D-Link accidentally published private key for code signing

BoerenkoolMetWorst · Sep 17, 2015

(Dutch article)
https://tweakers.net/nieuws/105137/d-link-blundert-met-vrijgeven-privesleutels-van-certificaten.html

In short, D-Link makes source code from a lot of firmware open source, and forgot to remove private keys (incl. the necessary passphrase..) This would enable anyone to give executable files a valid authenticode signature. The certificates have now been revoked.

JRViejo · Sep 17, 2015

FYI. Google Translate.

BoerenkoolMetWorst · Sep 20, 2015

In blunder threatening Windows users, D-Link publishes code-signing key

In a ham-fisted move that threatens computer users everywhere, developers at router manufacturer D-Link published a private cryptography key used to certify that software is trustworthy and not malware, a security researcher said.

The software signing key was released in late February on D-Link's GPL source code sharing website, along with the source code from some of the company's firmware, Yonathan Klijnsma, a threat intelligence analyst at Dutch security firm Fox IT, told Ars in an e-mail. D-Link used the key to cryptographically sign its software so it could be installed on computers running Microsoft Windows without the operating system generating a security warning. With it leaked to the world, anyone—including developers of keyloggers, remote access trojans, and other types of malware—could use the key to sign their malicious wares so they're accepted as trusted D-Link software.
Click to expand...

http://arstechnica.co.uk/security/2...dows-users-d-link-publishes-code-signing-key/

Dermot7 · Sep 24, 2015

Microsoft today revoked trust for the four digital certificates inadvertently leaked last week by networking gear manufacturer D-Link. Microsoft said it has modified its Certificate Trust List removing trust for the four certs, which could have been used to sign malicious code used in attacks.
Click to expand...

https://threatpost.com/microsoft-revokes-trust-for-certificates-leaked-by-d-link/114804/

Log in or Sign up

D-Link accidentally published private key for code signing

BoerenkoolMetWorst Registered Member

JRViejo Super Moderator

BoerenkoolMetWorst Registered Member

Dermot7 Registered Member

Log in or Sign up

D-Link accidentally published private key for code signing

BoerenkoolMetWorst Registered Member

JRViejo Super Moderator

BoerenkoolMetWorst Registered Member

Dermot7 Registered Member

Useful Searches