Stories
Slash Boxes
Comments

SoylentNews is people

posted by mrpg on Thursday November 29 2018, @07:30PM   Printer-friendly
from the so-funny dept.

Submitted via IRC for SoyCow1984

Audio device maker Sennheiser has issued a fix for a monumental software blunder that makes it easy for hackers to carry out man-in-the-middle attacks that cryptographically impersonate any big-name website on the Internet. Anyone who has ever used the company’s HeadSetup for Windows or macOS should take action immediately, even if users later uninstalled the app.

To allow Sennheiser headphones and speaker phones to work seamlessly with computers, HeadSetup establishes an encrypted Websocket with a browser. It does this by installing a self-signed TLS certificate in the central place an operating system reserves for storing browser-trusted certificate authority roots. In Windows, this location is called the Trusted Root CA certificate store. On Macs, it’s known as the macOS Trust Store.

The critical HeadSetup vulnerability stems from a self-signed root certificate installed by version 7.3 of the app that kept the private cryptographic key in a format that could be easily extracted. [...] the sensitive key was encrypted with the passphrase “SennheiserCC” (minus the quotation marks). That passphrase-protected key was then encrypted by a separate AES key and then base64 encoded. The passphrase was stored in plaintext in a configuration file. The encryption key was found by reverse-engineering the software binary.

[...] A later version of the Sennheiser app made a botched attempt to fix the snafu. It too installed a root certificate, but it didn’t include the private key. But in a major omission, the update failed to remove the older root certificate, a failure that caused anyone who had installed the older version to remain susceptible to the trivial TLS forgeries. Also significant, uninstalling the app didn’t remove the root certificates that made users vulnerable.

Source: Original source


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 4, Insightful) by requerdanos on Thursday November 29 2018, @09:33PM (5 children)

    by requerdanos (5997) Subscriber Badge on Thursday November 29 2018, @09:33PM (#767939) Journal

    To allow Sennheiser headphones and speaker phones to work seamlessly with computers, HeadSetup establishes an encrypted Websocket with a browser.

    The way to make a set of speakers or headphones "work seamlessly with computers" is not, repeat not, "to establish an encrypted websocket" by breaching the security of the store of certificates.

    If you have an employee who tells you this, you should fire that employee--escort the employee out--or at the least send him to security training and don't allow him to touch product design again until he has learned to the satisfaction of actual computer security professionals.

    If you yourself feel as though you should rise to defend the statement, then you may be the employee that needs to be fired or extensively retrained.

    See "Sony Rootkit" for further examples of why this is thinly veiled computer crime, not slick product design.

    Starting Score:    1  point
    Moderation   +2  
       Insightful=2, Total=2
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   4  
  • (Score: 5, Informative) by TheFool on Thursday November 29 2018, @09:58PM (4 children)

    by TheFool (7105) on Thursday November 29 2018, @09:58PM (#767951)

    These "value-add software" guys in hardware companies get paid extremely little, because... well, the software itself isn't what they are selling, so corporate treats those teams like garbage. There is no training budget for people on teams like this and it's often unpaid/low-paid interns doing the work to keep the costs even lower. I don't know if it's industry-wide, but I've run across this with pretty much any major hardware vendor I've worked with.

    I won't defend it, but yeah, none of what you suggest will happen. I imagine that as far as they are concerned this is a PR problem now, not a personnel or training problem. And that PR work is probably cheaper than Doing the Right Thing in 2018.

    • (Score: 4, Insightful) by edIII on Thursday November 29 2018, @11:21PM (3 children)

      by edIII (791) on Thursday November 29 2018, @11:21PM (#768013)

      Guess what is even cheaper? Not buying all that crap in the first place.

      I stopped buying anything that had bluetooth in it, or for some inane reason, demanded being configured by a smart phone app just because. Especially, when they're fucking headphones. Anything that demands a persistent connection to the Internet, to give a company telemetry, is also banned from my life. I don't allow any 3rd party company to collect telemetry on me, and heck, I even have a deal with my doctor (who is older) that he doesn't allow data entry of medical records. Keeps it on paper, and deliberately keeps as little info as possible in the system.

      All of my audio in the last few years was switched entirely over to analog, and wired. That's because Bluetooth already went through their security Armageddon with billions of devices, that can't be easily upgraded, now possessing a critical security flaw. So, can't use Bluetooth ever again. Won't trust them, especially without the ability to upgrade firmware via a USB cable.

      Software and security is such utter fucking shit these days.

      --
      Technically, lunchtime is at any moment. It's just a wave function.
      • (Score: 3, Insightful) by legont on Friday November 30 2018, @03:52AM (2 children)

        by legont (4179) on Friday November 30 2018, @03:52AM (#768136)

        Unfortunately it is everywhere and one can't avoid it. For example half - yes, half - of a modern car costs is this software junk.

        --
        "Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.
        • (Score: 1, Insightful) by Anonymous Coward on Friday November 30 2018, @05:49AM

          by Anonymous Coward on Friday November 30 2018, @05:49AM (#768181)

          The problem isn't 'software junk'. It is junk software.

        • (Score: 2) by Bot on Sunday December 02 2018, @12:43AM

          by Bot (3902) on Sunday December 02 2018, @12:43AM (#768775) Journal

          in other words, electronics provide the scapegoat for cars to cost more.

          --
          Account abandoned.