full-disclosure - Re: Default SSL Keys in Multiple Routers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTikGECmKkO1ufst1zJks1UZqdLRLZPEV9RRvMTfw@mail.gmail.com>
Date: Mon, 20 Dec 2010 16:04:50 -0800
From: BMF <badmotherfsckr@...il.com>
To: Craig Heffner <cheffner@...ttys0.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Default SSL Keys in Multiple Routers

On Sat, Dec 18, 2010 at 7:13 PM, Craig Heffner <cheffner@...ttys0.com> wrote:
> The LittleBlackBox project contains a database of over 2,000 (and growing)
> private SSL keys that are correlated with their respective public
> certificates, and hardware/firmware versions. While most of these
> certificates are from DD-WRT firmware, there are also private keys from
> other vendors including Cisco, Linksys, D-Link and Netgear.

Most of what I have read so far indicates that these secret keys can
be used to sniff only administrative traffic to the device itself.

I have a client who uses a bunch of WRV200's for corp VPN access. They
are configured with a shared secret. Wouldn't they use DH with the
built in private key to exchange the shared secret which would make
the VPN traffic itself vulnerable?

Looks like you have the 210 but not the 200 but I bet your tool could
pull out the key for wrv200.

BMF

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/