Full Disclosure mailing list archives
Re: Default SSL Keys in Multiple Routers
From: coderman <coderman () gmail com>
Date: Mon, 20 Dec 2010 16:45:05 -0800
On Mon, Dec 20, 2010 at 4:04 PM, BMF <badmotherfsckr () gmail com> wrote:
... Most of what I have read so far indicates that these secret keys can be used to sniff only administrative traffic to the device itself.
right. considering 97.3% of these devices have trivial XSRF, remote access, and other vectors wide open this (active MitM to HTTPS admin panel on home localnet?) is the least of your concerns.
I have a client who uses a bunch of WRV200's for corp VPN access. They are configured with a shared secret. Wouldn't they use DH with the built in private key to exchange the shared secret which would make the VPN traffic itself vulnerable?
this is ambiguous. what kind of VPN? are you keying ISAKMP daemon with a shared secret or is manual pre-shared key what you're describing? very different levels of privacy and forward secrecy respectively. see "IPSecVPN" chapter, specifically "Auto (IKE)" key exchange method, AES ISAKMP Encryption Method, SHA ISAKMP Authentication Method, 2048 or 4096 ISAKMP DH Group, PFS Enabled, AES IPSec Encryption Method, SHA IPSec Authentication Method, Pre-shared Key for ISAKMP authentication in manual. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Default SSL Keys in Multiple Routers Craig Heffner (Dec 19)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 19)
- Re: Default SSL Keys in Multiple Routers Larry Seltzer (Dec 20)
- Re: Default SSL Keys in Multiple Routers Craig Heffner (Dec 20)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 19)
- Re: Default SSL Keys in Multiple Routers Michal Zalewski (Dec 20)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 20)
- Re: Default SSL Keys in Multiple Routers BMF (Dec 20)
- Re: Default SSL Keys in Multiple Routers coderman (Dec 20)
- Re: Default SSL Keys in Multiple Routers Jeffrey Walton (Dec 20)
- Re: Default SSL Keys in Multiple Routers Thor (Hammer of God) (Dec 19)