Comments on: Default key algorithm in Thomson and BT Home Hub routers

By: saad

saad — Mon, 07 Jan 2013 02:48:42 +0000

Is there any method to find the default key for a Thom_Dxxxxxx ssid.

By: matt

matt — Tue, 15 May 2012 11:19:21 +0000

dose this work with backtrack 5 and bthomehub2?

By: kev

kev — Tue, 28 Feb 2012 04:31:05 +0000

http://weiss.u40.hosting.digiw.....gen.tar.gz

By: David

David — Tue, 14 Feb 2012 20:44:50 +0000

Did BT sort this out, or are the hubs still vulnerable to these attacks?

By: kev

kev — Sun, 12 Feb 2012 14:43:35 +0000

file in above link was removed

http://www.mediafire.com/?l2d57it4dkt6hso

By: kev

kev — Sun, 12 Feb 2012 00:11:22 +0000

New algorithm has been documented but no recovery tool is available due to the complexity and time required to crack key. BT and Technicolor are already aware of the problem. You can look at code here:

http://www.woofiles.com/dl-284.....gen.tar.gz

Feel free to mirror providing code is unmodified.

SHA-256 signature = 8dff6225783328c9516c0eb42f6ceab5624ded3f85ab0a94d91fb81ecabdd91c

By: akilez

akilez — Mon, 30 Jan 2012 21:26:53 +0000

Does not work for the modem / router TG585 v8, soft. 8.6.E.9 version.

By: Anto

Anto — Mon, 28 Nov 2011 22:55:52 +0000

What about BT Home Hub 2.0? Anybody has any clue how the key is generated?

By: Montana

Montana — Fri, 30 Sep 2011 13:44:13 +0000

Hey is there a tool like stkeys2.exe for BTHome? I mean an honest to goodness win32 executable, like BTkeys.exe for instance? I didn’t find anything of use in Adrian Pastors zip file.

By: Pass!ngBy

Pass!ngBy — Tue, 20 Sep 2011 06:00:40 +0000

some claim, on blogs and articles, that by using ONLY the XXXXXX characters you can do reverse calculations to obtain the password? without the need to know the S/N , if am not wrong stkey and md5 site, locates the S/N of the XXXXXX specified router from the database then do the hashes to locate the password, am i right or they were right all that you need is the XXXXXX characters and voila!

By: thehog

thehog — Thu, 11 Aug 2011 00:13:52 +0000

what can i say here simply impressive stuff great works

By: lefteris

lefteris — Mon, 18 Jul 2011 02:40:46 +0000

I created a windows version (with graphical user interface)

downloads + screenshot from:

http://www.doc.ic.ac.uk/~ee410/thomson/

By: name

name — Mon, 04 Jul 2011 01:18:48 +0000

Have fun trying to find out the NEW ALGORITHM used in Thomson routers.

ALL THE INFO HERE

http://pastebin.com/fNB4LTGH

By: Penetrate – WEP key cracking app removed from the Android Market | ForHacSec.com

Mon, 13 Jun 2011 20:36:45 +0000

[...] application performed penetration testing on Thomson and Speedtouch routers using a well know vulnerability. However the Thomson and Speedtouch routers were not purely used by their respective [...]

By: rony fadel

rony fadel — Tue, 22 Feb 2011 15:52:44 +0000

I’ve made a PHP script, check it out at http://ronyfadel.com/keys.php

By: David

David — Sat, 29 Jan 2011 04:28:39 +0000

I was wondering if it’s possible to do the same with only 4 digits.

For example here in Australia, Bigpond use the SpeedTouch modems and I have seen BIGPONDXXXXXX for example, but what about BIGPONDXXXX (with only 4)

How would I get the list of possible keys for the SSID BIGPOND004D?

Thanks in advance!

By: ck

ck — Mon, 17 Jan 2011 14:11:53 +0000

To change ur SSID Name n security type from WEP TO WPA2-PSK visit diz blog http://cklyf.blogspot.com

By: fadi

fadi — Mon, 10 Jan 2011 20:42:16 +0000

fastweb-1-38229dfb513c

By: Beveiliginglek in UPC-routers | McCool, orde in de chaos

Beveiliginglek in UPC-routers | McCool, orde in de chaos — Thu, 11 Nov 2010 17:14:53 +0000

[...] achterhaald, hierover later een heldere uitleg. Externe uitleg over deze fout in de beveiliging is hier te [...]

By: md5this

md5this — Thu, 04 Nov 2010 19:54:49 +0000

paokara ela: thomson521BE2 resolves to: 21255FBAF0 reversed on: http://www.md5this.com/speedto.....uchIT.html