Comment by jasonjayr
12 hours ago
> It's fortunate that the steps required here aren't particularly complicated for the devices you can update, and the advice essentially boils down to 'update them'. The problem is the devices you can't update or update easily.
> Update everything that ships a CA bundle: your OS ca-certificates package, certifi, Node, Homebrew, and rebuild your container images once the base images pick up the change.
> Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...
Quick -- we need to MITM all the smart TVs so they can be jailbroken in one fell swoop!
Devices that are smart enough to talk to the internet but not smart enough to let the user install their own certs should not exist.
"let the user install their own certs should not exist"
are you sure that this is not opening to more attack vector ?????
Yes. We're giving the user the ability to protect themselves from the vendor.
Your logic only makes sense if the user is your enemy.
3 replies →
You can even install your own certs into the golden cage (also known as iPhones).
Users aren't supposed to be considered an attack vector. I don't care what the advertisers think.
12 replies →
Which is better - two attack vectors that can be mitigated by an expert, or one attack vector that can't be mitigated by anyone?
These devices are already very weak and many of them even do non-TLS updates with no signing check anyway.
If it has been so weak already, it can't be weaker.
Not always true. I have IoT devices where a valid certificate is useful because the original host doesn't exist anymore and the certificate isn't pinned.
Flashing the devices require direct UART/USB access which may involve soldering, if it even exists. This leak is gold for those because these devices will never get an updated CRL.
It's easy enough to apt upgrade, and curl shows it's not vulnerable.
But what about python pip and node and bun which bundle their own certs?
And then you'll have a compiled binary like Claude Code, which was built with bun, and has its vulnerable certificates bundled in, ignoring the system certs.
Yep, it's a long tail. Anything that ships it's own CA bundle will ignore whatever you fix at the OS level. Those bundles are generally root-only and don't have revocation checking, so they can't block a bad intermediate cert.
The fix can only come from the tool shipping an updated bundle, or if there's some way you can point it at the OS store once that's updated.
If you just take them offline you can do this without having to rush.
Just change your WiFi password, don’t give them the new one and don’t update them lol.
You can't hardly use the TVs then. I've seen TVs that don't let you use the HDMI port without it being connected if you have a streaming dongle connected. Hopefully that practice has mostly died off now (Samsung used to do this on some models, iirc), but it's still a risk and only kicks the can down the road a bit.
Yeah those devices also need to be “opened up” as it were. Some of them already have been. Just think about it like fermented whiskey. Leave them alone for a month or two until they run an opensource firmware you control.
I have a terrible LG smart TV (that seems to connect to WiFi that is not mine), but I would instantly return a TV that did this.
Just imagine how much stuff you're going to be able to MiTM now!!
Some of them seem to do some cert pinning
> > Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...
The interesting question is, how many of these devices will have the compromised CA root certificate in place?
Oh and another thing is problematic, many a Java app ships with its own keystore.jks if it needs to trust some privately hosted endpoint, and that keystore.jks may or may not contain the compromised CA root certificate... updating the OS will not catch this kind of stuff.
> how many of these devices will have the compromised CA root certificate in place?
I have two Google devices at home and both are compromised still. If Google can't handle pushing out a quick cert chain update, then I truly doubt other manufacturers can.
I'm rather surprised google doesn't require cert pinning for all connections to any google server....
[dead]