• MAC address starting with 04.A2.22 are the oldest and have 16 character passwords
      SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9>   
      SSID Passwords follow <word><number><word><number><word> format (ex: met8sonata868elm)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: stubble16crowded)
  
• MAC address starting with B8:F8:53 are mixed and may have 15 or 16 character passwords
      SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9> 
      SSID Passwords follow <word><number><word><number><word> format (ex: moat288nit48pug)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: chopper86notably)
  
• MAC address starting with 3C.BD.C5 are the newest and have 15 character passwords
      SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9>
               or Verizon_XXXXXX where X is any char <A-Z><0-9>     
      SSID Passwords for “Fios” networks follow <word><number><word><number><word> format (ex: range36vex77toy)
               or “Verizon” networks follow <word>-<word>-<word> with a single digit at the end of one word (ex: miry9-elm-north)
  
•     Admin Passwords for “Fios” network are 16 characters and follow a <word><number><word> format (ex: unusual53smelter)
              or “Verizon” networks are 9 characters that are <A-Z><0-9> (ex: Z79KGSX4T)
              Note: 0 and 1 are not seen in sample    
  

• MAC address starting with 04.A2.22 are the oldest and have 16 character passwords
      SSID is E3200-XXXXX where X is any char <a-z><A-Z><0-9>   
      SSID Passwords follow <word><number><word><number><word> format (ex: nylon88wit657aye)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: ritual236auction)
  
• MAC address starting with B8:F8:53 are mixed and may have 15 or 16 character passwords
      SSID is E3200-XXXXX where X is any char <a-z><A-Z><0-9>
      SSID Passwords follow <word><number><word><number><word> format (ex: mach92see36flat)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: seraph497lantern)
  
• MAC address starting with 3C.BD.C5 have 15 character passwords
      SSID is Verizon_XXXXXX where X is any char <A-Z><0-9>
      SSID Passwords follow <word>-<word>-<word> with a single digit at the end of one word (ex: tenth-ben6-vend)    
      Admin Passwords are are 9 characters that are <A-Z><0-9> (ex: 3JB94H6CQ)        
      Note: 0 and 1 are not seen in sample  
  
• MAC address starting with DC.F5.1B are the newest and have 15 character passwords
      SSID is Verizon_XXXXXX where X is any char <A-Z><0-9>
      SSID Passwords follow <word>-<word>-<word> with a single digit at the end of one word (ex: plush-fast3-con)    
      Admin Passwords are are 9 characters that are <A-Z><0-9> (ex: QVB734TKL)           
      Note: 0 and 1 are not seen in sample  
  

• Password <word> are between 3-7 characters for SSID Password
  
• Password <number> are between 1-4 digits
  
• There are 3 HW version (1102, 1103, 1104)
  
• Serial #’s are 16 digits (except for the most recent E3200 which have 11)
  
• Shipped firmware ranges from 1.3.5.1 to 3.1.1.16 
  
• There are the 568 unique words extracted from the passwords:
  

• Analyze the data set to try to reduce key space (unused characters, common words, find the wordlist?)
  
• Collect more complete entries for the dataset
  
• Try to mount file system (ubi.img) in a proper Linux environment
  
• Try to find older firmware
  

(04-10-2025, 08:44 PM)textile302 Wrote: Awesome work but it seems the firmware links are now not respond. You don't by chance have a different source for them do you?