Tuesday, March 1, 2011

Verizon FIOS default keys are terribly unsecure.

I've suspected for a while that the Verizon FIOS WEP keys and SSID were correlated. The SSID is the ID your wireless router broadcasts out to any device with a Wifi chip. WEP itself is not very secure and can be cracked faster than I can write this, but it does keep the neighbors out and it's something you're not going to typically do on an Iphone.

However, Kyle Anderson took the time to publish the solution to figuring out the default WEP password on every Verizon FIOS router. WhatIsMyIP.org provides a free tool to automatically do the calculation too. However after reading Kyle's blog about it, the scary thing about the password is it's not some weak cryptography or scrambling which hides this key, its just in another base. So with a base converter app on your Iphone, you can get access to any FIOS internet your Iphone can see.

I tried Base Converter and Calculator Pro for just 99 cents and it worked like a champ. I can convert the SSID into a WEP key in seconds without any specialized tools and access a FIOS default WIFI.

Here is how: (Note, the steps I'm showing are simply a clarification on the sites referenced above. This should only be used to test or demonstrate the weakness in the default configuration of FIOS routers to encourage users to change their security)
  1. Run Base Pro on your iPhone (Click the link above with your iPhone)
  2. Change Base Pro to Base 36 by dragging the slider to the right.
  3. Type in the SSID backwards. ex. “E3X12″ gets typed in as "21X3E"
  4. Click the button at the top that says Hex (Don't drag the slider to Base 16, there is a small bug) ex. 21X3E becomes 349FCA
  5. Append one of these two prefixes to the result: 1801 or 1F90. ex Try 1801349FCA or 1F90349FCA.
  6. Try both keys to see which one works. (You can determine which key to use with more work, but its easier to just try them.)


That's it. A few easy steps with nothing more than a Base Calculator and you can determine the default FIOS WEP key with your phone.

No comments:

Post a Comment