Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: [1] 2 3 ... 25

Author Topic: Vodafone (Huawei) HHG2500  (Read 27193 times)

csiwek

  • Just arrived
  • *
  • Posts: 15
Vodafone (Huawei) HHG2500
« on: November 09, 2016, 11:26:07 AM »

Hi all,

Did anyone find where are the console pins in that router?
https://wikidevi.com/w/images/2/27/2015-12-25_18.35.40.jpg

5pins next to reset/power are not the ones. there are 4xGND and something else
The 20pin header seems dead .There are many unsoldered parts (resistors possibly).  I tried to sniff with a scope around that place but no luck so far.
If the SoC is the same as in  D-Link DSL-6850U     (BCM63168) 
http://i.imgur.com/pgdl7sv.jpg

it should be around that place.

The goal is to extract  pppoe password (or find a way how the router gets it over tr069) , since Vodafone sometimes don't want to provide those to some customers (this thread: http://forum.vodafone.co.uk/t5/Pay-monthly-products-services/Vodafone-connect-router-DHCP-settings/td-p/2429735 for reference.
I was lucky but perhaps there is a way to get those credentials



Logged

displaced

  • Reg Member
  • ***
  • Posts: 104
Re: Vodafone (Huawei) HHG2500
« Reply #1 on: November 12, 2016, 10:30:23 AM »

Hi csiwek!

I was over on that Vodafone thread and like you, lucky enough to get my PPPoE details.

I hope you have some luck with your endeavours.  It's been a while since I did this sort of hardware snooping, but if I get some free time I might crack open my HHG2500 and see if I can be of any help!

I dare say you've checked, but just a thought:  have you tested the headers right from when the router powers up?  It might be that they're only active for a brief period at startup before they're switched off as part of the boot process.
Logged
Vodafone Landline+Fibre: Huawei HG612 modem, pfSense router, AirPort access points.  50/10 sync, Huawei DSLAM. GigE home LAN with Netgear ProSafe switches. Mac, FreeBSD and Win10.

csiwek

  • Just arrived
  • *
  • Posts: 15
Re: Vodafone (Huawei) HHG2500
« Reply #2 on: November 13, 2016, 07:29:56 PM »

I have managed to sniff something on these VIAs. it looks like a serial signal on the scope but it's 1.8V peek2peek so I need to find a way convert it to 5v or rs232. I'll try to play more once I have some spare time :-)

Logged

csiwek

  • Just arrived
  • *
  • Posts: 15
Re: Vodafone (Huawei) HHG2500
« Reply #3 on: November 14, 2016, 11:21:33 PM »

Those VIAs was a dead end.  Nothing is there.
I spent 2 hours on sniffing what's happening on connector on the top. It's connected to some kind of infrared header.  The transmission seems very odd. My logic analyser does not recognise it. Minimum pulse width is 12us which would suggest it's about 80kbps which isn't a standard speed.
I thought it's IRda SIR but for me it does not match any of standard speeds either (according to this:http://www.vishay.com/docs/82513/physical.pdf)

I'm out of ideas for now....
Logged

lyonsj400

  • Just arrived
  • *
  • Posts: 3
Re: Vodafone (Huawei) HHG2500
« Reply #4 on: December 17, 2016, 02:55:04 PM »

Hi its John, (lyonsj400),

If you can activate the Ethernet WAN port, we can capture the packets using Wireshark and then examining those for the login details.

I tried the LAN side in case the DHCP broadcast went out of all ports like the Sky routers but it doesn't.
Logged

NewtronStar

  • Kitizen
  • ****
  • Posts: 4418
Re: Vodafone (Huawei) HHG2500
« Reply #5 on: December 17, 2016, 05:22:30 PM »

Indeed have one of these devices ready to go once the switch over has taken place on Monday and really don't want you use it am very happy with the Billion 8800NL.

Was trying to understand how the authentication details are sent to Vodafone and I take it has to a username@vodafone.com & password and what about the CHAP and MTU settings are they all preset before being sent out to the customer I have no idea  :(     
Logged

csiwek

  • Just arrived
  • *
  • Posts: 15
Re: Vodafone (Huawei) HHG2500
« Reply #6 on: December 17, 2016, 08:41:47 PM »

Hi its John, (lyonsj400),

If you can activate the Ethernet WAN port, we can capture the packets using Wireshark and then examining those for the login details.

I tried the LAN side in case the DHCP broadcast went out of all ports like the Sky routers but it doesn't.

Ethernet WAN is disabled (even switch does not find any device connected).   I tried sniffing - there is no traffic at all.
I'm currently on vacation but I'll definitely spend some more time on it when I'm back.
Logged

csiwek

  • Just arrived
  • *
  • Posts: 15
Re: Vodafone (Huawei) HHG2500
« Reply #7 on: December 17, 2016, 09:03:25 PM »

Indeed have one of these devices ready to go once the switch over has taken place on Monday and really don't want you use it am very happy with the Billion 8800NL.

Was trying to understand how the authentication details are sent to Vodafone and I take it has to a username@vodafone.com & password and what about the CHAP and MTU settings are they all preset before being sent out to the customer I have no idea  :(   

There are few options to provision device remotely.
1. Most obvious is TR-069  protocol
2. The router has an infrared port that does something, I imagine it can be used to provision some parameters before it gets shipped.
3. In early days (and old firmware version) some people have reported that when they tried establish PPPoE session with wrong credentials, the modem was getting an internal IP address. It's possible that modem is requesting credentials from a web service based on MAC address etc.

 
Logged

NewtronStar

  • Kitizen
  • ****
  • Posts: 4418
Re: Vodafone (Huawei) HHG2500
« Reply #8 on: December 17, 2016, 11:18:19 PM »

Ethernet WAN is disabled

That would be correct as there is no firmware to make this port discoverable the electronics pipes are still there for the WAN socket, to make it work would require a firmware flash of course someone will need to get access to the firmware and modify it then find away to flash the EPROM

where is Asbo kid when you need em  :)
Logged

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 29903
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Vodafone (Huawei) HHG2500
« Reply #9 on: December 18, 2016, 08:39:49 AM »

@NS

This isn't anything like the HG612 issue whereby we were wanting info on the LAN side for line stats.   With the HG612, we had a separate router for which the PPP login info was configured.  The reasons why the HG612 was hacked was for linestats at a time when you could if you liked use your own hardware.. but back in 2012 there were very few VDSL routers available.  Unlike now, whereby theres probably 100+ modem routers to chose from, back then there were only about 2,  both of which cost several hundred pounds.

New f/w is unlikely to be the solution.  The user login info appears to be held in an encrypted (ie secure & unreadable) config file.  This data will be different for and unique to each individual user.

With sky routers they also broadcast this info on the LAN side so if you capture packets you can get your login data.
However with vodafone the data isnt broadcast so that leaves a big problem which is how do you capture packets to sniff data that is going out on the WAN.   

What the guys are trying to do is find a way to sniff data being sent out from the WAN side of the router to Vodafone.  The problem is how do you do that, because unlike trying to sniff something on the LAN side, you cant put a laptop running wireshark between the modem and vodafone on the internet side.


----

What we don't know is how the HHG2500 is getting that login info in the first place.  It could come shipped with it, but possibly most likely is the first time it connects it will be sent that info by TR-069/TR-064  probably based on the routers MAC address.   
Its then stored in the config file, but because its encrypted there's no way of finding out what that info is.  Even if you look at the data (which is possible by looking at a backup config) encryption means that the user info is gobbledygook and unreadable.

I believe Plusnet do something kind of similar based on the routers MAC address that is then tied to the user account so that the first time they connect, TR-069 will automatically config the router with the correct login info.  Big difference though, is that (1) You can turn this off in the PN customer portal if you use your own modem (2) They are quite happy to give you this info as its based on your account settings and not some obscure number.

---

I was myself considering vodafone a few months ago, but the prospect of only being able to use their HHG2500 was a big turn off. 
There were a couple of other things such as the non-avoidable setup fee, which pushed up the first year costs quite a bit therefore not as big as a saving as it first appears... and the fact they use Standard rather than Speed DLM.
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

NewtronStar

  • Kitizen
  • ****
  • Posts: 4418
Re: Vodafone (Huawei) HHG2500
« Reply #10 on: December 18, 2016, 04:41:20 PM »

Ah I see thanks Kitz have saved the HHG2500 config file to PC and it's very readable now this modem has not been plugged into the DSL line socket as yet


<Name>InternetGatewayDevice.WANDevice.7.WANConnectionDevice.13.WANPPPConnection.13.Username</Name>
                <Value xsi:type="xsd:string">autoconfig@broadband.vodafone.co.uk</Value>
            </ParameterValueStruct>
            <ParameterValueStruct>
                <Name>InternetGatewayDevice.WANDevice.7.WANConnectionDevice.16.WANPPPConnection.16.Username</Name>
                <Value xsi:type="xsd:string">autoconfig@broadband.vodafone.co.uk</Value>
            </ParameterValueStruct>
            <ParameterValueStruct>
                <Name>InternetGatewayDevice.WANDevice.65.WANConnectionDevice.3.WANPPPConnection.18.Username</Name>
                <Value


« Last Edit: December 18, 2016, 04:45:17 PM by NewtronStar »
Logged

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 29903
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Vodafone (Huawei) HHG2500
« Reply #11 on: December 18, 2016, 05:37:51 PM »

Yes thats it, and about as far as Bonzer managed to get here.   
However, he decided to cancel within the cooling off period so wasnt able to investigate much further.

I think theres another post somewhere which Ive read (cant find it atm) whereby someone on the service and using it...  said they found once it had connected, then the user details were stored as encrypted data in the backup config.


------

Just had one other thought which Im unsure if anyone has tried

Quote
So dsl000******@broadband.vodafone.co.uk doesn't authenticate?

Quote
I've tried "password", "vodafone", "broadband" and the unit's serial number to no avail.

I know its a long shot, has anyone tried using it with their account password which they chose when they set up their account with vodafone? 
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 29903
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Vodafone (Huawei) HHG2500
« Reply #12 on: December 18, 2016, 05:54:53 PM »

PS

I think the username the router needs is the dsl000*******@broadband.vodafone.co.uk
Its getting the password which is the problem.   The password is a unique 8 digit mixed case string.
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

NewtronStar

  • Kitizen
  • ****
  • Posts: 4418
Re: Vodafone (Huawei) HHG2500
« Reply #13 on: December 18, 2016, 08:15:15 PM »

Well my cooling off period is very close to the end and will be with Vodafone ISP Very very soon, and just need some verification into DLM profile, when looking on MDWS 2 users using Vodafone  :-\ it shows both as being on the speed profile (2880) is that correct ?
Logged

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 29903
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Vodafone (Huawei) HHG2500
« Reply #14 on: December 18, 2016, 09:59:33 PM »

Ive been told by a reliable source that vodafone (retail) use Standard Profile.

ISPs using Vodafone wholesale do have option to change this, but the default for both retail and wholesale is Standard unless specifically requested by the EU and the retailing ISP is agreeable to changing it for you.  (eg. Origin will upon request)
« Last Edit: December 18, 2016, 10:10:01 PM by kitz »
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker
Pages: [1] 2 3 ... 25