Verizon Fios G3100 and E3200 Research

[FiosFiend]

Everyone join the celebration, we finally hit a few milestones this week. There are now over 1000 unique entries in the database, and over 500 entries for the G3100/E3200! The past two weeks I’ve focused heavily on scraping images from the search engine dorks that I’ve posted.  Somehow I overlooked that these searches also turn up several links that may lead to old listings (for FB and offerup).  So now I am collecting the links too and scraping those listings as well.  It was a silly thing to overlook, but I’m happy I caught it because we gathered a ton of new images.  I’ve added 92 new entries for the G3100 / E3200, which up to 555 now!

Updated Data Set: 
  router_data_FULL_052325.xlsx (Size: 690.21 KB / Downloads: 2)

Of course we have to test the new entries with Fios-F1nDr

Before:
Correct - 57 (62%)
Incorrect - 29 (32%)
unknown block - 4 (4%)
Unknown device - 2 (2%)
Not Enough Data - 0 (0%)

After:
Correct - 84 (91%)
Incorrect - 8 (9%)
unknown block - 0 (0%)
Unknown Device - 0 (0%)
Not enough data - 0 (0%)


I looked back through the past updates and this is the highest % correct so far! As always there are some outliers, but this week I actually managed to sort out some of the outliers. With enough of them in a date block, I was able to see that some belonged in their own block. Once separated, both blocks calculated correctly again. Awesome!

Now that I had some sort of dictionary, I spent some of this week collecting captures for these devices. I had been using older software to capture, but now I have hcxdumptool working correctly. Using hcxpcapngtool -D on the captures gives us the device info. We see that the correct MAC, Model, and Serial are broadcast in the packet... which makes calculating the serial # like I have been doing with Fios-F1nDr completely useless . The good news is that separating the entries by Date Codes is still useful, and I will have more time to look into something else haha. There are now 235 Date Codes.



The odd GreenWave device above is the G1100, which happens to be our device of the week!



The G1100 is manufactured by Greenwave. This device is an older model that was distributed for a good number of years. As far as I can tell this is the first device to use the QR code on the sticker. The information contained in the QR code changes a few times during production, but it’s fairly basic. Unfortunately the MAC address isn’t contained in the QR, but it is included on a different sticker. Unfortunately I have not been collecting / connecting the second sticker to the first, but that will change hopefully. It’s kind of funny that we can see that they messed up the URL in the QR code to read incorrectly "http\\://myfiosgateway.com”, which does eventually get fixed later on.

Code:

('WIFI:S:FiOS-FKTGH;T:WPA;P:jane6709dash350gas;;ROUTER:S:G1A115082602549;U:http\\://myfiosgateway.com;I:admin;P:sum22tutor;;1',)

Currently, the data set contains 136 entries for G1100 models!



SSID is FiOS_XXXXX or Fios_XXXXX where X is any char <A-Z><0-9> (The FiOS prefix is unique to this device)
SSID Passwords follow <word><number><word><number><word> (I did catch 2 entries that are <number><word><number><word>)
Admin Passwords are 8-10 characters and follow <word><number><word>

From this sample we can gain some other info:

• SSID passwords are 16-18 characters long (16 characters is rare, only 3 entries so far)
  
• These appear to be the most complex out of all of the devices.
  
• Password <word> are between 3-6 characters for SSID Password
  
• MAC Prefixes <Needs added to DB>
  
• HW version <Needs added to DB>
  
• Shipped firmware <Needs added to DB>
  

The serial number is 15-characters, starting with F1A, G1A, or S1A followed by 12 digits.  Looking at the serial #, we see that they contain a Date Code (2-Digit Year, 2-Digit Month, 2-Digit Day) similar to the G3100/E3200.  In the serial (G1A115082602549) the first 4 characters is the Prefix, the next 6 characters is the Date Code, and the last 5 is the 5-Digit incremental serial. We can verify this because the Month column is never > 12, and the day is never > 31 and is only ever 31 on a month with 31 days. The years fall between 14-19.



From the device teardown, we can’t see much.  However, this video on YouTube does a better job and tells us the CPU is a ARMv7 Cortina WPCS7542E A1 dual core 750mhz. Sadly, I can’t identify the memory from either source.  There is a GitHub page that has firmware available, as well as info on how to root the device.

The Dataset now contains:
G3100/E3200 - 555 entries
CR1000 A/B - 105 entries
ARC-XCI55AX - 101 entries
ASK-NCQ1338 - 123 entries
WNC-CR200A - 42 entries
G1100 - 136 entries
Other - 48 entries
Total - 1210 entries

This post concludes the deep dive on the most popular devices. Next week I’ll wrap up the “Others” category for us, then I can start taking a better look at all of the info that we’ve collected. I should finally be able to get some of these scripts cleaned up and shared.  I also want to do a better job at sorting/renaming the reference images so that I can upload those again.