More than 900 embedded devices share hard-coded certs, SSH host keys
Embedded devices of some 50 manufacturers has been found sharing the same hard-coded X.509 certificates (for HTTPS) and SSH host keys, a fact that can be exploited by a remote, unauthenticated attacker to carry out impersonation, man-in-the-middle, or passive decryption attacks, Carnegie Mellon University’s CERT/CC warns.
Stefan Viehböck, Senior Security Consultant at SEC Consult, has analyzed firmware images of more than 4000 embedded devices of over 70 vendors – firmware of routers, IP cameras, VoIP phones, modems, etc. – and found that, in some cases, there are nearly half a million devices on the web using the same certificate.
“Another aspect to the whole story is the large number of devices directly accessible on the web,” the company also noted. “Just by looking at the numbers one can deduce that it is highly unlikely that each device is intentionally exposed on the web (remote management via HTTPS/SSH from WAN IP). Enabling remote management exposes an additional attack surface and enables attackers to exploit vulnerabilities in the device firmware as well as weak credentials set by the user.”
According to the research, affected vendors are: ADB, AMX, Actiontec, Adtran, Alcatel-Lucent, Alpha Networks, Aruba Networks, Aztech, Bewan, Busch-Jaeger, CTC Union, Cisco, Clear, Comtrend, D-Link, Deutsche Telekom, DrayTek, Edimax, General Electric (GE), Green Packet, Huawei, Infomark, Innatech, Linksys, Motorola, Moxa, NETGEAR, NetComm Wireless, ONT, Observa Telecom, Opengear, Pace, Philips, Pirelli , Robustel, Sagemcom, Seagate, Seowon Intech, Sierra Wireless, Smart RG, TP-LINK, TRENDnet, Technicolor, Tenda, Totolink, unify, UPVEL, Ubee Interactive, Ubiquiti Networks, Vodafone, Western Digital, ZTE, Zhone and ZyXEL.
The company has been aided by CERT/CC in notifying affected device vendors, chipset manufacturers and affected ISPs of the problem and, according to CERT/CC. “some vendors have indicated that updates or guidance will be provided.”
“For the majority of vulnerable devices, reuse of certificates and keys are limited to the product lines of individual vendors. There are some instances where identical certificates and keys are used by multiple vendors. In these cases, the root cause may be due to firmware that is developed from common SDKs, or OEM devices using ISP-provided firmware,” the organization explained.
Users are urged to pester device vendors for more information and a solution. In the meantime, they can manually replace X.509 certificates or SSH host keys with unique ones (if they know how).
As a partial mitigation for the problem, users can only allow connections from trusted hosts and networks.
SEC Consult has more specific advice for vendors and ISPs.