Full Disclosure mailing list archives
Re: Default SSL Keys in Multiple Routers
From: BMF <badmotherfsckr () gmail com>
Date: Mon, 20 Dec 2010 16:04:50 -0800
On Sat, Dec 18, 2010 at 7:13 PM, Craig Heffner <cheffner () devttys0 com> wrote:
The LittleBlackBox project contains a database of over 2,000 (and growing) private SSL keys that are correlated with their respective public certificates, and hardware/firmware versions. While most of these certificates are from DD-WRT firmware, there are also private keys from other vendors including Cisco, Linksys, D-Link and Netgear.
Most of what I have read so far indicates that these secret keys can be used to sniff only administrative traffic to the device itself. I have a client who uses a bunch of WRV200's for corp VPN access. They are configured with a shared secret. Wouldn't they use DH with the built in private key to exchange the shared secret which would make the VPN traffic itself vulnerable? Looks like you have the 210 but not the 200 but I bet your tool could pull out the key for wrv200. BMF _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Default SSL Keys in Multiple Routers Craig Heffner (Dec 19)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 19)
- Re: Default SSL Keys in Multiple Routers Larry Seltzer (Dec 20)
- Re: Default SSL Keys in Multiple Routers Craig Heffner (Dec 20)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 19)
- Re: Default SSL Keys in Multiple Routers Michal Zalewski (Dec 20)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 20)
- Re: Default SSL Keys in Multiple Routers BMF (Dec 20)
- Re: Default SSL Keys in Multiple Routers coderman (Dec 20)
- Re: Default SSL Keys in Multiple Routers Jeffrey Walton (Dec 20)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 19)