I've recently read an article about a weakness that was discovered in SpeedTouch modems which are manufactured by Thompson. Here in the Netherlands, they are commonly found almost anywhere, which basically gives you free internet everywhere you go :)

Based on the original Proof of Concept code, I created a .NET version, which in turn was used to build a database with all possible SSID's, Serial Numbers and WPA(2) Keys, which I find preferable over the brute force tools that have been created to date.

I am leaving for a two week vacation, so I didn't have much time to put it all togeather. I have put a small tool online here, where you can enter a SpeedTouch SSID (with or without the leading 'SpeedTouch' part of the SSID), which in turn will give you all possible serial numbers and WPA keys.

NKCSS SpeedTouch Crack

Update

I havn't had much time to do much on this project since I quickly cooked up the initial release. I hope to find some spare time soon and start working on some pocket-pc/windows mobile versions aswell as redo the database to allow our English friends with BT Homehub routers to do some lookups.

While checking the traffic statistics (so much fun seeing all the traffic coming in after releasing the Red Alert 3 tool), I've noticed some people starting to link to me. Thanks! I always love more attention :)

A dutch blog: http://sikkepitje.nl/~paul/blog/archives/103
A dutch hacking related link site: http://www.ikwilhet.nu/hacken/24/nu-meer-informatie-over/hacken.html
Croatian forum: http://forum.bug.hr/forum/topic/razni-hardverski-problemi/thomson-speedtouch-780wl-problem/10814.aspx?sort=asc&view=flat
French WiFi hacking forum: http://www.crack-wpa.fr/forum/viewtopic.php?id=246