“./mifi-passgen.py 091118 091119 091120 091121 >mifi-wordlist.txt”)Īllows us to pass it to your favorite WPA cracking tool. Running this script and redirecting it to a file (e.g. You can download this source as mifi-passgen.py. Print 'Must specify the 6-digit manufacture date (e.g. To attack the PSK selection with a small Python script and a tool such Target device is one of these values, we can quickly build a dictionary I was able to identify 4 unique manufacture prefixes. Talking amongst my wonderful colleagues at InGuardians, Please let me know what prefixes you see on your individual devices, and I’ll add them to the attack set. We don’t know how many 6-byte prefixes are in use, but that’s Knowing that for a given 6-byte password prefix there are onlyġ00,000 possible passwords, we can get down to exploiting a given MiFiĭevice. Is true for the 6-byte prefix, then we have a relatively small search If the concept of a manufacture date-stamp Only has an effective entropy of less than 17 bitsįor a given 6-byte prefix. With an effective entropy of approximately 36 bits, the MiFi password

Sequential Identifier: “ 00891” represents the 5-character sequential identifier code.īased on this assessment, we can determine that the password.

Manufacture Day?: “ 19” represents the 2-character day code (NB: This could be wrong, one sample had a value of “34” here, need more data).

Manufacture Month: “ 11” represents the 2-character month code.

Manufacture Year: “ 09” represents the 2-character year of manufacture.

This password value likely breaks down into four fields:

From the photo above, the password on my MiFi The password on the back of the MiFi device also reveals some To determine if all 16-bits of the BSSID are evenly distributed among Unique SSID’s for MiFi devices (potentially less more data is needed From this we can determine that Verizon has no more than 65,536

Mixed-case “MiFi”, which is important to us).Īlso, we can see that the “DAD1” in the SSID matches the last twoīytes of the AP’s MAC address (or Basic Service Set Identifier –īSSID). (where Kismet reports the addition of ” Secure” to the SSID, and the The MiFi SSID on my product is “Verizon MiFiĭAD1 Secure”, slightly different than that of the MiFi device label

Cursory analysis of the beacon information elements don’t revealĪnything particularly interesting, though the Kismet screen-shot gives

Mifi device hack