Netgear Signed TLS Cert Private Key Disclosure

Post by [deleted] » Mon, Jan 20, 2020, 10:25 AM UTC

rvnx wrote: post #34

Erlich_Bachman wrote: post #11

Earlier quoted context omitted.

"How" is that they only inlude the private key for that specific router, and then that key/cert itself is certified by the real CA cert, the key for which is not kept on the router itself?

Delegated Credentials for TLS I guess ? but this requires internet access so barely a solution. https://engineering.fb.com/security/delegated-credentials/ I don't think that the fact that private keys for routerlogin.net are bundled with the router are an issue. It's very logical to do so, and BETTER than plain HTTP in most real-life scenarios. routerlogin.net is a local server (when you are using the router) and not…

Post by devwastaken » Mon, Jan 20, 2020, 10:27 AM UTC

tinus_hn wrote: post #38

regecks wrote: post #2

6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly. This is not what you should do as a security researcher - delete the gist until the CAs h…

Boo hoo. Netgear should have known better than to expose their keys like this in the first place, this is really amateur hour stuff. They were reached out to and didn’t respond. It’s their own fault and they have to make do with what they’ve been granted. Now they get to pick up the pieces.

Post by CiPHPerCoder » Mon, Jan 20, 2020, 10:45 AM UTC

mschuster91 wrote: post #10

The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser will whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked? The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10…

Post by ryanlol » Mon, Jan 20, 2020, 10:50 AM UTC

regecks wrote: post #2

6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly. This is not what you should do as a security researcher - delete the gist until the CAs h…

Post by TheSwordsman » Mon, Jan 20, 2020, 11:03 AM UTC

vbezhenar wrote: post #12

mschuster91 wrote: post #10

The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser will whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked? The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10…

1. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet. 2. Router coordinates with company server to get its own hostname like n-123123123.netgear.com (which points to 192.168.1.1 or whatever), generates private key and company server issues certificate for that key. HTTP requests to 192.168.1.1 return HTTP 302 to this address. It requires Netgear to operate CA…