Millions Of Vulnerable Devices By The Same Encryption Keys

Researchers warn that millions of devices such as Internet routers, IP cameras and modems are vulnerable because they use the same encryption keys. Attackers can therefore perform man-in-the-middle attacks and eavesdropping and decrypt encrypted traffic.

Therefore might enter sensitive information into the wrong hands. The problem is with so-called embedded devices, including routers, modems, IP cameras and VoIP phones. Researchers from security firm SEC Consult watched for their research firmware more than 4,000 such devices from more than 70 manufacturers.

They mainly looked at cryptographic keys in firmware, such as public keys, private keys and certificates. It mainly involves keys that are used to connect through SSH and X.509 certificates used for HTTPS. In total, were found more than 580 unique private keys in the 4,000 studied devices.

This information was then correlated with data from large-scale Internet scans. It emerged that the dataset with the 580 unique keys contains the private keys of 9% of the HTTPS web hosts and the private keys of more than 6% of all SSH hosts.At least 230 of the 580 keys were actively used and seen by millions of hosts.

The keys are added by manufacturers to provide connection via HTTPS and SSH. The problem is that all devices with the appropriate firmware using the same keys. It was remarkable that the same keys were found in the products of different manufacturers. For example, a certificate of Broadcom were found on the Internet at more than 480,000 units, including Linksys and ZyXEL. The problem also arises in Cisco, Huawei, Ubiquiti Networks and other vendors. The devices are especially vulnerable in the United States (26.3%) and Mexico (16.5%).

Solution

SEC Consult has worked with the CERT Coordination Center (CERT / CC) at Carnegie Mellon University to warn the manufacturers involved and browser developers. Meanwhile, some parties have released updates. Manufacturers also are advised to use unique cryptographic keys for each device. In addition, Internet service providers to ensure that remote access over the WAN port to the equipment of their subscribers is not possible. Finally end users are advised to generic SSH keys and X.509 certificates on their devices to replace unique versions. However, the CERT / CC states that in many cases, there is no practical solution is available.

Ransomware Focused Specifically On Pedophiles

The Tox-ransomware deployed published in May was initially specifically against pedophiles, know as the designer. Recently announced the author, who claims to be a student teenager, he decided to stop the development of Tox platform and offered for sale to.

Tox is a free kit to experience ransomware. Like other ransomware encrypts files and then demands ransom Tox to decrypt it.The website which is offered Tox is on the Tor network, and generating the ransomware is free. However, the automaker received 30% of the ransom was earned through the ransomware, with the remaining 70% went to the party that spread the ransomware.

The first users of Tox had to cater to pedophiles, because the simple victims. "Pedophiles were the prime target in the beginning, because it is easy to make a file that claims" hot pics "contain," the ransomwaremaker opposite Vocativ . In the first week after Tox went live, he had more than 1,000 users and infections. The maker decided to own saying stop because the business model of ransomware is contrary to his values.

Tox-Maker Ransomware Quits And Is Looking For Buyer

The author of the recently published Tox-ransomware, in his own words a teenager who studies, it has decided to stop offering its platform now for sale. According to the developer, he had not counted on all the attention that was his creation. Tox is a free kit to experience ransomware.

Like other ransomware encrypts files and then demands ransom Tox to decrypt it. The website which is offered Tox is on the Tor network, and generating the ransomware is free. A few days after the site went live, which was noticed by McAfee and followed a blog posting , making the fame grew. This resulted in more users and more infections with the Tox-ransomware.

According to the developer, however, it was enough and he's not a criminal. In addition, the situation would get out of hand, which he has now decided to quit. In addition, he provides the database encryption keys for sale. If no one buys the database which he will release in a month and the files of victims will be decrypted automatically. Recently decided the creator of the Locker-ransomware them to stop and automatically decrypted while all infected computers.