Comment by hypfer
13 hours ago
From what the internet is telling me, the keys were allegedly found on https://repository.emsign.com/certs/<redacted>.crt
Which, if true, is definitely a lot of fun.
Hope you people are ready for lots and lots of suddenly hackable IoT.
__
Edit: I might also be misinterpreting what I am seeing and it's actually weak logic that created the keys, in the sense that one could guess the private key?
Someone actually qualified please give credible answers. I'm just pretending.
> Hope you people are ready for lots and lots of suddenly hackable IoT.
I was not expecting to find a silver lining _this bright_ but you have a point.
I think you’re right. And since the intermediate certs expire around 2039 and the private keys are known, we have plenty of smooth MitM fun against IoT in front of us.
Source? That would be an incredible blunder, but that also appears to be the kind of URL one would expect to find certs at.
https://mastodon.catgirl.cloud/@49016/117474217042191790
Apparently it's even worse
Yup. Mozilla just unrestricted the incident report with more details. Insane.
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
That's actually a good point - tons of IoT is "secure enough" to sign things, but not secure enough to bother pinning anything ...
Also who hasn't left their private keys hanging around web-accessible, eh? lol
https://chaos.social/@fluepke/117474156947559280
Private keys can be trivially recovered from the public keys because they're tiny. I found D=156, flüpke found D=4.
Yes, that's the entire private key.
all of them:
4, 56, 66, 115, 155, 156, 230, 237
i can't even https://xkcd.com/221/