Moderators: Bill Smith, Pilot
Nah, that would imply that some actual security was implementedMagicHack wrote:It looks like magicJack patched that URL a little... although, you can still obtain SIP information using the URL above, you just need to pass a valid nonce, chkval, and version along with the serial number, and you can still obtain your (or someone elses) SIP info.
OK, so they did make some server side changes, they were just not as clever as I gave them credit for.Stewart wrote:Nah, that would imply that some actual security was implementedMagicHack wrote:It looks like magicJack patched that URL a little... although, you can still obtain SIP information using the URL above, you just need to pass a valid nonce, chkval, and version along with the serial number, and you can still obtain your (or someone elses) SIP info.
It's just that old versions are no longer supported -- try http://prov1.talk4free.com/softphone/pr ... xxxxxxxxxx .
New passwords are 12 characters nowjoecanadian wrote:My proxy user password was alot more then 4 digits?!
do I just use the first 4 digits?
Thanks for the heads up. It looks like they are indeed phasing in encryption. For now, you can use version=20071210000000 (last date before encryption started), though that will obviously soon stop working.banstro wrote:Its not working anymore. Just checked a few times .. the page shows some encrypted text. Looks like they have encrypted the account information, just like Sunrocket used to do.
MagicHack... how did that app of your go... did you finish it? With Cain & Abel set at 12 numbers, it'll take my PC 14 days... it's it's just digits it might be doable, but if not... i think i'll have to find a 64bit multithreated app that will prob go much much faster. Any ideas???MagicHack wrote:Gregg,
Your post is very useful to the Newbie, but I want to point out a few things.
The second 'Connection' to the magicjack proxy server is not really a 'connection'. It is UDP, and thus connectionless. (yes, I am nit-picking. This is an important point if you ever decided to brute force someone elses password, because you have to deal with dropped packets.) If you sniff the wire, you will see that the second 'connection' usually looks something like this:Code: Select all
MagicJack SIP Server | | |------------REGISTER --------->| | | |<------401 Unauthorized--------| | | |-----------REGISTER----------->| | | |<-----------200 OK-------------| | |
The data passed across the wire for this second 'connection' is not encrypted either - it is an MD5 checksum. It is just standard WWW-Authentication (see rfc2617). So, the actual calculation for the 'encrypted' password is as follows:
I looked all of this stuff up a while back because I was writing a tool to brute force the passwords:Code: Select all
Calculate A1 = MD5(username:realm:password) Calculate A2 = MD5(METHOD:uri) Calculate Final Hash = MD5(A1:nonce:A2)
(Of course, after writing this, someone pointed out that tools like cain exist, and do this kind of thing automatically for you...)
MagicHack
thank you thank you for answering my post. i'll start cracking now that i know my efforts won't be futilejoecanadian wrote:password in mine is all numbers
i know... i wanted to use an ata so i don't use too much electricity with my pc on all the time... i'm kinda sad i just missed it by days... but you can still get your username with cain & abel and the other settings are most likely the same. i wouldn't quite give up yet. all you need is a password, but it's limited to just numbers (12), which cain reports it'll take a little over 14 days... so if there's no power outage or anything (i don't have a ups), i'll post my results when it's done.SpamBox wrote:This sucks.
Just got done ordering my magicjack.
And now it looks like I'm not going to be able to use it the way I wanted too.
Keep me (us) posted. Hopefully by the time I get mine in the mail, your Cain will be done working. And everything will be working.candlebox1369 wrote:i know... i wanted to use an ata so i don't use too much electricity with my pc on all the time... i'm kinda sad i just missed it by days... but you can still get your username with cain & abel and the other settings are most likely the same. i wouldn't quite give up yet. all you need is a password, but it's limited to just numbers (12), which cain reports it'll take a little over 14 days... so if there's no power outage or anything (i don't have a ups), i'll post my results when it's done.
it's too bad cain & abel doesn't have a save/resume. eh. but we'll see what happens... if anybody comes up with anything before then, please share
but if not, merry christmas everyone... be back soon...
I got a P4 2.8G HT, 2GB ramjoecanadian wrote:SpamBox how fast is your system ... cpu, ram... ?
so I can rough how long mine will take!
I am 512 amd athlon1200 mobile (laptop )
250,000 years! wow, Vista should be stable by then!ir_efrem wrote:14 days on mine as well...
I about flipped the first go around - i didn't select custom and left it at predefined (with the whole alphabet and all the numbers), it said 250,000 years...
I feel so stupid sometimes
would be nice if some one has some fore-knowledge as to whether or not this works.
naw , Vista is a In between they are already talking about the new OS. They will probably history repeat them selves and abandon it cut support. But no fear they have the biggest linux lab in the world and must be studying Linux possibly build a microsoft flavour cause its the only way they could survive lol!250,000 years! wow, Vista should be stable by then!
I know they changed it from a 4 digit to a 12 digit. I had my new 12 digit password and I had it working after the change. They changed something again within the past 24 hours.magicman wrote:(kenbr you cANT run Fiddler while doing the upgrade!, wait until upgrade is complete, then start it!)
(yes jeffnyc! something has changed, Magicjack has changed all their softphone passwords! and they are no longer a numeric 4 digit number!)
I guess ya got one . . .candlebox1369 wrote:for everyone else with an ATA, does it still work??? cuz i was thinking of getting one...
They changed it to 12 digits when the portal was first introduced and you could change your number. They encrypted it with in the next few days. I retrieved it before they encrypted it. It was working for me fine until today.magicman wrote:mabey they changed it from 12 digit to some other length? how did you know it was 12 digit?
I'm sure they must be reading this forum. They want to see what security holes they have and patch them. Who wouldn't? I was hoping that they would view the few who already had their passwords before the encryption as "water over the dam" but I guess they decided to make the effort to shut those down too.candlebox1369 wrote:does anybody think that maybe magicJack reads the forums here and finds way to make it more troublesome for us?
, after all, we can save even more money and electricity this wayI would pretty much second that opinion. I haven't really had any problem with the USB adapter but I need an ATA so it can be up at all times without having to worry about whether the computer is up or not. I work from home and I do a lot of testing on my PC. This requires quite a bit of shutting down and rebooting which is not really a good thing if you're on the phone with a customer at the same time. Although I really like the Magicjack service I don't know that I can use it if I have to have the PC running to talk.kumar wrote:Not to suck up or anything but this is still their beta. I would say they're doing a pretty good job for beta even though there are some bugs. For $40 i am not complaining.
i third it. i was actually surprised it was working in xp x64! which means it should also works in windows server 2003 x64. not bad....kenbr wrote:I would pretty much second that opinion.kumar wrote:Not to suck up or anything but this is still their beta. I would say they're doing a pretty good job for beta even though there are some bugs. For $40 i am not complaining.
i agree. it could be better for both them and us... if magicJack lets users use an ATA, even if they don't provide support for it, then their service will be OS independent, not to mention that once it's up, the connection will be more reliable as we all know hardware beats software any day. why keep this quality away from the customers? plus, they will get less customer support headaches because there will be less people with problems.joecanadian wrote: hey as lovely as that is.. I don't use windows I use Linux thats all..
if they open things up and keep things as cheap as they are I will buy alot more accounts.
this reminds me of a story i read on betanews... how skype went down due to microsoft's fault (all the super node computers simultaneously rebooting at the same time because of windows update which runs 2nd tues of each month if set an automatic) but then how it wasn't.... and how it was interesting that before that happened the govt. wanted a way in which would require changing their algorithm or something like that... maybe this won't be for magicJack, but these days who knows.joecanadian wrote: I sorta like knowing that all the traffic from my computer actually is..
no hidden tasks no 3 keys for complet backdoor access one the NSA has.. no secrets..
