SoylentNews is people
SoylentNews
Submitted via IRC for SoyCow1984
Audio device maker Sennheiser has issued a fix for a monumental software blunder that makes it easy for hackers to carry out man-in-the-middle attacks that cryptographically impersonate any big-name website on the Internet. Anyone who has ever used the company’s HeadSetup for Windows or macOS should take action immediately, even if users later uninstalled the app.
To allow Sennheiser headphones and speaker phones to work seamlessly with computers, HeadSetup establishes an encrypted Websocket with a browser. It does this by installing a self-signed TLS certificate in the central place an operating system reserves for storing browser-trusted certificate authority roots. In Windows, this location is called the Trusted Root CA certificate store. On Macs, it’s known as the macOS Trust Store.
The critical HeadSetup vulnerability stems from a self-signed root certificate installed by version 7.3 of the app that kept the private cryptographic key in a format that could be easily extracted. [...] the sensitive key was encrypted with the passphrase “SennheiserCC” (minus the quotation marks). That passphrase-protected key was then encrypted by a separate AES key and then base64 encoded. The passphrase was stored in plaintext in a configuration file. The encryption key was found by reverse-engineering the software binary.
[...] A later version of the Sennheiser app made a botched attempt to fix the snafu. It too installed a root certificate, but it didn’t include the private key. But in a major omission, the update failed to remove the older root certificate, a failure that caused anyone who had installed the older version to remain susceptible to the trivial TLS forgeries. Also significant, uninstalling the app didn’t remove the root certificates that made users vulnerable.
Source: Original source
(Score: 4, Insightful) by ledow on Friday November 30 2018, @09:18AM (2 children)
Complete lack of permissioning.
Where the hell was the dialog saying "This app is trying to install a certificate that will allow it to intercept all your secure web sessions, including banking and financial transactions, carried out by any installed system application. Do you want to allow this?"
Nowhere. Because Microsoft don't want to burden you with decisions and kowtowed to apps "just doing anything they like" on your machine without question... even if you're an expert user. Meanwhile Android gives you a bunch of individual permissions and, while it only "allows" or "disallows" installation in its entirety, at least you can join the dots if you have half a brain.
Honestly, we are 20-30 years overdue for just runnings apps in entirely contained bottles that can't affect anything, even user's data, until you set an individual permission for them to do so that no automated program can set for you (i.e. it takes human interaction to set it whether that human's a network admin, or a home user). Literally pass applications only a copy-on-write copy of the user's documents when the user says to open a file in a certain program, and keep a revision history of everything they touch, and then completely isolate them from everything else in the system and things like this go away.
And then when you uninstall them, anything you HAVE agreed to... it just disappears with the bottle. Because at no point was any program ever allowed to add anything anywhere other than in its bottle, which extends to a bunch of executables, and a /proc like filesystem to request permissions / interact with the wider system / install certificates that overlay into the system if the user so wishes. Remove the bottle, that overlaid file disappears, and it's gone from everywhere.
(Score: 1, Interesting) by Anonymous Coward on Friday November 30 2018, @12:13PM
Containers and sandboxing do exist, they just aren't all that popular outside industry. Considering that Jess Frazelle now works for Microsoft though, they may get a "containerized-everything" userland before any major linux distro.
(Score: 2) by acid andy on Friday November 30 2018, @02:01PM
That's a great idea, but I imagine in cases like TFA, the programmers might see the need to release their software installer as an operating system upgrade, in the same vein as the rootkits we have now, that would punch a hole in those sandbox protocols by "upgrading" that part of the operating system. I can't see how that can be stopped without also locking out the user from upgrading their own operating system. I suppose your first point about the increased permission granularity would at least mean they'd be told what OS component was about to be replaced, rather than the generic "this application needs root / admin access. OK?".
If a cat has kittens, does a rat have rittens, a bat bittens and a mat mittens?