Using EBAY To Compromise Your Home Router For Fun and Profit

I started this project in late 2024 when I moved into new apartment and realized that, for the foreseeable future, I was stuck with COX home internet. During the sign up, I opted to use my own router and save some money.

Three days later, an installer showed up at my door and told me that he was here to install my new “COX Panoramic WiFi” router.

Very fancy. I decided that was fine, as long as I wouldn’t be charged extra for it.

Spectrum WiFi marketing graphic for Panoramic WiFi wall-to-wall coverage — wall-to-wall coverage!

The guy came into the apartment, plugged the router into the wall, and told me I was good to go! He said “the password is on the bottom of the box, if you forget it.”

My password for my router was “amount1890bacon”

I’m a curious person and I’m always eager to have new hardware I can poke at. I decided that I was going to do everything I could to break into this router before I took any steps to secure it.

I did all the standard stuff. I tried a WPS Pixie Dust attack, a PIN brute force attack, etc. No luck there.

Next, I sniffed the traffic until I received a four-way handshake and extracted the hash. I ran the hash against all the standard wordlists without any luck. Of course. A password like “amount1890bacon” wouldn’t be in any of the normal wordlists. It looked to be randomly generated.

I started thinking about that password. It looks like a pretty standard setup. Two words pulled from a dictionary with a four digit number in between.

Assuming a normal 3000 word simple english dictionary we get 3,000 words times 10,000 numbers times 3,000 words for a total of 90 BILLION possible combinations.

That’s a lot of combinations.

Calculator showing 3,000 times 10,000 times 3,000 equals 90,000,000,000 — proof I know how to do math

An average gaming computer can guess 950,000 WPA2 passwords per second. With 90 billion possibilities, it would take an average of 13 hours to guess a password. That wasn’t good enough for me.

I decided to start looking to see if I could reduce that number of possible combinations.

The first thing I did was check to see if all of the potential words were five or six letters long. If so, that would greatly reduce the number of possibilities.

I didn’t have enough friends with Panoramic WiFi routers to form any conclusions, so I went to the hacker’s paradise: EBAY.

eBay search results for Cox Panoramic Wifi gateways — despite the fact that these routers are rental-only, many still pop up for sale

I found out quickly that most online listings contained photos of the bottom of the router (and therefore contained the default password)

I started compiling these passwords into an excel sheet.

By the time I collected my first 60 words, I had noticed a few things:

Every word was either 5 or 6 characters long
Every word was simple english
Every word started with letters A through H

And even more concerning was the fact that I was catching a surprising number of duplicates.

You can estimate the size of a population by counting the number of duplicate entries you find along the way using a concept called the coupon collector’s problem. Imagine a coupon collector trying to collect all the coupons (words). She can use statistical analysis to determine with a high degree of precision how many coupons are left to collect. I estimated my total number of words to be around 200.

I kept collecting. I found out that the same password generation scheme was shared by several router models across several ISP including Xfinity, Rogers, Shaw, and now Spectrum.

Technicolor CGM4141
Technicolor CGM4981
Technicolor CGM4331
Xfinity XB6
Xfinity XB7-T
Xfinity XB8-T
Arris TG1682G (only when provided by Xfinity)

I scoured Facebook Marketplace, OfferUp, Ebay, French Ebay, Canadian Ebay, Yahoo Auctions, etc etc. I ended up finding 185 unique words.

about
bacon
bring
check
crumbs
energy
across
badge
brook
cheer
crunch
engine
action
bagel
brush
cheery
curve
enter
advice
baked
bucket
chord
daily
entire
again
baking
buckle
chore
dairy
equal
agree
banana
build
chores
daisy
escape
ahead
basic
built
chose
dance
event
aisle
basket
button
chosen
degree
factor
alert
beard
cabin
chunk
delay
famous
alley
become
cactus
circle
depend
fancy
allow
begin
called
cities
design
fasten
always
being
camel
class
detail
faucet
amaze
below
camera
clear
diesel
favor
amount
berry
canal
clever
dimmed
feast
anchor
beside
candid
coast
diner
fence
angle
better
canvas
cocoa
dinner
field
animal
block
career
collar
dough
filter
answer
bloom
carmel
column
dozed
finish
anyone
board
carpet
common
drain
flight
anyway
boast
castle
copied
dried
flower
appear
bonus
cattle
corral
drink
folded
apple
booth
caught
cough
eagle
follow
apron
bored
cause
count
earth
forest
arctic
borrow
celery
county
easier
garden
around
bottle
cellar
course
effect
gather
arrive
brace
center
court
eight
guitar
arrow
bread
chance
cover
eighty
happen
attic
breezy
charge
creak
elbow
harbor
autumn
brick
charm
cream
elect
hardly
award
bridge
chart
create
eleven
health
awhile
bright
chase
crumb
empty

Here’s how the math works when you know there are 200 words in the wordlist instead of 3,000.

You’ll have 400 million total combinations and a crack time averaging 3 minutes and 31 seconds.

To me, that’s just unacceptable. The majority of consumers do not change the default password. Every cybersecurity professional knows this. The ISPs know this. The “Getting Started” guide does not mention changing your password at all.

If a company is going to rely on randomly generated default passwords, they need to make sure there are enough random combinations available to protect users!

I'm publishing this because I believe consumers should know how easy it is to compromise their devices. I highly /highly/ recommend setting your own secure password. Even adding an extra word to these passwords would make them essentially uncrackable.

I found this exploit in 2024 and spend two years disclosing it to the ISPs involved. It seems as if these same routers with the same password schemes are still being issued to new customers.

All I can say is that it’s a good idea for you to change your default password. If you have Cox Panoramic WiFi or Xfinity X-Fi, your network can be compromised in less than five minutes.