Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear Signed TLS Cert Private Key Disclosure

gist.github.com

Post reply on HN
Print view View original

71–80 of 158 posts

Re: Netgear Signed TLS Cert Private Key Disclosure

#71

Post by zonidjan »

moviuro wrote: post #32
peterwwillis wrote: post #17

Earlier quoted context omitted.

We could change the standards to facilitate client apps using a private network's own PKI. This would solve about a million problems that currently exist with most private orgs that need to enforce policy on content on secure networks, as well as allowing consumers to securely browse self-hosted private services. I don't know what that would look like or what would need to change, but it could definitely be done. Ide…

Number 2: already dealt with: * .test * .example * .invalid * .localhost http://www.rfc-editor.org/rfc/rfc2606.txt

What? No. While those are meant to be reserved, nothing stops you from configuring your resolver to answer for them.

Re: Netgear Signed TLS Cert Private Key Disclosure

#72

Post by zonidjan »

oarsinsync wrote: post #66
josteink wrote: post #58

To all the people shitting on Netgear and security in this thread, just how do you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA? Really. Please educate the world with your ingenious insight. I’ll be waiting. The unavoidable truth is: You have to stu…

This was answered on the Gist in a comment[0] linking to a tweet[1]: Things to do instead of shipping TLS certs and static private keys to consumer-grade routers you sell by the thousand: Generate a unique keypair per device. Use this keypair to communicate upstream, in a similar fashion to CloudFlare's Keyless SSL. This keypair you generate on the device would need to be preloaded at the factory, unique per device,…

> Fallback to HTTP reachable via port 80 on the private IP for the server.

How, exactly, is that better than using a common cert? What threat do you propose that applies to HTTPS with a shared cert, and not to HTTP?

Re: Netgear Signed TLS Cert Private Key Disclosure

#73

Post by vbezhenar »

pjc50 wrote: post #64
josteink wrote: post #58

To all the people shitting on Netgear and security in this thread, just how do you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA? Really. Please educate the world with your ingenious insight. I’ll be waiting. The unavoidable truth is: You have to stu…

Define "secure". If you've "stuffed the key in there" in such a way that other people can get it out again, and it works across all routers of that model, then it's possible for an active attacker on your network to MITM your connection to your router. So it's slightly more secure than cleartext but not much; about the same as a random self-signed certificate. It is definitely a hard problem because there's no easy w…

AFAIK CA can't issue certificate for more than two years. So if you've bought the device two years after it was manufactured, you're getting error and it's even worse than HTTP for user.

Re: Netgear Signed TLS Cert Private Key Disclosure

#74

Post by throw0101a »

JshWright wrote: post #59
ryanlol wrote: post #48

Earlier quoted context omitted.

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

> How does non-disclosure benefit them?

And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now.

IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.

Re: Netgear Signed TLS Cert Private Key Disclosure

#75

Post by JshWright »

throw0101a wrote: post #74
JshWright wrote: post #59

Earlier quoted context omitted.

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

> How does non-disclosure benefit them? And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now. IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.

No one (that I've seen in this thread) disagrees that coordinated disclosure is the best path. If the vendor doesn't want to coordinate, then dumping the vulnerability is the best course available.

Re: Netgear Signed TLS Cert Private Key Disclosure

#76

Post by StavrosK »

throw0101a wrote: post #74
JshWright wrote: post #59

Earlier quoted context omitted.

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

> How does non-disclosure benefit them? And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now. IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.

> And how does dumping the vulnerability without a fix help Netgear owners?

It lets us know to buy another brand immediately and never buy Netgear again.

> IMHO, the best scenario is coordinated disclosure

The original post said that Netgear doesn't do coordinated disclosure, and subsequent posts were arguing whether non-disclosure or full disclosure were better. Nobody was disagreeing with what you said.

Re: Netgear Signed TLS Cert Private Key Disclosure

#77

Post by pjc50 »

vbezhenar wrote: post #73
pjc50 wrote: post #64

Earlier quoted context omitted.

Define "secure". If you've "stuffed the key in there" in such a way that other people can get it out again, and it works across all routers of that model, then it's possible for an active attacker on your network to MITM your connection to your router. So it's slightly more secure than cleartext but not much; about the same as a random self-signed certificate. It is definitely a hard problem because there's no easy w…

AFAIK CA can't issue certificate for more than two years. So if you've bought the device two years after it was manufactured, you're getting error and it's even worse than HTTP for user.

Indeed. So what was the expiry situation on this CA-signed certificate in the original article?

Re: Netgear Signed TLS Cert Private Key Disclosure

#78

Post by StavrosK »

JshWright wrote: post #63
gdm85 wrote: post #19

Earlier quoted context omitted.

There is another reason why responsible disclosure would have been better (and less short-sighted): vendor might make an internal audit, find root cause and invalidate a bunch of certificates at once (think about similarly leaked certificates due to a bug in some deployment tool). Now it's an open race with the bad guys, and surely a lot of them all at once; hardly an advantageous scenario for end users.

That's an awfully big (and awfully optimistic) "might" in your first paragraph there...

Not to mention that all the bad guys had to do to get the private key was unpack the firmware image, so they've probably noticed long ago.

Re: Netgear Signed TLS Cert Private Key Disclosure

#79

Post by ryanlol »

JshWright wrote: post #59
ryanlol wrote: post #48

Earlier quoted context omitted.

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

I have zero sympathy for end users who aren’t willing to hold the vendors accountable.

And besides, there’s nothing stopping the millions of end users from offering their own bribes in order to get shit fixed. $10 from each would go very far.

Re: Netgear Signed TLS Cert Private Key Disclosure

#80

Post by ryanlol »

RL_Quine wrote: post #52
ryanlol wrote: post #48

Earlier quoted context omitted.

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

That isn't what disclosing these sort of vulnerabilities is about. The core reason for just going full disclosure is that the vendor has absolutely not incentive to fix any sort of bug that is kept private. The customer is impacted, never the vendor.

Nah, disclosing these vulnerabilities is usually about CV-padding and publicity .

There aren’t many people out there hunting bugs just to be nice.

Post reply on HN