Stories
Slash Boxes
Comments

SoylentNews is people

posted by mrpg on Thursday November 29 2018, @07:30PM   Printer-friendly
from the so-funny dept.

Submitted via IRC for SoyCow1984

Audio device maker Sennheiser has issued a fix for a monumental software blunder that makes it easy for hackers to carry out man-in-the-middle attacks that cryptographically impersonate any big-name website on the Internet. Anyone who has ever used the company’s HeadSetup for Windows or macOS should take action immediately, even if users later uninstalled the app.

To allow Sennheiser headphones and speaker phones to work seamlessly with computers, HeadSetup establishes an encrypted Websocket with a browser. It does this by installing a self-signed TLS certificate in the central place an operating system reserves for storing browser-trusted certificate authority roots. In Windows, this location is called the Trusted Root CA certificate store. On Macs, it’s known as the macOS Trust Store.

The critical HeadSetup vulnerability stems from a self-signed root certificate installed by version 7.3 of the app that kept the private cryptographic key in a format that could be easily extracted. [...] the sensitive key was encrypted with the passphrase “SennheiserCC” (minus the quotation marks). That passphrase-protected key was then encrypted by a separate AES key and then base64 encoded. The passphrase was stored in plaintext in a configuration file. The encryption key was found by reverse-engineering the software binary.

[...] A later version of the Sennheiser app made a botched attempt to fix the snafu. It too installed a root certificate, but it didn’t include the private key. But in a major omission, the update failed to remove the older root certificate, a failure that caused anyone who had installed the older version to remain susceptible to the trivial TLS forgeries. Also significant, uninstalling the app didn’t remove the root certificates that made users vulnerable.

Source: Original source


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1, Informative) by Anonymous Coward on Thursday November 29 2018, @07:58PM

    by Anonymous Coward on Thursday November 29 2018, @07:58PM (#767888)

    To allow Sennheiser headphones and speaker phones to work seamlessly with computers

    DUUUUH!!!!

    But for a serious answer:

    Sennheiser HeadSetup™ Pro is a client application running in the background on the headset users’ PC. The solution ensures that Sennheiser headsets and speakerphones work seamlessly with various leading softphones and give you access to latest firmware updates and personalized settings.

    Sennheiser HeadSetup™ Pro is designed to be simple to use, allowing Sennheiser headset and speakerphone users to enhance their experience and productivity simply and quickly.

    still pretty dumb

    Starting Score:    0  points
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  

    Total Score:   1