Default WEP key generation algorithms.
Publié par DecereBrain Tue, 22 Apr 2008 18:45:00 GMT
Following is a copy of the comment I posted a few minutes ago on the GNUTIZEN weblog, about an amazing article talking about the default WEP key generation algorithm used in a DSL router from the British Telecom ISP. I’ve made a similar discovery some time ago, and I did not talk about it on my web log yet, so let’s do it now :).
hahaha, that’s a good work :).
A similar algorihtm exist for the generation of the defaut WEP key in the Hitachi AH4021 and AH4222, used in France by Club-Internet and Alice.
In fact, the default WEP key is the beginning of the SHA-1 hash of the default SSID, which is derived from the serial number of the device (which is derived form the MAC address of the Wi-Fi interface).
We went on that conclusion thanks to the marvelous work of Club-Internet, who just released a Windows GUI tool named WEPtool. WEPtool takes a Club-Internet.box SSID and generate the corresponding WEP key (yes, our #@! government vote for fascit laws against the citizens while ISP help wardrivers and outlaws). What is really fun is that we did not need to perform any sort of reverse engineering to understand the generation process : the WEPtool relies entirely upon a DDL called FSHash (for File String Hash), and the source code of that library is open source !
What you need is a SHA-1 computing program, and you can hack into any of these.
The WEPtool binary and the source code of the FSHash DLL can be found on my humble website). A reverse engineering work has been made by a member of the FRET group, and all of this was originally published in the 2600 Lille meeting reports along the year 2007 and in this thread, thanks to my friend oxyde.
