Slashdot Mirror
900 Embedded Devices Share Hard-Coded Certs, SSH Host Keys
An anonymous reader writes: Embedded devices of some 50 manufacturers has been found sharing the same hard-coded X.509 certificates (for HTTPS) and SSH host keys, a fact that can be exploited by a remote, unauthenticated attacker to carry out impersonation, man-in-the-middle, or passive decryption attacks. SEC Consult has analyzed firmware images of more than 4000 embedded devices of over 70 vendors — firmware of routers, IP cameras, VoIP phones, modems, etc. — and found that, in some cases, there are nearly half a million devices on the web using the same certificate.
What's that? The companies who make consumer electronics do a terrible job of security and routinely deliver products with little or no security?
Well, golly gee, I'm totally shocked.
No, wait, the other one ... where I think it should be self evident that probably 95% or more of all devices which want to connect to the internet should be presumed to be utterly insecure and not used.
It's pretty clear that without some penalties and liability, the companies who are trying to bring us the connected world are either incompetent at, or indifferent to, any form of security.
If it isn't a computer, I pretty much don't trust it with any form of network connection.
Lost at C:>. Found at C.
Nice biased article leaving Apple out, when part of Apple's touted security is HARD CODED KEYS embedded in hardware.
Why attack the little guys when one of the biggest of them all is given a free pass? Google key0x89b or go straight to http://www.sputtr.com/key0x89b for a copy.
What a bunch of idiots. Not just for sharing the same certificate between multiple devices, but for doing this in devices that clearly have mediocre to non-existent firmware read protection. Knowing how many of these products are put together, there is probably some underpaid graduate developer in China who is whoring out the same firmware to any MBA who wants to pay bottom dollar for everything.
I have worked with some pretty poor embedded developers in my time, but none of them would be this stupid. Their own magic number XOR encryption scheme would at least not have been as obvious as a duplicated X.509 cert sitting in firmware.
Dammit, I knew running the bum smacking machine on a ZigBee was a bad idea.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
There is not that much wrong with doing that. As long as you can not extract the certificate, why care?
Against popular believe SSH and HTTPS don't use public key encryption for the data transfer. A little bit thinking, in case of SSH at least, would make that obvious to everyone.
The public/private key encryption is used in the beginning of the handshake to exchange a stream cypher usually something like DES.
There is absolutely no difference in having a billion devices with the same keys/certificates and trying to use the data of all transmissions to them to crack them (reversal them) versus a singe certificate like google.com's and having billions of connections per day to that single point.
Of course it would be cooler if only small badges of devices had the same cert, or if you even would go through the hassle to make individual ones.
However someone smarter than me might point out the not so obvious attack vectors.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
"Embedded devices of some 50 manufacturers has been found sharing . . . . "
That should be "have been", not "has been". I'm sorry, but it just grates on my nerves.
Welcome to the internet of everything era, where nothing can possible go wrong.
I work trying to secure small embedded devices. It is frustrating beyond belief. No one will pay for real security. Most end users don't understand it and wont pay for real security. Banks, utilities and even governments don't care if the loss caused by a breach is incurred by someone else. Managers might care but they aren't going to stick their necks out and do anything different since they can never be blamed for following "industry best practices"
Until the people who have the ability to fix security problems are the same people who will incur the loss when something goes wrong we will never have secure IoT devices, let alone secure public infrastructure.
Did anybody compare the lists of devices sharing these hardcoded SSL certs to the lists in the Snowden Revelations that various projects in NSA were willing to crack on a wholesale basis for other departments?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I think of them as tires only (well, and the calendar). What since when do they make/sell/rebadge routers?