full-disclosure - Re: Default SSL Keys in Multiple Routers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 Dec 2010 16:45:05 -0800
From: coderman <coderman@...il.com>
To: BMF <badmotherfsckr@...il.com>
Cc: Craig Heffner <cheffner@...ttys0.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: Default SSL Keys in Multiple Routers

On Mon, Dec 20, 2010 at 4:04 PM, BMF <badmotherfsckr@...il.com> wrote:
>...
> Most of what I have read so far indicates that these secret keys can
> be used to sniff only administrative traffic to the device itself.

right. considering 97.3% of these devices have trivial XSRF, remote
access, and other vectors wide open this (active MitM to HTTPS admin
panel on home localnet?) is the least of your concerns.

> I have a client who uses a bunch of WRV200's for corp VPN access. They
> are configured with a shared secret. Wouldn't they use DH with the
> built in private key to exchange the shared secret which would make
> the VPN traffic itself vulnerable?

this is ambiguous. what kind of VPN? are you keying ISAKMP daemon with
a shared secret or is manual pre-shared key what you're describing?
very different levels of privacy and forward secrecy respectively.

see "IPSecVPN" chapter, specifically "Auto (IKE)" key exchange method,
AES ISAKMP Encryption Method, SHA ISAKMP Authentication Method, 2048
or 4096 ISAKMP DH Group, PFS Enabled, AES IPSec Encryption Method, SHA
IPSec Authentication Method, Pre-shared Key for ISAKMP authentication
in manual.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/