tecnicians (who do the installation in most of the cases) do not change the default wpa key.
    What does this have to do with the Sky WPA algorithm?



    "The goal of every man should be to continue living even after he can no longer draw breath."

    ~ShadowKill

  3. #13
    Just burned his ISO
    Join Date
    Aug 2009
    Posts
    14

    Default

    Quote Originally Posted by slim76 View Post
    Cheers mate, i will keep an eye out for it!
    Ive got a couple of siemens gigaset routers from tiscali that use wpa2 as default, Ive noticed that their ssid's match the last six Characters/Digits of the routers mac address and that most of the wpa2 passkey seems to be made up from the mac address!

    Check this out and let me know what you think.

    ssid Tiscali 153BDB -- ROUTER MAC 002104153BDB -- PASSKEY B14B03B5B3D6
    ssid Tiscali 11ECCF -- ROUTER MAC 00210411ECCF -- PASSKEY F34C0EF1C7C5
    Quote Originally Posted by letmein View Post
    Mapping the WPa to the MAC address shows that the WPA key is made up as follows?

    MACS code digit
    1 - 12th digit of MAC
    2 - can't figure out - possibly connected to serial number?
    3 - 6th digit of MAC
    4 - 10th digit of MAC
    5 - 5th digit of MAC
    6 - 9th digit of MAC
    7 - 12th digit of MAC
    8 - 8th digit of MAC
    9 - 10th digit of MAC
    10 - can't figure out - possibly connected to serial number?
    11 - 11th digit of MAC
    12 - can't figure out - possibly connected to serial number?

    This works for the 2 combinations given, could be coincidence but unlikley... do you have any more we can check against (this is a call to all Tiscali BB users)? Have alook at the Serial numbers (or any other numbers on the router) the 3 missing may be on their. Either way of this works it would be pretty easy to work out the missing key digits through bruteforce once the handshake is a captured!!

    Let me know if this helps....



    i got one here, there its not working.
    its a tiscali gigaset one...

    ssid: TiscaliF4CB1D
    mac: 00:01:E3:F4:CB:1D
    Passkey: D87B0CD8B211


    can you create a list of working default passkey generators?
    i just know the sky and the speedtouch ones.

    hope this one helps

  4. #14
    Member
    Join Date
    Jun 2008
    Posts
    50

    Default

    Quote Originally Posted by bender01101 View Post
    i got one here, there its not working.
    its a tiscali gigaset one...

    ssid: TiscaliF4CB1D
    mac: 00:01:E3:F4:CB:1D
    Passkey: D87B0CD8B211


    can you create a list of working default passkey generators?
    i just know the sky and the speedtouch ones.

    hope this one helps
    The missing links to the Tiscali mappings above is that the 2 WPA key is always 1, the 10th is always 3 and the 12th is always 6.

    My guess is that the gigaset routers are mapped differently, or use the serial number as part of the alogrith, would need more gigaset routers to work with to try and figure it out......

    I only know of

    SKY V1
    Speedtouch
    Tiscali
    BT Home HUB

    My thoughts on the SKY V2/3 is to look at the make up of the serial key, maybe there are only a limited number of combinations, this combined with the MAC could lead to a shorter dictionary for use with Aircrack (or if really small could be done in a similar way to the BT HomeHub)

    Anyone know the make up of the serial on the routers? (I have one at home I'll look at later)


    I think this is the start of the mapping, need more gigaset routers (the one which MAC starts 00:01, instead of 00:21)

    WPA key
    12 th MAC
    always 8 - needs confirming
    always 7 - needs confirming
    10 th MAC
    3rd MAC
    9th MAC
    12 th MAC
    always 8 - needs confirming
    10 th MAC
    always 2 - needs confirming
    11 th MAC
    11 th MAC

  5. #15
    Just burned his ISO
    Join Date
    Aug 2009
    Posts
    14

    Default

    maybe the S/N is important.

    I will post it, when i am home.

  6. #16
    Junior Member imported_pingu's Avatar
    Join Date
    Sep 2006
    Posts
    40

    Default

    Hi, is this code or similar available for offline use, thanks.

  7. #17
    Member
    Join Date
    Jun 2008
    Posts
    50

    Default

    Quote Originally Posted by pingu View Post
    Hi, is this code or similar available for offline use, thanks.
    The code for what, the Tiscali router is clearly stated?

  8. #18
    Junior Member imported_pingu's Avatar
    Join Date
    Sep 2006
    Posts
    40

    Default

    I am enquiring about the availability of the Sky Router WPA algorithm, I would have thought this was obvious, as that is the title of this topic.

  9. #19
    Member
    Join Date
    Jun 2008
    Posts
    50

    Default

    Quote Originally Posted by pingu View Post
    I am enquiring about the availability of the Sky Router WPA algorithm, I would have thought this was obvious, as that is the title of this topic.
    This thread has gone slight off topic as it now seems consumed with Tiscali router algorithm?

    The Sky V1 router algorithm is know,the V2 algorithm is know to contain the MAC address and Serial No. but isnt publically available. James who reversed engineered these has provided the online webservice. Doesnt that acheive what your after?

    What are you looking to do with the algorithm?

  10. #20
    Junior Member imported_pingu's Avatar
    Join Date
    Sep 2006
    Posts
    40

    Default

    Yeah I know its on t'internet and it does provide pw for routers, just wanted to have a neb for my curiosity, isn't that what drives us all

Page 2 of 3 FirstFirst 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •