Comments on: Default key algorithm in Thomson and BT Home Hub routers

By: lefteris

lefteris — Mon, 18 Jul 2011 02:40:46 +0000

I created a windows version (with graphical user interface)

downloads + screenshot from:

http://www.doc.ic.ac.uk/~ee410/thomson/

By: name

name — Mon, 04 Jul 2011 01:18:48 +0000

Have fun trying to find out the NEW ALGORITHM used in Thomson routers.

ALL THE INFO HERE

http://pastebin.com/fNB4LTGH

By: Penetrate – WEP key cracking app removed from the Android Market | ForHacSec.com

Mon, 13 Jun 2011 20:36:45 +0000

[...] application performed penetration testing on Thomson and Speedtouch routers using a well know vulnerability. However the Thomson and Speedtouch routers were not purely used by their respective [...]

By: rony fadel

rony fadel — Tue, 22 Feb 2011 15:52:44 +0000

I’ve made a PHP script, check it out at http://ronyfadel.com/keys.php

By: David

David — Sat, 29 Jan 2011 04:28:39 +0000

I was wondering if it’s possible to do the same with only 4 digits.

For example here in Australia, Bigpond use the SpeedTouch modems and I have seen BIGPONDXXXXXX for example, but what about BIGPONDXXXX (with only 4)

How would I get the list of possible keys for the SSID BIGPOND004D?

Thanks in advance!

By: ck

ck — Mon, 17 Jan 2011 14:11:53 +0000

To change ur SSID Name n security type from WEP TO WPA2-PSK visit diz blog http://cklyf.blogspot.com

By: fadi

fadi — Mon, 10 Jan 2011 20:42:16 +0000

fastweb-1-38229dfb513c

By: Beveiliginglek in UPC-routers | McCool, orde in de chaos

Beveiliginglek in UPC-routers | McCool, orde in de chaos — Thu, 11 Nov 2010 17:14:53 +0000

[...] achterhaald, hierover later een heldere uitleg. Externe uitleg over deze fout in de beveiliging is hier te [...]

By: md5this

md5this — Thu, 04 Nov 2010 19:54:49 +0000

paokara ela: thomson521BE2 resolves to: 21255FBAF0 reversed on: http://www.md5this.com/speedto.....uchIT.html

By: james

james — Fri, 29 Oct 2010 22:43:35 +0000

is it possible to find the wep for orange906A02 i would be happy to get accsess

thanks

By: Queen

Queen — Wed, 27 Oct 2010 10:35:02 +0000

Best aplication. Link: http://hotfile.com/dl/78429275.....y.rar.html

By: @paok

@paok — Sun, 10 Oct 2010 00:47:22 +0000

@paok 21255FBAF0

By: Jonny

Jonny — Tue, 28 Sep 2010 18:01:53 +0000

Wow… sounds amazing and far too complicating for me… Then.. what would the key be for BTHomeHub-9236?..

By: paok

paok — Sat, 25 Sep 2010 19:11:03 +0000

does anyone know the wpa-psk key for thomson521BE2?

By: AP

AP — Wed, 22 Sep 2010 07:45:50 +0000

Consider the following Speedtouch AP

CP0815SF2PB(80)
SSID Thomson9c726a
WPA BBA72BD067

Now take the CP0815 and change the XXX to ASCII. That is change 2PB to ASCII = 325042

SHA-1 CP0815325042 is bba72bd067e6cb5b9f21707b547cfd1bf79c726a.

The first 10 characters is the WPA key and the last 6 characters is the SSID.

However if we use the 9c726a is the program that cracks the codes it says that nothing is found. Therefore is there something wrong with the application? Is it not meant to work with letters above F. In this case there is a P character.

By: The Bigpond Speedtouch Hacking Project!

The Bigpond Speedtouch Hacking Project! — Tue, 14 Sep 2010 13:21:26 +0000

[...] hack has been known for a while, since it was first discovered back in April by Kevin Devine. The reason of posting it now is that today I found this really simple executable to get possible [...]

By: AndrÃ©

Great Work ppl! But the stkeys link is down… Can’t you upload plz. I want the source code too :)
Thanks

By: Sam

Sam — Thu, 02 Sep 2010 16:47:52 +0000

does anyone have BTHHkeybf for window XP????

By: roo

roo — Tue, 24 Aug 2010 04:32:27 +0000

@closis From the s/n you provided, the old algorithm calculates your key to be “CE74DE1A22″. This is pretty close to your posted suggestion of “C374DEA22″… can you doublecheck that please?
Also can you post your MAC please.

@colesy Can you post your s/n please?

@’broadcast’ I just got issued a new speedtouch (sn CP1019…). The default wpa key is calculated correctly from the sn, but the ssid appears to be derived from the last 3 octets of the mac.
I have a hunch that there could possibly be a link between the mac and the serial along the lines of the pirelli DRG A225 disclosed by Muris Kurgas (http://packetstorm.orion-hosti.....n.pdf.html)

By: colesy

colesy — Wed, 11 Aug 2010 13:05:19 +0000

Why does this research not apply?