Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear Signed TLS Cert Private Key Disclosure

gist.github.com

Post reply on HN
Print view View original

51–60 of 158 posts

Re: Netgear Signed TLS Cert Private Key Disclosure

#51

Post by mcny »

TheSwordsman wrote: post #49
vbezhenar wrote: post #12

Earlier quoted context omitted.

1. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet. 2. Router coordinates with company server to get its own hostname like n-123123123.netgear.com (which points to 192.168.1.1 or whatever), generates private key and company server issues certificate for that key. HTTP requests to 192.168.1.1 return HTTP 302 to this address. It requires Netgear to operate CA…

The issue is you're going to have the ignorant customers calling Netgear to complain their brand new router is not secure if their browser highlights it for situation #1. Same for an untrusted certificate. The risk with #2 is then an attacker could potentially probe the firmware to figure out that process, and phish from that domain? The other is we need to trust Netgear to run HA infrastructure to support that. (lol…

So it sounds like pretty much marketing/sales runs the company and the product people have no say at Netgear?

Re: Netgear Signed TLS Cert Private Key Disclosure

#52

Post by RL_Quine »

ryanlol wrote: post #48
CiPHPerCoder wrote: post #46

Some commenters are decrying that this post fails to meet the bar for "responsible disclosure". Please stop using that phrase. "Responsible disclosure". It's wrong and harmful , and the person who coined it agrees with me: https://adamcaudill.com/2015/11/19/responsible-disclosure-is... You want "coordinated disclosure" instead. Netgear doesn't do coordinated disclosure. They do non-disclosure. In the absence of a coo…

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

That isn't what disclosing these sort of vulnerabilities is about. The core reason for just going full disclosure is that the vendor has absolutely not incentive to fix any sort of bug that is kept private. The customer is impacted, never the vendor.

Re: Netgear Signed TLS Cert Private Key Disclosure

#53

Post by shock »

bottled_poe wrote: post #37

Netgear has reliably demonstrated to me over more than 10 years that they are incapable of delivering secure products of an acceptable quality. I actively avoid this brand like the plague.

I have posted this in another thread, but I am posting it again because more people need to be aware of Netgear's practices:

I recently bought a couple of Netgear Managed Switches (for Business)⁰ and in their datasheet they list "Local-only management" as a feature. Only after they arrived we discovered that you only get limited functionality in the Local-only management mode, you have to register the switches to your Netgear Cloud account to get access to the full functionality.

Reading up on it, this was achieved only after a community outcry because in the prior firmware versions the switch would have to connect to the Netgear Cloud on every bootup.

Needless to say I would not have bought the swiches if I had knew I needed to register them to Netgear Cloud to have access to the full functionality specified in the data sheet. If I had bought them as a consumer, not as a business, I would have returned them immediately.

Netgear are now on our purchasing blacklist.

⓪ - the switches are Netgear GS-108Tv3

Re: Netgear Signed TLS Cert Private Key Disclosure

#54

Post by josteink »

I guess I run a different firmware for my Netgear ReadyNAS 312.

This is easy to inspect because the FW is Debian-based, and enabling inbound SSH is easy.

Checking on mine, it has a cert only for the "nas.local"-domain, and the cert is stored in /etc/ssl/certs/ssl-cert-snakeoil.pem and /etc/ssl/private/ssl-cert-snakeoil.key respectively.

Have to admit I love the naming of those files :)

Edit: Obviously it is a different firmware. Mine is a NAS, this was a router. And “snakeoil” seems to be default debianism.

Re: Netgear Signed TLS Cert Private Key Disclosure

#55

Post by pixl97 »

vbezhenar wrote: post #12
mschuster91 wrote: post #10

The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser will whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked? The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10…

1. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet. 2. Router coordinates with company server to get its own hostname like n-123123123.netgear.com (which points to 192.168.1.1 or whatever), generates private key and company server issues certificate for that key. HTTP requests to 192.168.1.1 return HTTP 302 to this address. It requires Netgear to operate CA…

#3 is why IPv6 needs universally pushed out by all ISPs.

Re: Netgear Signed TLS Cert Private Key Disclosure

#56

Post by josteink »

tinus_hn wrote: post #40
ploxiln wrote: post #28

Earlier quoted context omitted.

The difference is that these newly discovered certs with private keys were signed by real Certificate Authorities trusted by browsers by default.

So their security got worse. It’s a miracle people even bother attempting to do responsible disclosure to fools like this.

> so their security got worse

Only because current browsers makes it increasingly hard to run medium security, user-trusted networking.

Re: Netgear Signed TLS Cert Private Key Disclosure

#57

Post by philjohn »

bottled_poe wrote: post #37

Netgear has reliably demonstrated to me over more than 10 years that they are incapable of delivering secure products of an acceptable quality. I actively avoid this brand like the plague.

True, but the devices themselves are often pretty powerful in the home networking space, especially for the price.

I've got an R7800 running as the main router in my home, however, it's flashed with OpenWRT as their own software is a complete mess.

Re: Netgear Signed TLS Cert Private Key Disclosure

#58

Post by josteink »

To all the people shitting on Netgear and security in this thread, just how do you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA?

Really. Please educate the world with your ingenious insight. I’ll be waiting.

The unavoidable truth is: You have to stuff the key in there somehow. There’s no way around that.

Either browsers have to start accepting “local” certs more easily, or end-user network deployed appliances can’t have ssl.

Take a pick.

Re: Netgear Signed TLS Cert Private Key Disclosure

#59

Post by JshWright »

ryanlol wrote: post #48
CiPHPerCoder wrote: post #46

Some commenters are decrying that this post fails to meet the bar for "responsible disclosure". Please stop using that phrase. "Responsible disclosure". It's wrong and harmful , and the person who coined it agrees with me: https://adamcaudill.com/2015/11/19/responsible-disclosure-is... You want "coordinated disclosure" instead. Netgear doesn't do coordinated disclosure. They do non-disclosure. In the absence of a coo…

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

I think the millions of people with Netgear equipment deployed have some "stake in the game".

How does non-disclosure benefit them?

Re: Netgear Signed TLS Cert Private Key Disclosure

#60

Post by ajsnigrutin »

vbezhenar wrote: post #31
berti wrote: post #14

Earlier quoted context omitted.

All but one make for an undesirable UX during initial setup before WAN is up, which is probably the only time most users login to their router.

Yeah, that's why I think that movement to HTTPS everywhere must at least exclude private IP addresses. While it's expected to have HTTPS on public resources, what happens in my local network is my business and should not be considered insecure.

The problem is, that someone setting up a public wifi (in a restaurant for example), will be vulnerable to sniffing attacks (if they don't know what they're doing).
Post reply on HN