Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks

guest · Nov 28, 2018

Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks
November 28, 2018
https://www.bleepingcomputer.com/ne...re-could-allow-man-in-the-middle-ssl-attacks/

When users have been installing Sennheiser's HeadSetup software, little did they know that the software was also installing a root certificate into the Trusted Root CA Certificate store.

While these certificate files are deleted when a user uninstalls the HeadSetup software, the trusted root certificate was not removed. This would allow an attacker who had the right private key to continue to perform attacks even when the software was no longer installed on the computer.

"Upon such a rare inspection of the Trusted Root CA store, we stumbled across two unexpected root certificates," stated Secorvo's report.

When the researchers analyzed the private key, they determined that it was encrypted with AES-128-CBC encryption [...] Now that they had access to the private key for the root certificate, they were able to generate a wild card certificate that signs traffic from google.com, sennheiser.com [...]
Click to expand...

Removing the insecure root certificate
Secorvo had responsibly disclosed this vulnerability to Sennheiser in advance and was issued the unique ID ID CVE-2018-17612. They were told by Sennheiser that an updated version of the HeadSetup software would be released by the end of November.

In the meantime, Sennheiser has released a batch file and information that can be used to remove the certificates for those who want to be protected immediately.
Click to expand...

"Certificate Management Vulnerability in Sennheiser HeadSetup" (PDF):
https://www.secorvo.de/publikationen/headsetup-vulnerability-report-secorvo-2018.pdf

Log in or Sign up

Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks

guest Guest

Log in or Sign up

Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks

guest Guest

Useful Searches