Fritz Box Hack Password
I hacked my Fritz!Box (yeah, a bad name for a german router) and I'm entirely sure that it has a backdoor integrated too. That's why I wiped and flashed it with an alternative image. That and the Telecom's Speedport router are the most popular routers by far in Germany. And both have backdoors, I know that other router manufacturers also integrate backdoors from a source who works at such a company.
A friend can also verify the fact, because a different employee told him the same. Also it's public that the ISP can upgrade, modify, flash and disable features remotely. My friend's router has wifi, but their provider disabled it remotely within the firmware (it even has an antenna) and his ISP wants him to pay 5€/m to re-enable wifi.I really wonder why nobody complained about that earlier. Also the interesting thing here is that for a very long time, you weren't allowed to use a different router than the one provided by your ISP. Which enforced their surveillance monopoly.Here's an article about reverse engineering the backdoor in D-Link routers using IDA:PoC Available. This is probably NOT a backdoor.Most likely your ISP is using a technique like TR-069.
This enables them to push settings for voip/TV, and in your friends case wifi. A lot of DSL providers are starting to use this for less intrusive (?) goals like measuring noise and attenuation at the clients end once a day, so they can adjust the speed accordingly.AVM is a very nice company and you should not accuse them without proof. They actually provide an option to disable TR-069 in the page 'Provider Services' ('Allow automatic configuration by the service provider' and 'Allow automatic updates'). If you don't have this option you could try installing the original firmware from avm.de.Maybe you are still able to flash the modem with the original firmware from, and configure it yourself? 'you can easily install other firmware'That's what I did, I flashed it with a custom firmware (that was after I got aware of the backdoor). I've not 'reverse-engineered' the base image of my own router like in the article above, because that's a lot of work. I've worked on an awful lot of routers, hubs, switches of all sorts, enterprise and consumer.
Have been network administrator for a large global company and I think that I can trust my sources.What the new user 'blablablaat ' mentioned is obvious, I'm not stupid to make something like this up. Of course I have no 'Provider Services' or anything remotely similar enabled, but it's still possible to connect to the router and take control over it according to my source and I've seen it back then, when I asked for him/her to show it. Now why, do you expect me to prove that? A security researcher, is more qualified than me to create the convincing report you're asking for, sorry. You can feel free to do it yourself too, if you want. It's not my intention to spread rumors or FUD, but to make you at least aware of that your router ain't secure.
I was wondering, how safe the default configuration of a Fritz!Box really is.By default, there is a 16 digit WPA2 key, which contains only numbers.My first though was, that bruteforcing is right easy, because it only containes numbers.I could find out, it'll take up to 65 years with my Geforce 780 to bruteforce.Now I am wondering, if it's possible to have rainbow tables, in order to crack it? I don't understand rainbow tables that well to imagine the time to create them, or the size.Maybe somebody can help me understand it some more.Thanks. As for rainbow tables regarding the 16 lenght number default password on FritzBox, YES, if somebody had them already made, you could calculate for your FritzBox if it has a default password or no (all possibilities, 16 numbers).But as regarding to MAKE a rainbow-table for 16lenght numbers for FritzBox, it would take 63 years (same time as dictionary attack or even a bit slower) and some PB, thousnds and thausends of TB of space. But yes, if anyone would make a rainbowtable with some super-computer and store it on his super-drive, it would work for all future probes (ofcourse only with same ESSID (wlan NAME), for example only for 'Fritz!Box FON Wlan 7390'.
Fritz Box 7490 Password Hack
For EVERY ESSID you would have to make a new rainbow table.In practice, I higlhly doubt that anyone has a rainbow table for any of Fritz!Box which include all default WPA's (16 lenght numeric key).If I were you, I would try to calculate the algorithm, with which they (the factory) calculate the default WPA key. You can find at least a dozen of FORUMs, WIKIs etc (most in German),where they are trying to calulate the secret, from which the factory calculates the default WPA keys for their boxes. As I understood, the calculate them from the MAC (every box has more than 1 MAC, one for WLAN, one for ETH, itd., from serial number, and from default ESSID.Good luck decrypting the alghoritm.