Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: dario luethi (dluremote-exploit.org)
Date: Mon Jan 28 2002 - 04:06:43 CST
('binary' encoding is not supported, stored as-is)
while doing some troubleshoting i found a bug on a
compaq evo n600c, with an
integrated 802.11b card connected via usb (on the
back of the display) running
as Intel(R) PRO/Wireless 2011B LAN USB Device.
the WEP-Key ist stored plain to the registry. the
permission the the specific key
is weak enough that every local user has read
access and can extract it via
regedit.exe or an equivalent tool. a driver from
other vendors (as example: Actiontec PrismII)
stores the 128bit key in a encrypted form to the
same place in the registry.
if you open up the properties dialog of your
WLAN-Card and click to the "Advanced" tab,
you can find an entry dislaying the WEP-Key
plaintext (only as administrator).
a normal user don't have access to this "Advanced"
tab. this happened with the latest
driver version from Compaq Support Page (version
18.104.22.168). I tried to get the latest driver
from intel which is Version 22.214.171.124 (downloaded
on 24th January 2002). The newer release
fixed one part by not showing the entry in the
Everytime working way:
lets look the registry
the security policies on
Owner: local Administrator
Owner Group: local Administrators
Name: Permisssion: Apply to:
local Administrator: Full Control This Key and Subkeys
local Power Users: Read This Key and Subkeys
local Users: Read This Key and Subkeys
Owner: Full Control Subkeys only
System: Full Control This Key and Subkeys
but if you look registry under
^^ look for your correct device section ^^
(no matter which of the 2 noted driver versions used)
you find the string entry
where the first 12 Hex-values show the WEP key in
on another system with the new driver (126.96.36.199)
added additional key's under the
same context noted above: "Profiles\Default\WepKey"
if this wep-key belongs to anyone, i apologize.
this key is free invented from
my fingers on the keyboard!