Home - Wireless Cracking - Sky Q keyspace investigations

Nothing wrong here, we just want to break one of them or both if we can this topic is for both, you just need to specify which one you're talking about, to figure out what important information you add and understand it.

By the way what aircrack version did you use when you've got that kind of strange cap's?

SKY3DE23:CDFSBTDMNS

aircrack-ng-1.2-rc4-win

SKY1F326:XLWRCRFMRQ

SKY5EA85:VPDWTSPQWN

SKY23B43:YSXMYNYTFR

SKYA61E7 CLLFYWQSSL

Updated
https://github.com/soxrok2212/Sky/blob/master/SkyQHub_ER100K

BTC: 1B4ZAbWYQ399p6QJm3VLbywiCWVSBAXYJ1

NVIDIA
1x GTX 1080 Founder’s Edition
1x GTX 980 Reference Design

seem no new idea on data from anyone?
just collecting now with no reason?

The keyspace hasnt changed any. I have to look at the char per positions based on the updated list.
But there were certain positions in the passphrase that didnt use all 16 chars. But that was based on a week or 2 ago.

Ill have to rerun the analysis on it and see if it has changed any. Ill try and do that tomorrow and post up the results.

is that the blandyuk pattern of first ssid hex to last pass map?

OK, seeing nothing else here but flat random distribution
other patterns claimed in thread were all false

Finally managed to get a probe response from a Sky Q, this is what it looks like in the WPS tag. Shows the exact model, ER110. SR102 will show Broadcom and 123456 for model name and model number.

BTC: 1B4ZAbWYQ399p6QJm3VLbywiCWVSBAXYJ1

NVIDIA
1x GTX 1080 Founder’s Edition
1x GTX 980 Reference Design

Spent ages scraping the bay and looked at known keys here and noticed the 2nd from last char is never (haven’t seen yet) an ‘A’ so maybe using custom char sets -1 (known keyspace) -2 (known omitting ‘A’) -1?1?1?1?1?1?1?1?2?1 should speed thing up a little?

That discovery is not particularly surprising, considering that A is not even in the Sky Q charset
in the first place

Ahh shucks, back to the drawing board!!! I got mixed up with the standard charset and the q one *goes back and sits in the corner quietly*

I still commend you for trying to find something new.
This thread has gone pretty dead.

Noticed something that is quite amusing, but I am not sure there is any more to it

If you push the Sky Q charset through the SSID to final character mapping backwards,
the isolated LMN group maps to AE5, which immediately made me wonder if someone
had buried a hint to AES being used in the algorithm?

Anyway, all seems like a very odd coincidence?

ABCDEFGHIJKLMNOPQRSTUVWXYZ
 BCD F     LMN PQRST VWXY  Sky Q charset
 BCD F     AE5 01234 6789  Sky Q charset backwards through mapping

Nice finding, but nope.

Character mapping is:
0123456789ABCDEF
PQRSTNVWXYLBCDMF

Or in hex:
30 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46
50 51 52 53 54 4E 56 57 58 59 4C 42 43 44 4D 46

So, they add 0x20 to digits and replace vowels AEU with LMN

Well, OK, I guess that is more plausible than my AES conspiracy theory

I wonder if they replaced the vowels AEU with LMN to prevent potentially
offensive words from appearing randomly in the passphrases?

Spending a bit too much time finding out how many rude words I can
make from the Sky Q charset using AEU instead of LMN

I can certainly see why they took those vowels out of the charset now

Sorry for asking a newbie question, but what happened to https://github.com/soxrok2212/Sky/blob/master/SkyQHub_ER100K ?

If anyone is still interested, here are my findings:

SKY###2#
SKY3DE23:CDFSBTDmNS
SKY1F326:XLWRCRFmRQ
SKY0F122:YYMXTFSmFP

SKY0F###
SKY0F122:YYMXTFsMFP
SKY0F091:XRPPWFsDLP
SKY0FA58:YFWWSCsCYP

SKY1F###
SKY1F6A6:xNBTVCDYFQ
SKY1F326:xLWRCRFMRQ

SKY##C6#
SKYD0C62 BCPNWbVLPD
SKYF6C6A NTRBNbWNTF
SKYE3C9A PSYLBPMYbM (b position is +3 to the right, hence c9-c6=3)

Is this still ongoing? any progress with any of the keyspace?

SSID PSK MAC
SKY43C92 PBPTCYMLLT 7050AF833328
SKYD1117 TDXQLNDVXD 24A7DC448EF8

SKY0F058:XLNCDNQDYP

No s as you have. :|

BTC: 1QFsUY54JQDGpJf1UPV2YdcpQgcYKnyrpN
XMPP: WW1GamEyUnZiM0pBWTNKbFpYQXVhVzA9

From 28 combinations in the OP.

I pulled the hex part from the SSID -> decimal.

Converted the passprase -> hex -> decimal.

Dropped them in excel. Calculated the pearson correlation between them: r = -0.155326556

i.e. The only relationship between those 2 is that one is always smaller than the other (obviously)

If anyone has more ideas to analyze relationships between I'll gladly do so

My haschat stuff (rules, scripts): https://github.com/theherp/Hashcat-stuff

We need more data

My haschat stuff (rules, scripts): https://github.com/theherp/Hashcat-stuff

Given the information above and also using the Default Algo post is this still the correct attack to run against a SKYQ handshake

crunch 10 10 NBPYVLMRXTCFWDSQ

or am i missing letters or rule sets for crunch.

That should work but you could perhaps use maskprocessor --seq-max=NUM Maximum number of multiple sequential characters, --occurrence-max=NUM Maximum occurrence of a character. Currently going through all the keyspace using --seq-max=2 and --occurrence-max=3. Will report if i manage to crack my test hash.

any news?

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz