WPA2 attack against specific devices.

[cooper]

I'm just going to leave this here...

To wit, UPC is a cable company in .NL that had 35% of the market until they merged with Ziggo. The combined company now provide coverage in 80% of .NL.

UPC used a different cable modem than Ziggo, but the combined company is called Ziggo and they might just be using the UPC modem with new customers, I honestly don't know.

Bottom line is these devices are fairly abundant in .NL

From that code file:

The attack is two-fold; in order to generate the single valid WPA2 phrase for a given network we need to know the serialnumber of the device.. which we don't have. Luckily there's a correlation between the ESSID and serial number as well, so we can generate a list of 'candidate' serial numbers (usually around ~20 or so) for a given ESSID and generate the corresponding WPA2 phrase for each serial. (This should take under a second on a reasonable system)

[vailixi]

So are all of the ESSIDs are something like: UPC2488886
Then from it gets a list of possible serials like: SAAP27334486

And all of the passwords are 8 character upper_alpha?

[cooper]

Looking at the hash2pass function I can't say for sure that passwords are 8 char upper_alpha - it may very well produce lower-case values (which have a higher numeric ASCII value than capitals) and numbers too.

[Guest]

Right it's all upper_alpha no numbers.

Runs fine but the input HAS to be in the format UPC*******.

Unfortunately part of Netherlands where I live no one has a UPC box so I can't test if what the script spits out actually works. I see a lot of ziggo***** but the script doesn't accept those as input!!

Edited January 14, 2016 by Guest

[cooper]

I used to have Ziggo, but after cancelling them I had to ship back my router.