Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Compare cell phone plans using Wirefly's innovative plan comparison tool ×
Networking Security Wireless Networking

D-Link Accidentally Publishes Private Code Signing Keys 67

New submitter bartvbl writes: As part of the GPL license, D-Link makes its firmware source code available for many of its devices. When looking through the files I accidentally stumbled upon 4 different private keys used for code signing. Only one — the one belonging to D-Link itself — was still valid at the time. I have successfully used this key to sign an executable as D-Link. A Dutch news site published the full story (translated to english with Google Translate).
This discussion has been archived. No new comments can be posted.

D-Link Accidentally Publishes Private Code Signing Keys

Comments Filter:
  • You can't be serious....
    • by Anonymous Coward

      Yes... this is a very common mistake.

      Someone checks in their entire source tree without realizing that it includes their private keys.

      Happens all the time.

  • by Anonymous Coward on Thursday September 17, 2015 @02:51PM (#50543221)

    They revoked the keys in question in some time in September.

    But if you disconnect the machine from the internet, or otherwise block the connection to the server that provides revocation information, will the Windows system still see an executable signed with the revoked key as valid?

    I'm not an expert. Genuinely asking.

    • Re: (Score:2, Interesting)

      by tapspace ( 2368622 )

      if you disconnect the machine from the internet, or otherwise block the connection to the server that provides revocation information, will the Windows system still see an executable signed with the revoked key as valid?

      Yes, that is exactly how it works. To give an example of how weak this security control is, Google Chrome no longer even bothers, ignoring revocation lists completely. [computerworld.com]

      • by dlenmn ( 145080 ) on Thursday September 17, 2015 @03:42PM (#50543737)

        Google Chrome no longer even bothers, ignoring revocation lists completely.

        That's not quite what your article says. It says that google stopped checking with the cecurity authority using the Online Certificate Status Protocol. However, the article also says that chrome replaced that with a local list of revoked certificates that can be updated without restarting the browser. So, chrome still does keep track of revoked certificates.

      • Isn't there OCSP stapling now https://en.wikipedia.org/wiki/OCSP_stapling ?

        The HTTPS webserver asks the OCSP server for a signed by CA & timestamped message every few hours to validate the certificate serial it is using is still valid (i.e. the certificate has not been revoked by CA).

        The HTTPS webserver then provides this extra bit of signed information to the browser during the TLS handshake.

        So now the load on the OCSP scales better (by website, not by all web users), has minimal latency impact (just t
  • It's surprisingly common for someone to accidentally publish their private signing key.

    • by jandrese ( 485 )
      It's common enough that there are bots that troll Github looking for anything that looks like a private key and immediately tries to take over any account it finds.
    • Why would the FAA want to lock down anybody's router? I'm pretty sure they're too busy dealing with aviation to care... ;-)
  • by Ungrounded Lightning ( 62228 ) on Thursday September 17, 2015 @04:26PM (#50544075) Journal

    I'll leave the company name out (mostly to protect my source B-) )

    This was in the early part of the cycle of:
      - A handful of companies made graphics accelerator chips..
      - A BUNCH of new companies also made graphics accelerator chips.
      - There was a shakeout and only a few survived - not necessarily many - or any - of the original handful.
    The company in question was one of the original few.

    The hardware was good. But much of the performance advantages were due to some good algorithms in the driver, which were applicable to other good, bad, or moderate capability hardware, rather than depending on special features of the company's product.

    As with many Silicon Valley companies, where the value added was so high that the administration could be utterly wacky or clueless and the company would still survive for years, this one had some managers make some dumb decisions.

    One dumb decision was to try to save money by limiting the personnel to one new floppy disk per month. So the developers kept reusing the disks they had, when they shouldn't.

    As a result, the golden master for an object-only release of the driver was built on a used disk, which had once held the complete sources of the driver in question. Apparently the "reformat" process used didn't overwrite the sectors - but the manufacturing process that cloned the golden master DID copy those sectors.

    A customer tried an undelete utility and found almost the entire source code. Oops!

    This news got out. Over the next couple years the great algorithms went from being a valuable trade secret (much of the company's "secret sauce") to a de facto industry standard.

    • That company's name didn't start with an 'R' by any chance did it? If so, I may have known some of the people you're describing...and by association, you!
    • >One dumb decision was to try to save money by limiting the personnel to one new floppy disk per month

      Wow, this has got to be one of the most hilarious cases of "penny-wise, pound-foolish" I've ever heard.

      Floppy disks were cheap, even back then! They were practically a drop in the ocean when it comes to the budget of even small companies. What were these managers thinking?

      • Floppy disks were cheap, even back then! They were practically a drop in the ocean when it comes to the budget of even small companies. What were these managers thinking?

        They also organized groups of developers and QA people to be sure the lights in the bathrooms were turned off. Compare the cost of the time of a highly trained and highly paid (pre-H1-B flood) engineer spent on checking a bathroom light to the cost of leaving it on even over a weekend. Then think of the time spent by the lot of them in th

  • by godel_56 ( 1287256 ) on Thursday September 17, 2015 @05:05PM (#50544379)
    I find their full bodied and unrestrained support for open source commendable.
  • D-Link and GPL (Score:5, Insightful)

    by MrKaos ( 858439 ) on Thursday September 17, 2015 @07:59PM (#50545587) Journal

    I'd just like to point out, before Dlink get too much criticism, that there are many companies that avoid this situation by violating the terms of the GPL by not making the source code available or even displaying the terms of the license.

    Ok, Dlink made a mistake, however I think it is a good thing that they being sincere to the terms of the license. Well done Dlink, they will fix the problem and I will be happy to buy their products over other vendors who violate the terms of the GPL.

    • by Anonymous Coward

      Like this one

      https://trac.ffmpeg.org/ticket... [ffmpeg.org]

      Blue Iris Video Security Software
      Perspective Software

      No indication of GPL use. Claims work as his own.

      From the download package, BlueIris.exe is UPX compressed. Decompress, then investigate 22 MB file with strings.exe.

      libswresample license: GPL version 2 or later
      libswscale license: GPL version 2 or later
      libavcodec license: GPL version 2 or later
      libavformat license: GPL version 2 or later
      libavutil license: GPL version 2 or

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Like this one

        https://trac.ffmpeg.org/ticket... [ffmpeg.org]

        Blue Iris Video Security Software

        Perspective Software

        No indication of GPL use. Claims work as his own.

        From the download package, BlueIris.exe is UPX compressed. Decompress, then investigate 22 MB file with strings.exe.

        libswresample license: GPL version 2 or later

        libswscale license: GPL version 2 or later

        libavcodec license: GPL version 2 or later

        libavformat license: GPL version 2 or later

        libavutil license: GPL version 2 or later

        Compile strings discovered:

        --enable-gpl --cpu=i686 --prefix=/c/msys/1.0/ffmpeg/build --enable-libx264

        Here's something fun to do. Tell PayPal that BlueIris is violating term 9c of the user agreement (since they take PayPal for their registration fee):

        PayPal User Agreement [paypal.com]

"What the scientists have in their briefcases is terrifying." -- Nikita Khrushchev

Working...