D-Link Accidentally Publishes Private Code Signing Keys

New submitter bartvbl writes: As part of the GPL license, D-Link makes its firmware source code available for many of its devices. When looking through the files I accidentally stumbled upon 4 different private keys used for code signing. Only one — the one belonging to D-Link itself — was still valid at the time. I have successfully used this key to sign an executable as D-Link. A Dutch news site published the full story (translated to english with Google Translate).

Comments

Revoked the keys, but is this still exploitable?

[Anonymous Coward]

They revoked the keys in question in some time in September.

But if you disconnect the machine from the internet, or otherwise block the connection to the server that provides revocation information, will the Windows system still see an executable signed with the revoked key as valid?

I'm not an expert. Genuinely asking.

Re:Revoked the keys, but is this still exploitable

[tapspace]

if you disconnect the machine from the internet, or otherwise block the connection to the server that provides revocation information, will the Windows system still see an executable signed with the revoked key as valid?

Yes, that is exactly how it works. To give an example of how weak this security control is, Google Chrome no longer even bothers, ignoring revocation lists completely.

Reminds me of story about a graphics chip company

[Ungrounded Lightning]

I'll leave the company name out (mostly to protect my source B-) )

This was in the early part of the cycle of:
  - A handful of companies made graphics accelerator chips..
  - A BUNCH of new companies also made graphics accelerator chips.
  - There was a shakeout and only a few survived - not necessarily many - or any - of the original handful.
The company in question was one of the original few.

The hardware was good. But much of the performance advantages were due to some good algorithms in the driver, which were applicable to other good, bad, or moderate capability hardware, rather than depending on special features of the company's product.

As with many Silicon Valley companies, where the value added was so high that the administration could be utterly wacky or clueless and the company would still survive for years, this one had some managers make some dumb decisions.

One dumb decision was to try to save money by limiting the personnel to one new floppy disk per month. So the developers kept reusing the disks they had, when they shouldn't.

As a result, the golden master for an object-only release of the driver was built on a used disk, which had once held the complete sources of the driver in question. Apparently the "reformat" process used didn't overwrite the sectors - but the manufacturing process that cloned the golden master DID copy those sectors.

A customer tried an undelete utility and found almost the entire source code. Oops!

This news got out. Over the next couple years the great algorithms went from being a valuable trade secret (much of the company's "secret sauce") to a de facto industry standard.