Slashdot Mirror
900 Embedded Devices Share Hard-Coded Certs, SSH Host Keys
An anonymous reader writes: Embedded devices of some 50 manufacturers has been found sharing the same hard-coded X.509 certificates (for HTTPS) and SSH host keys, a fact that can be exploited by a remote, unauthenticated attacker to carry out impersonation, man-in-the-middle, or passive decryption attacks. SEC Consult has analyzed firmware images of more than 4000 embedded devices of over 70 vendors — firmware of routers, IP cameras, VoIP phones, modems, etc. — and found that, in some cases, there are nearly half a million devices on the web using the same certificate.
And know that you use a bum smacking machine.
What's that? The companies who make consumer electronics do a terrible job of security and routinely deliver products with little or no security?
Well, golly gee, I'm totally shocked.
No, wait, the other one ... where I think it should be self evident that probably 95% or more of all devices which want to connect to the internet should be presumed to be utterly insecure and not used.
It's pretty clear that without some penalties and liability, the companies who are trying to bring us the connected world are either incompetent at, or indifferent to, any form of security.
If it isn't a computer, I pretty much don't trust it with any form of network connection.
Lost at C:>. Found at C.
Well, now that we know there are commonly reused keys shared between different firmware, it shouldn't be too hard to find them; download a variety of firmware updates, and look for a block of text the size of a key, that is identical between different firmware images. Imagine the kinds of botnets that are now possible...
http://it.slashdot.org/story/15/11/22/1431237/cios-spend-a-third-of-their-time-on-security
So, with all of that time, you guys never thought about this? You want us to trust your security and you don't know about Certs? They don't generate themselves!
it would fix the certificates, java multicore is all we need. java on more cores than like 3. 32/64 fine, arm/x86 fine.
Nice biased article leaving Apple out, when part of Apple's touted security is HARD CODED KEYS embedded in hardware.
Why attack the little guys when one of the biggest of them all is given a free pass? Google key0x89b or go straight to http://www.sputtr.com/key0x89b for a copy.
What a bunch of idiots. Not just for sharing the same certificate between multiple devices, but for doing this in devices that clearly have mediocre to non-existent firmware read protection. Knowing how many of these products are put together, there is probably some underpaid graduate developer in China who is whoring out the same firmware to any MBA who wants to pay bottom dollar for everything.
I have worked with some pretty poor embedded developers in my time, but none of them would be this stupid. Their own magic number XOR encryption scheme would at least not have been as obvious as a duplicated X.509 cert sitting in firmware.
There is not that much wrong with doing that. As long as you can not extract the certificate, why care?
Against popular believe SSH and HTTPS don't use public key encryption for the data transfer. A little bit thinking, in case of SSH at least, would make that obvious to everyone.
The public/private key encryption is used in the beginning of the handshake to exchange a stream cypher usually something like DES.
There is absolutely no difference in having a billion devices with the same keys/certificates and trying to use the data of all transmissions to them to crack them (reversal them) versus a singe certificate like google.com's and having billions of connections per day to that single point.
Of course it would be cooler if only small badges of devices had the same cert, or if you even would go through the hassle to make individual ones.
However someone smarter than me might point out the not so obvious attack vectors.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
"Embedded devices of some 50 manufacturers has been found sharing . . . . "
That should be "have been", not "has been". I'm sorry, but it just grates on my nerves.
they hack into all those cameras and shit on cop shows....
I work trying to secure small embedded devices. It is frustrating beyond belief. No one will pay for real security. Most end users don't understand it and wont pay for real security. Banks, utilities and even governments don't care if the loss caused by a breach is incurred by someone else. Managers might care but they aren't going to stick their necks out and do anything different since they can never be blamed for following "industry best practices"
Until the people who have the ability to fix security problems are the same people who will incur the loss when something goes wrong we will never have secure IoT devices, let alone secure public infrastructure.
Did anybody compare the lists of devices sharing these hardcoded SSL certs to the lists in the Snowden Revelations that various projects in NSA were willing to crack on a wholesale basis for other departments?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I think of them as tires only (well, and the calendar). What since when do they make/sell/rebadge routers?