dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
26659
pulsar777
join:2009-12-21

pulsar777

Member

[Unlock] Unlocking Linksys SPA2102 adapter

I want administer some settings of Linksys SPA2102 adapter, so I need to connect to its web interface. When I type adapter IP address, it ask for a password. I tried some defaults, like admin with no password, and no username with "admin" password, or "admin", "admin", this not work. Is there way to find SPA2102 admin password? (and other passwords if there is). The SPA device was provisioned by a service provider, therefore I don't want to erase all the configuration settings.
Stewart
join:2005-07-13

Stewart

Member

If you enter just the IP address in your browser, you should see the password screen showing "spa user" or similar. The user name is "user" (without the quotes) and the password should have been supplied by (or be readily available from) your provider. It's usually something simple like 1234. However, this "user" access is limited to parameters that the provider has designated as user changeable. Speed dials, IP address, port forwarding, etc. are generally in this category.

If you enter i.p.add.ress/admin/ in your browser, you should see the password screen showing "spa admin" or similar. The user name is "admin" (without the quotes) and the (probably different) password might be available from your provider, if you explain that are having a technical problem that is best fixed by you making some settings changes. This "admin" access, if enabled, allows modification of all device settings. Alternatively, they may simply make the requested changes at their end.

If the provider won't cooperate, you might try some Google searches; possibly the passwords are the same for all their users. Or, try capturing traffic from the device as it boots up -- with luck, the provisioning file is unencrypted.

If none of the above helps, post provider name and the trouble you are having. It's possible that a member will have some useful advice.
pulsar777
join:2009-12-21

pulsar777

Member

I already tried the first two ways, but default user name and password combinations not work. Btw, how to capture traffic from the device as it boots up?
IPfaxer
join:2010-10-24

IPfaxer to pulsar777

Member

to pulsar777
just don't do it - just call the provider or get a new provider - locked devices suck

otherwise you can reset your ATA and then do what you want
pulsar777
join:2009-12-21

1 edit

pulsar777

Member

unfortunately, the both above options is not suitable in my case.
Have anyone the schematics for the Linksys SPA2102 adapter? The SPA2102 uses SIPURA SIP316FF chip. Maybe someone schematics for that adapter?
Stewart
join:2005-07-13

Stewart

Member

IMO, it's very unlikely that hacking the hardware will be productive.

If you want help, post as much detail about the problem as possible.

What is wrong (or what would you like to change) with your present setup?

Given that your provider is apparently unwilling to fix it, why do you want to stay with them (long contract, no one else can port your number, etc.)?
pulsar777
join:2009-12-21

pulsar777

Member

well, there are no obvious connectors pins on board.
Is there way to get device configuration file, to decrypt it, modify and reupload again?
I want to get admin password to be able to view settings and change it myself. In general, I'm satisfied with current service provider, except for a phone service, I want to be able to control all settings myself.

toro
join:2006-01-27
Scarborough, ON

toro to pulsar777

Member

to pulsar777
Who is the provider ?

VexorgTR
join:2012-08-27
Sheffield Lake, OH

VexorgTR to pulsar777

Member

to pulsar777
Did you try the "Reset By IVR" method? It worked for all the ones that Clear sent out.
pulsar777
join:2009-12-21

1 edit

pulsar777 to toro

Member

to toro
local, non-U.S. provider. Reset By IVR method: did you mean reset the device to factory defaults with phone pad by dialing **** and pressing 7xxxx#..? It ask password at the end. Also I don't want to erase all the configuration settings.

toro
join:2006-01-27
Scarborough, ON

toro to pulsar777

Member

to pulsar777
Then unless your provider gives you the password there is very little you can do.
You can try to sniff the traffic from the ATA when it boots up, by connecting its WAN interface to your router through to an old hub (not switch), connecting your PC to the same hub and running Wireshark. The ATA will probably use TFTP, HTTP or HTTPS to retrieve its configuration file within the first 1-2 minutes of the boot up. Unless it uses HTTPS, you can actually see the request and the URL for the file and try to download it manually. Then, if you're lucky and the file is not encrypted you can get your passwords from there or you can spoof the provider's servers and "feed" the ATA another file which will reset the passwords. If the file is encrypted you are out of luck, you won't be able to decrypt it without knowing the key which is stored in the ATA.
pulsar777
join:2009-12-21

pulsar777

Member

the ATA and PC both are connected to the router, which connected to cable modem. Do I need connect it through the hub before router? Also, I read somewhere that encryption somehow use MAC address of ATA for the key.

toro
join:2006-01-27
Scarborough, ON

toro

Member

said by pulsar777:

the ATA and PC both are connected to the router, which connected to cable modem. Do I need connect it through the hub before router? Also, I read somewhere that encryption somehow use MAC address of ATA for the key.

Yes, the hub basically replicates all packets to all ports, so your PC can sniff the traffic that is supposed to go to the ATA. With a switch (which is built into today's routers), the traffic only goes to the port of the device that is meant to receive it.
The encryption can be done in different ways, the most common one is to save a unique encryption key in the ATA and all the provisioning files feed to the ATA afterwards will be encrypted with that key.
pulsar777
join:2009-12-21

pulsar777

Member

If ATA use TFTP to retrieve its configuration file, the TFTP server may be configured to prevent direct download of configuration file, is it correct?

toro
join:2006-01-27
Scarborough, ON

toro

Member

Usually no. However that restriction may be implemented in case of HTTPS (but in that case you can't even see the URL for the config file)
IPfaxer
join:2010-10-24

IPfaxer to pulsar777

Member

to pulsar777
1. you can reset it
2. no, it will not save your configuration - it will RESET it - not just passwords

don't know why people are looking at diagrams of the circuit board - pretty irrelevant

toro
join:2006-01-27
Scarborough, ON

toro

Member

The ****73738# reset sequence can be blocked by the provider (basically it asks for the admin password), and in case of the OP it is blocked: »Re: [Unlock] Unlocking Linksys SPA2102 adapter
pulsar777
join:2009-12-21

1 edit

pulsar777 to IPfaxer

Member

to IPfaxer
said by IPfaxer:

don't know why people are looking at diagrams of the circuit board - pretty irrelevant

well, if this device has a programming ports that support jtag, it would be possible to dump the chip. However, the CPU has to support JTAG (which the ATA seems doesn't) and there has to be the connectors or test pads to connect to.

toro
join:2006-01-27
Scarborough, ON

toro

Member

There's no JTAG support on the Linksys SPAxxxx and PAP2(T) series of ATAs. Have you tried capturing the traffic with wireshark yet ?
pulsar777
join:2009-12-21

pulsar777

Member

will try..
pulsar777

pulsar777

Member

is it possible to configure the same phone number on another SPA in different network node?

toro
join:2006-01-27
Scarborough, ON

toro

Member

Do you have the SIP credentials, server info, etc ?
hardly
Premium Member
join:2004-02-10
USA

hardly to pulsar777

Premium Member

to pulsar777
And does the provider support multiple registrations?
pulsar777
join:2009-12-21

pulsar777 to toro

Member

to toro
assuming that I will have the SIP credentials.

toro
join:2006-01-27
Scarborough, ON

toro

Member

This thread is full of questions and assumptions but except for taking the ATA apart you haven't tried anything yet.
If the provider doesn't give you the SIP credentials, there's no way to get them from the ATA, even if it's unlocked (you can read everything except for the passwords).
If you get the SIP credentials, you can set them up on another ATA in such a way that you can make outbound calls. For inbound calls the ATA must register with the VoIP provider and 99% of the providers don't support multiple registrations. If both ATAs are online, only the last ATA that has registered will ring on inbound calls.
pulsar777
join:2009-12-21

pulsar777

Member

as I can no find hub, I connected PC to ATA ethernet port and cable modem to ATA internet port. I tried sniff packets with Ethereal, unplugged the AC adapter from the ATA, wait 30 sec then connected again. What I can see there is a lot of requests, I can see an IP address assigned to ATA, and "Server Identifier" IP address: is it IP address where config file requested from? The other info I see is Host name= SipuraSPA. But I didn't see config file name and path to this file. Also, I think the config file probably transferred via TFTP, not HTTP. How I can get it?

toro
join:2006-01-27
Scarborough, ON

toro

Member

You can't capture the traffic made by the WAN interface if your computer is connected to the LAN port.
You can often find hubs for a few dollars at thrift stores.
Some users have succeeded capturing the traffic by setting up Internet Connection Sharing on a laptop, connecting the laptop to the router via wireless and connecting the ATA to the LAN port of the router through a crossover cable. Personally I have never needed this setup so I haven't done it.
pulsar777
join:2009-12-21

1 edit

pulsar777

Member

Well, finally I got the hub, connected ATA and PC, and captured the network traffic when the ATA is powered on. I can see some info, but I can no find path to server where ATA configuration file loaded during the boot. I am not sure, but config name seems is D3-3c.bin, that this name looks like cable modem config file, strange. I save capture, Ethereal default format. Can anybody help me?

toro
join:2006-01-27
Scarborough, ON

toro to pulsar777

Member

to pulsar777
Can you start another capture, reboot the adapter and let the wireshark run longer (10-15 min) ? You only let it run for about 90 seconds and the only thing it capured was the DHCP transaction where the ATA got the IP address and then it registered to the VoIP provider.
pulsar777
join:2009-12-21

2 edits

pulsar777

Member

I attached another ones. ATA IP address 10.250.63.39
Is the D2.bin, D3-1n.bin, D3-3c.bin configs for cable modem?