Hacker News Reader

Comment by jasonjayr | Hacker News Reader

> It's fortunate that the steps required here aren't particularly complicated for the devices you can update, and the advice essentially boils down to 'update them'. The problem is the devices you can't update or update easily.

> Update everything that ships a CA bundle: your OS ca-certificates package, certifi, Node, Homebrew, and rebuild your container images once the base images pick up the change.

> Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...

Quick -- we need to MITM all the smart TVs so they can be jailbroken in one fell swoop!

View on HN

Devices that are smart enough to talk to the internet but not smart enough to let the user install their own certs should not exist.

"let the user install their own certs should not exist"

are you sure that this is not opening to more attack vector ?????

Users aren't supposed to be considered an attack vector. I don't care what the advertisers think.

The infected devices on the LAN are an attack vector, though.

If I want my IOT garbage to be infected that's between me and my local botherder.

The vendor loses the right to decide how my things are used the minute they take my money.

Not in the EU. If devices you made get hacked in the EU and you have a business presence there, you're liable for the resulting damages under the Cyber Resiliency Act. If you don't notify the authorities promptly upon discovery, you might also be criminally liable.

What if your company doesn't exist anymore, and you have checks billions of devices out there that won't be getting firmware updates?

Not sure. You're probably out of luck in that case if someone can't prove that your out of business was a manipulative attempt to avoid liability.

Users are attack vectors in one of the more commonly successful attacks: social engineering.

Like: To verify you are human, clik on the two ducks and install this new certificate.

Bonus points if it's during a fake job interview.

Absolutely. "To access our secure site, install this certificate as follows..."

I did a job interview in a VM once and my legitimate accounts on some platforms got banned for using them in a VM. So you can't even protect yourself.

> my legitimate accounts on some platforms got banned for using them in a VM

Which legitimate accounts get banned for use in a VM?

That seems like an incredibly important thing I should know as I use legitimate accounts in VMs.

Bullshit. How would a website even detect a VM?

They can ask your web browser what GPU you have.

If it says QEMU, the jig is up.

See here:

https://developer.mozilla.org/en-US/docs/Web/API/GPUAdapterI...

Live demo here:

https://www.checkadevice.com/tests/gpu/ (random web site that came up in a quick search)

You have to make sure your VM + GPU hide or falsify all identity information. They just have to find one API or signal that you missed that reveals it.

RCE then run an exploit to break out VM. If it's success, then you are on VM.

Yes, however, this causes people who know what they do suffer because of people who don't. My question is whether this affects innovation, because the same thing at different places definitely does, and we actively fight against this exactly to help innovation.

Right. Let's no longer sell computers then.

Which is better - two attack vectors that can be mitigated by an expert, or one attack vector that can't be mitigated by anyone?

You can even install your own certs into the golden cage (also known as iPhones).

Yes. We're giving the user the ability to protect themselves from the vendor.

Your logic only makes sense if the user is your enemy.

I am the vendor and the user is my enemy. Fortunately I get to decide his capabilities and not the other way around, so I win.

Oops, claude just cracked your system!

The device is in the user's possession, so you'll lose eventually, it's just a matter of how long it takes.

> > Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...

The interesting question is, how many of these devices will have the compromised CA root certificate in place?

Oh and another thing is problematic, many a Java app ships with its own keystore.jks if it needs to trust some privately hosted endpoint, and that keystore.jks may or may not contain the compromised CA root certificate... updating the OS will not catch this kind of stuff.

> how many of these devices will have the compromised CA root certificate in place?

I have two Google devices at home and both are compromised still. If Google can't handle pushing out a quick cert chain update, then I truly doubt other manufacturers can.

I'm rather surprised google doesn't require cert pinning for all connections to any google server....

These devices are already very weak and many of them even do non-TLS updates with no signing check anyway.

If it has been so weak already, it can't be weaker.

Not always true. I have IoT devices where a valid certificate is useful because the original host doesn't exist anymore and the certificate isn't pinned.

Flashing the devices require direct UART/USB access which may involve soldering, if it even exists. This leak is gold for those because these devices will never get an updated CRL.

It's easy enough to apt upgrade, and curl shows it's not vulnerable.

But what about python pip and node and bun which bundle their own certs?

And then you'll have a compiled binary like Claude Code, which was built with bun, and has its vulnerable certificates bundled in, ignoring the system certs.

Yep, it's a long tail. Anything that ships it's own CA bundle will ignore whatever you fix at the OS level. Those bundles are generally root-only and don't have revocation checking, so they can't block a bad intermediate cert.

The fix can only come from the tool shipping an updated bundle, or if there's some way you can point it at the OS store once that's updated.

Some of them seem to do some cert pinning

Just imagine how much stuff you're going to be able to MiTM now!!

If you just take them offline you can do this without having to rush.

Just change your WiFi password, don’t give them the new one and don’t update them lol.

You can't hardly use the TVs then. I've seen TVs that don't let you use the HDMI port without it being connected if you have a streaming dongle connected. Hopefully that practice has mostly died off now (Samsung used to do this on some models, iirc), but it's still a risk and only kicks the can down the road a bit.

I have a terrible LG smart TV (that seems to connect to WiFi that is not mine), but I would instantly return a TV that did this.

Yeah those devices also need to be “opened up” as it were. Some of them already have been. Just think about it like fermented whiskey. Leave them alone for a month or two until they run an opensource firmware you control.

Reply on news.ycombinator.com