Database of private SSL keys for embedded devices

http://code.google.com/p/littleblackbox/

by bensummers • 16 years ago

80 19 16 years ago

code.google.com

tptacek2• 16 years ago

  select * from firmare
  [...]
  [4:08pm:~] RIDGELAND:tqbf [0:6]% pbpaste | egrep '[0-9]+\|[0-9]+\|[0-9]+' 
  | cut -d\| -f4-5 | cut -d\  -f1 | sort | uniq

Wireless access points.

ten72• 16 years ago

I don't get why this post keeps getting up voted: it's mostly just a list of DD-WRT firmware, small percentage of the market most likely. And wouldn't that be the most likely candidate for the appropriate fix, i.e. uniquely generated Keys on each device, not preprogrammed, and a way to import your own?

tptacek2• 16 years ago

Probably because it takes the 1.7 minutes required to download the stupid database, dump it, and sum it up for everyone else?

mmaunder• 16 years ago

Mostly used for home vpns and router admin https it looks like. Also dd-wrt is fairly niche.

ten72• 16 years ago

Great article. So what's the fix? What should the right approach have been? Let's see a solution!

And yes, I read the blog post associated with it and didn't see a solution: http://www.devttys0.com/2010/12/breaking-ssl-on-embedded-dev...

_b8r03• 16 years ago

The devices should've generated their keys (and provided a legit key import and cert generation function) once initialised at home instead of pre-generating them.

Of course, I'm waiting for the inevitable mashup with this and firesheep.

skymt• 16 years ago

That would protect against passive attacks with known keys, but it would do little to stop MitM attacks, since your freshly-generated certs haven't been signed by a CA.

Is there a way to add a unit-specific salt to a cert?

modeless• 16 years ago

This would only allow you to sniff/MITM SSL connections made by/to the router itself, right? Not connections made by users of the router to servers on the Internet. What do these routers use SSL for, anyway? Update checks? Admin control panels?

sp332• 16 years ago

I use SSL for my admin control panel. I don't know if it's really useful but I feel better :-)

jrockway3• 16 years ago

This is why I have my own CA. Too bad the router manufacturers don't do the same; let the router generate a key-signing request, paste it into the manufacturer's site (with a "real" SSL cert), download file suitable for providing to the router, enjoy secure VPN.

Oh yeah, but that would add like fifty cents to the cost of every $150 VPN router, and we can't have that!

rlpb• 16 years ago

Fifty cents and another ten dollars or more to deal with the extra tech support.

jrockway3• 16 years ago

When you unpack and plug-in a router, it automatically gets the current time without any tech support. Why not get an SSL cert too?

bmastenbrook• 16 years ago

Maybe it'd be a one time fee for somebody like Cisco that can afford the intermediate CA process, but I've looked into this for my own company and there's no way we can afford this. Nor is there any affordable option to prepurchase device certificates that I can find. If anybody actually has an idea on how to ship devices with unique certificates signed by a CA accepted by the majority of browsers, I'd love to hear it.

Raphael• 16 years ago

Good to see Hacker News living up to its name.

Database of private SSL keys for embedded devices

Related Stories