critical WPA2 vulnerabilities afoot, see KRACK attacks (discussion @ /r/KRaCK, HN, /r/netsec, Slashdot)

Panasonic N5HBZ0000055

From WikiDevi
Jump to: navigation, search

Panasonic N5HBZ0000055

Manuf/OEM/ODM Askey WLU5080-D81

FCC approval date: 02 December 2010

Amazon image

ASIN
B00AK4L30C (Flag of the United States.svg, On Amazon, On CCC)

Interface: USB

USB 2.0
Connector: Male A
Form factor tags: dongle

ID: 04da:3904
Windows: USB\VID_04DA&PID_3904

FCC ID: H8N-WLU5080
Industry Canada ID: 1353A-WLU5080

Chipset: Atheros AR9002U-2NX

WI1 chip1: Atheros AR7010

WI1 chip2: Atheros AR9280

Probable Linux driver
ath9k_htc (in backports, open firmware)
USB ID first seen in kernel v3.5 (2012-07-21)
(see also passys)

Windows driver
try this, if it doesn't work let me know

Antenna connector: none

abgn, 1x2:2

has accessible UART

OUI: 24:EC:99 (-, 1 W, 2010), 4C:ED:DE, B4:74:9F, E0:CA:94 (-, 3 W, 2011)

 FCC ID
Askey WLU5080-D81H8N-WLU5080
For a list of all currently documented Atheros chipsets with specifications, see Atheros.



This device may also be known as TY-WL20U.

Additional models of N5HBZ0000056 and N5HBZ0000057 noted within the WLU5080's test report.

Usage on Linux w/ ath9k_htc[edit]

This device works fine with ath9k_htc. At least some units (or probably most US distributed ones) have the following EEPROM settings...

Capable of Master / AP operation but because of the EEPROM world regulatory domain, it will not work as a Master / AP device in the 5GHz band on most platforms. The linux cfg80211 driver reports this condition as...

wlan0: IEEE 802.11 Configured channel (36) not found from the channel list of current mode (2) IEEE 802.11a
wlan0: IEEE 802.11 Hardware does not support configured channel
Could not select hw_mode and channel. (-4)

This can be circumvented, but it requires mucking with the regulatory framework in some fashion.

OpenWRT 'Barrier Breaker' since r32126 contains a fix that removes the "no IR/IBSS" condition on channels 36-48 only, permitting AP / Master mode on these channels. Tested to work on this device.

Images[edit]

External[edit]

Panasonic N5HBZ0000055 top.jpg Panasonic N5HBZ0000055 bot.jpg

Internal[edit]


Additional info[edit]

dmesg dump[edit]

usb 3-2: new high-speed USB device number 7 using xhci_hcd
usb 3-2: New USB device found, idVendor=04da, idProduct=3904
usb 3-2: New USB device strings: Mfr=16, Product=32, SerialNumber=48
usb 3-2: Product: UB94
usb 3-2: Manufacturer: ATHEROS
usb 3-2: SerialNumber: 12345
usb 3-2: ath9k_htc: Firmware htc_7010.fw requested
usb 3-2: ath9k_htc: Transferred FW: htc_7010.fw, size: 72992
ath9k_htc 3-2:1.0: ath9k_htc: HTC initialized with 45 credits
ath9k_htc 3-2:1.0: ath9k_htc: FW Version: 1.3
ath: EEPROM regdomain: 0x6a
ath: EEPROM indicates we should expect a direct regpair map
ath: Country alpha2 being used: 00
ath: Regpair used: 0x6a
ieee80211 phy5: Atheros AR9280 Rev:2

cat /sys/kernel/debug/ieee80211/phyX/ath9k_htc/base_eeprom[edit]

mTOR ath9k_htc # cat base_eeprom
       Major Version :         14
       Minor Version :         25
            Checksum :      13353
              Length :       3556
          RegDomain1 :        106
          RegDomain2 :         31
             TX Mask :          1
             RX Mask :          3
          Allow 5GHz :          1
          Allow 2GHz :          1
   Disable 2GHz HT20 :          0
   Disable 2GHz HT40 :          0
   Disable 5Ghz HT20 :          0
   Disable 5Ghz HT40 :          0
          Big Endian :          0
   Cal Bin Major Ver :          0
   Cal Bin Minor Ver :          8
       Cal Bin Build :        133
          MacAddress : e0:ca:94:9f:f9:e5

cat /sys/kernel/debug/ieee80211/phyX/ath9k_htc/modal_eeprom[edit]

iw phy info[edit]

Wiphy phy0
	Band 1:
		Capabilities: 0x114e
			HT20/HT40
			SM Power Save disabled
			RX HT40 SGI
			RX STBC 1-stream
			Max AMSDU length: 3839 bytes
			DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 8 usec (0x06)
		HT RX MCS rate indexes supported: 0-15
		TX unequal modulation not supported
		HT TX Max spatial streams: 1
		HT TX MCS rate indexes supported may differ
		Frequencies:
			* 2412 MHz [1] (20.0 dBm)
			* 2417 MHz [2] (20.0 dBm)
			* 2422 MHz [3] (20.0 dBm)
			* 2427 MHz [4] (20.0 dBm)
			* 2432 MHz [5] (20.0 dBm)
			* 2437 MHz [6] (20.0 dBm)
			* 2442 MHz [7] (20.0 dBm)
			* 2447 MHz [8] (20.0 dBm)
			* 2452 MHz [9] (20.0 dBm)
			* 2457 MHz [10] (20.0 dBm)
			* 2462 MHz [11] (20.0 dBm)
			* 2467 MHz [12] (20.0 dBm) (passive scanning)
			* 2472 MHz [13] (20.0 dBm) (passive scanning)
			* 2484 MHz [14] (disabled)
		Bitrates (non-HT):
			* 1.0 Mbps
			* 2.0 Mbps (short preamble supported)
			* 5.5 Mbps (short preamble supported)
			* 11.0 Mbps (short preamble supported)
			* 6.0 Mbps
			* 9.0 Mbps
			* 12.0 Mbps
			* 18.0 Mbps
			* 24.0 Mbps
			* 36.0 Mbps
			* 48.0 Mbps
			* 54.0 Mbps
	Band 2:
		Capabilities: 0x114e
			HT20/HT40
			SM Power Save disabled
			RX HT40 SGI
			RX STBC 1-stream
			Max AMSDU length: 3839 bytes
			DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 8 usec (0x06)
		HT RX MCS rate indexes supported: 0-15
		TX unequal modulation not supported
		HT TX Max spatial streams: 1
		HT TX MCS rate indexes supported may differ
		Frequencies:
			* 5180 MHz [36] (30.0 dBm) (passive scanning, no IBSS)
			* 5200 MHz [40] (30.0 dBm) (passive scanning, no IBSS)
			* 5220 MHz [44] (30.0 dBm) (passive scanning, no IBSS)
			* 5240 MHz [48] (30.0 dBm) (passive scanning, no IBSS)
			* 5260 MHz [52] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5280 MHz [56] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5300 MHz [60] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5320 MHz [64] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5500 MHz [100] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5520 MHz [104] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5540 MHz [108] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5560 MHz [112] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5580 MHz [116] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5600 MHz [120] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5620 MHz [124] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5640 MHz [128] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5660 MHz [132] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5680 MHz [136] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5700 MHz [140] (30.0 dBm) (passive scanning, no IBSS, radar detection)
			* 5745 MHz [149] (30.0 dBm) (passive scanning, no IBSS)
			* 5765 MHz [153] (30.0 dBm) (passive scanning, no IBSS)
			* 5785 MHz [157] (30.0 dBm) (passive scanning, no IBSS)
			* 5805 MHz [161] (30.0 dBm) (passive scanning, no IBSS)
			* 5825 MHz [165] (30.0 dBm) (passive scanning, no IBSS)
		Bitrates (non-HT):
			* 6.0 Mbps
			* 9.0 Mbps
			* 12.0 Mbps
			* 18.0 Mbps
			* 24.0 Mbps
			* 36.0 Mbps
			* 48.0 Mbps
			* 54.0 Mbps
	max # scan SSIDs: 4
	max scan IEs length: 2257 bytes
	Coverage class: 0 (up to 0m)
	Supported Ciphers:
		* WEP40 (00-0f-ac:1)
		* WEP104 (00-0f-ac:5)
		* TKIP (00-0f-ac:2)
		* CCMP (00-0f-ac:4)
		* CMAC (00-0f-ac:6)
	Available Antennas: TX 0x1 RX 0x3
	Configured Antennas: TX 0x1 RX 0x3
	Supported interface modes:
		 * IBSS
		 * managed
		 * AP
		 * AP/VLAN
		 * monitor
		 * mesh point
		 * P2P-client
		 * P2P-GO
	software interface modes (can always be added):
		 * AP/VLAN
		 * monitor
	valid interface combinations:
		 * #{ managed, P2P-client } <= 2, #{ AP, mesh point, P2P-GO } <= 2,
		   total <= 2, #channels <= 1
	Supported commands:
		 * new_interface
		 * set_interface
		 * new_key
		 * new_beacon
		 * new_station
		 * new_mpath
		 * set_mesh_params
		 * set_bss
		 * authenticate
		 * associate
		 * deauthenticate
		 * disassociate
		 * join_ibss
		 * join_mesh
		 * remain_on_channel
		 * set_tx_bitrate_mask
		 * action
		 * frame_wait_cancel
		 * set_wiphy_netns
		 * set_channel
		 * set_wds_peer
		 * Unknown command (84)
		 * Unknown command (87)
		 * Unknown command (85)
		 * Unknown command (89)
		 * Unknown command (92)
		 * testmode
		 * connect
		 * disconnect
	Supported TX frame types:
		 * IBSS: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * AP/VLAN: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * mesh point: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
		 * Unknown mode (10): 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
	Supported RX frame types:
		 * IBSS: 0x40 0xb0 0xc0 0xd0
		 * managed: 0x40 0xd0
		 * AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
		 * AP/VLAN: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
		 * mesh point: 0xb0 0xc0 0xd0
		 * P2P-client: 0x40 0xd0
		 * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
		 * Unknown mode (10): 0x40 0xd0
	Device supports RSN-IBSS.
	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	Device supports TX status socket option.
	Device supports HT-IBSS.