It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.
subscribed 15 seconds ago [-]
OMG, that would be brutal
shrubble 1 hours ago [-]
If I’m understanding correctly, you could sniff the communication between your Smart TV and the manufacturer using this method?
the_snooze 46 minutes ago [-]
As long as the smart TV still trusts eMudhra, then yeah. You'll want to super careful and prevent the TV from pulling updates that could revoke that trust.
kevin_nisbet 57 minutes ago [-]
Possibly. But some manufacturers may not have the full set of roots, use a private authority, or do certificate pinning.
quotemstr 58 minutes ago [-]
If the TV isn't older than a few years, if it's not checking CRLs, and if it hasn't yet patched itself.
lambda 11 minutes ago [-]
Oh, nice. I was thinking of setting up a proxy for this for testing, nice to just have it working out of the box.
seniorsassycat 59 minutes ago [-]
How much of a boon is this for jailbreaking, reverse engineering, and mitm really?
himata4113 6 minutes ago [-]
client on startup asks: hey server do you have any ads for me
server: here are latest ads
btw, the ads are capable of code execution for whatever reason so now you have an RCE on your hands for your client
bryancoxwell 18 minutes ago [-]
Been wondering this as well. I also don’t really understand the mitm to jailbreak pipeline
flexagoon 10 minutes ago [-]
Some smart devices pull config files from a server. By mitming that, you can change the config to enable some sort of developer mode on the device.
qwertyforce 10 minutes ago [-]
Maybe intercept firmware update and then reverse engineer it and find rce?
tecleandor 1 hours ago [-]
This is gonna be great to sniff apps in a couple older Android phones I have around. Hope they're not pinning certificates.
wildmXranat 48 minutes ago [-]
Someone should've coined this disaster as "QuattroFail" to give it a little panache and international mystery
gnabgib 42 minutes ago [-]
"4" was only some of the keys (they were all <256).. ByteFail seems more accurate
mintflow 36 minutes ago [-]
Haha, this is quite interesting to test if you need to update various of program (if they do not use the sys ca chain)
skeledrew 1 hours ago [-]
This is how fame happens.
deadbabe 16 minutes ago [-]
Can someone explain the significance here, a lot has happened in 24 hours.
Gigachad 13 minutes ago [-]
An Indian Certificate Authority was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.
brendoelfrendo 2 minutes ago [-]
They had 8 intermediate certs with private keys under 1 byte (<256). The most egregious was 4, but any of those 8 were pitiful.
0xbadcafebee 19 minutes ago [-]
Remember twenty years ago when tools like this were "controversial" because you could "just download it and hack anyone" ? Except the only systems you could hack were... insecure ones... so people updated their systems to resist the tools' attacks, and we all ended up more secure.
xmcp123 36 minutes ago [-]
Never thought there would be a silver lining on this issue. Fuck yeah.
sippingabonedry 57 minutes ago [-]
Wonderful.
Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".
xuki 51 minutes ago [-]
Which iOS version? 27.0.1 here and they're all revoked for me.
sippingabonedry 43 minutes ago [-]
26.7.1 still (randomly) trusts 2 out of the 12 compromised chains. All browsers impacted.
My best guess is it's soft-failing on a failed OCSP lookup?
snailmailman 47 minutes ago [-]
FWIW i havent updated my ios, I'm on 26.6.2, and they all got revoked for me. The revocation shouldn't require an iOS update.
DrammBA 1 hours ago [-]
I love how someone's security disaster becomes someone else's feature.
xp84 1 hours ago [-]
I agree. We may as well make some lemonade out of these lemons. IMHO the ability of companies to 'securely' close off hardware and software from their users is a sad casualty of the success of cryptography, and not a feature.
r3trohack3r 42 minutes ago [-]
Most things have tradeoffs
At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive
Bratmon 10 minutes ago [-]
As the percentage of technology controlled by people actively using it to do evil increases, so does the net value to society of a trivially-expliotable zero-day.
tonymet 1 hours ago [-]
I seriously laughed at the flag. public wifi is going to be lit.
MajorTakeaway 7 seconds ago [-]
What about using a VPN on public wifi?
Rendered at 01:26:09 GMT+0000 (UTC) with Wasmer Edge.
server: here are latest ads
btw, the ads are capable of code execution for whatever reason so now you have an RCE on your hands for your client
Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".
Edit: I'm not the only one with this issue:
https://www.reddit.com/r/iphone/comments/1xbvxgd/emudhra_cer...
My best guess is it's soft-failing on a failed OCSP lookup?
At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive