Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear Signed TLS Cert Private Key Disclosure

gist.github.com

Post reply on HN
Print view View original

21–30 of 158 posts

Re: Netgear Signed TLS Cert Private Key Disclosure

#21

Post by yardstick »

regecks wrote: post #2

6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly. This is not what you should do as a security researcher - delete the gist until the CAs h…

“ Thursday, January 16 - Bugcrowd responds, but we are unable to establish a communications channel outside of the Netgear bug bounty programs.”

I’m curious to what does this mean? They got a response form Bugcrowd but not Netgear themselves? Or they got through to Netgear but didn’t like what Netgear said so they went public? Something else?

Re: Netgear Signed TLS Cert Private Key Disclosure

#23

Post by politelemon » 

    Tuesday, January 14th 2020 - Initial Discovery

    Tuesday, January 14 2020 - Tweet sent attempting to establish communications with Netgear  

    Wednesday, January 15 2020 - Reached out to Bugcrowd to attempt to establish communications.  

    Thursday, January 16 - Bugcrowd responds, but we are unable to establish a communications channel outside of the Netgear bug bounty programs.  

    Friday, Jaunary 17th - Conversation with bugcrowd proves inconclusive  

    Sunday, January 19th - Feeling we have exhausted our disclosure avenues, we decide to publish
I didn't understand, can someone explain this to me - I see the author tried to talk to Netgear, then it's BUgcrowd the next day... it's not clear to me what the relation between Netgear and Bugcrowd is.

Re: Netgear Signed TLS Cert Private Key Disclosure

#24

Post by beardog »

regecks wrote: post #2

6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly. This is not what you should do as a security researcher - delete the gist until the CAs h…

I discovered this same thing in 2017. My bugcrowd report was shot down as dupe

https://www.chaoswebs.net/blog/tls-key-reuse-on-popular-rout...

Re: Netgear Signed TLS Cert Private Key Disclosure

#25

Post by vegardx »

peterwwillis wrote: post #17
mschuster91 wrote: post #10

The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser will whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked? The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10…

We could change the standards to facilitate client apps using a private network's own PKI. This would solve about a million problems that currently exist with most private orgs that need to enforce policy on content on secure networks, as well as allowing consumers to securely browse self-hosted private services. I don't know what that would look like or what would need to change, but it could definitely be done. Ide…

Or you know - don't use TLS at all since all your efforts will be moot anyway. You could always make a self-signed certificate and print the fingerprint on the device itself, but that costs money, for very little gain.

Re: Netgear Signed TLS Cert Private Key Disclosure

#26

Post by Maxious »

politelemon wrote: post #23

Tuesday, January 14th 2020 - Initial Discovery Tuesday, January 14 2020 - Tweet sent attempting to establish communications with Netgear Wednesday, January 15 2020 - Reached out to Bugcrowd to attempt to establish communications. Thursday, January 16 - Bugcrowd responds, but we are unable to establish a communications channel outside of the Netgear bug bounty programs. Friday, Jaunary 17th - Conversation with bugcrow…

Bugcrowd run bug bounty programs like https://bugcrowd.com/netgear on behalf of companies

They explained earlier that if they entered the bug bounty program with Netgear, they would be agreeing to not disclose: "By submitting the security bug, you affirm that you have not disclosed and agree that you will not disclose the security bug to anyone other than NETGEAR."

So it seems they were trying to get Bugcrowd as a intermediary to contact Netgear on their behalf to "establish a communications channel outside of the Netgear bug bounty programs"

Re: Netgear Signed TLS Cert Private Key Disclosure

#27

Post by Thorrez »

regecks wrote: post #2

6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly. This is not what you should do as a security researcher - delete the gist until the CAs h…

Full disclosure means 0 days generally.

Re: Netgear Signed TLS Cert Private Key Disclosure

#28

Post by ploxiln »

beardog wrote: post #22

I discovered this same thing in 2017. My bugcrowd report was shot down as dupe https://www.chaoswebs.net/blog/tls-key-reuse-on-popular-rout...

The difference is that these newly discovered certs with private keys were signed by real Certificate Authorities trusted by browsers by default.

Re: Netgear Signed TLS Cert Private Key Disclosure

#29

Post by GoblinSlayer »

peterwwillis wrote: post #17
mschuster91 wrote: post #10

The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser will whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked? The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10…

We could change the standards to facilitate client apps using a private network's own PKI. This would solve about a million problems that currently exist with most private orgs that need to enforce policy on content on secure networks, as well as allowing consumers to securely browse self-hosted private services. I don't know what that would look like or what would need to change, but it could definitely be done. Ide…

https://en.wikipedia.org/wiki/TLS-SRP as an example.

Re: Netgear Signed TLS Cert Private Key Disclosure

#30

Post by philprx »

buraksarica wrote: post #9
mjevans wrote: post #5

Earlier quoted context omitted.

I think in this case it's to force browser vendors (who have the most exploitable endpoints) and companies like Apple and Microsoft at the OS level, to blacklist the offending certs. Though the CAs in question should probably have an automated challenge-response system to which a timed signed reply of a given message of their choice causes a revocation of the key that signed the message. (As sufficient proof of "this…

The OS level actions won't be fast. So this disclosure is closer to an irresponsible attitude. At least CAs should be informed.

I tend to differ:

Netgear security is paid to manage security. They failed by not responding to these legitimate communications requests.

The researcher are not paid. They did what could be done to really fix the problem. Of course you can always do better as a researcher, always, but consider time available and paid vs. pro bono time. Also consider all the people who probably found this before and may have sold it on black market, you’re attacking the wrong people.

Post reply on HN