Netgear Signed TLS Cert Private Key Disclosure

Re:Netgear Signed TLS Cert Private Key Disclosure by vbezhenar on Monday January 20, 2020 @03:45AM (#22097405)

1. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet.

2. Router coordinates with company server to get its own hostname like n-123123123.netgear.com (which points to 192.168.1.1 or whatever), generates private key and company server issues certificate for that key. HTTP requests to 192.168.1.1 return HTTP 302 to this address. It requires Netgear to operate CA or make some extended agreement with existing CA to let them issue certificates. I know that Plex does something similar, so it should be possible.

3. Company server creates hostname which points to a public router IP address and router uses letsencrypt to get a certificate for that hostname. But that requires public IP and some providers are using NAT nowadays, so it won't work universally.

4. To configure a device you're talking with company server, rather than your device and your device is talking with that server as well. It requires working Internet, so not a complete solution as well.

I don't believe that HSM chip would work. You would just extract that chip and use it as a private key and that's about it. You won't be able to extract private key bits, but you don't need them. May be it might work with very secure device like iPhone, where everything is signed, but yeah, $10 device and someone will still hack it, causing bad situation.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by berti on Monday January 20, 2020 @03:50AM (#22097431)

All but one make for an undesirable UX during initial setup before WAN is up, which is probably the only time most users login to their router.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by vbezhenar on Monday January 20, 2020 @04:46AM (#22097682)

Yeah, that's why I think that movement to HTTPS everywhere must at least exclude private IP addresses. While it's expected to have HTTPS on public resources, what happens in my local network is my business and should not be considered insecure.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by ajsnigrutin on Monday January 20, 2020 @07:35AM (#22098359)

The problem is, that someone setting up a public wifi (in a restaurant for example), will be vulnerable to sniffing attacks (if they don't know what they're doing).

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by franga2000 on Monday January 20, 2020 @08:22AM (#22098588)

So get a cert before setting up wifi. This is not a hard problem. 1. Connect to AP with random key from the box 2. Open admin panel over HTTP 3. Follow instructions to get Internet access 4. As soon as it has a connection, the router obtains a cert and redirects you to HTTPS 5. Now you can make all your poor security decisions

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by Terretta on Monday January 20, 2020 @10:44AM (#22099586)

Have you met ‘normals’?

Everything is a hard problem if it’s any steps at all.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by franga2000 on Monday January 20, 2020 @11:03AM (#22099733)

I meant that "how to make router setup secure without making it more difficult" is not a hard problem. My system is no more difficult than the currently most common ones and about as secure as it gets.

Although, one could argue that setting up a router really shouldn't be left to people who don't understand how they work...

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by pixl97 on Monday January 20, 2020 @07:11AM (#22098250)

#3 is why IPv6 needs universally pushed out by all ISPs.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by TheSwordsman on Monday January 20, 2020 @06:03AM (#22098000)

The issue is you're going to have the ignorant customers calling Netgear to complain their brand new router is not secure if their browser highlights it for situation #1. Same for an untrusted certificate.

The risk with #2 is then an attacker could potentially probe the firmware to figure out that process, and phish from that domain? The other is we need to trust Netgear to run HA infrastructure to support that. (lol)

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by mcny on Monday January 20, 2020 @06:29AM (#22098107)

So it sounds like pretty much marketing/sales runs the company and the product people have no say at Netgear?

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by rvnx on Monday January 20, 2020 @04:56AM (#22097727)

In case number 2, it's possible to ask CA to reissue n-123123123.netgear.com, and if it's not possible (due to uniqueness verification during key issuing process), to ask n-123132123.netgear.com and the system administrator may not notice.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by tialaramex on Monday January 20, 2020 @09:34AM (#22099035)

With CAA Netgear gets to decide which CA is authorized for netgear.com and they can cut a deal with that CA for any rules they want.

Facebook, for example, has a deal with their preferred CA which says that all certificates for names under fb.com and facebook.com are only to be issued with authorization from Facebook's central security team.

So even if you can fulfil that CA's normal checking perfectly for fake-bank.facebook.com, if you haven't got someone on the inside of the Facebook security team you can't get a working certificate for your fake bank social media scam.

[ Parent | on HN ]

Re:Netgear Signed TLS Cert Private Key Disclosure by lima on Monday January 20, 2020 @10:04AM (#22099256)

> 1. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet.

This would be categorically worse than hardcoding the SSL key.

[ Parent | on HN ]