Here's my translation: D-link has accidentally published private keys for certificates which they use to sign their software. It was possible to extract the ke

Here's my translation: D-link has accidentally published private keys for certificates which they use to sign their software. It was possible to extract the keys from the manufacturers open source firmware packages. That made it possible for Criminals to abuse the certificates. [short explanation of how the certs work for n00bs] The mistake was find by bartvbl who informed the reporter of the problem. He had bought a D-Link DCS-5020L security camera and wanted to download the firmware. D-Link makes the source from lots of firmware available under a GPL license. "After looking through the files it turned out that the they contained the private keys which are used to sign the code" reported bartbvl, "It gets worse - some of the batch files contained the commands and passphrases that were needed [to sign the software". The user was able to confirm that the key could be used by signing a file that wasn't from D-Link. The certificate expired at the start of september, which means that the trick no longer works. Even now that the expiry date has passed, software which has been signed will still be seen as being valid. Windows only shows a certificate error after the certificates have been withdrawn. This withdrawal has already happened so this [bug/failure] cannot be abused. Software security specialists Fox-IT confirm the findings. Yonathan Klijnsma, a researcher from the company: "The certificate was indeed in one of the firmware packages, version 1.00b03, the source of which was released on 27-feb-2015. The cert was thus published before it expired, which is a big error". He [, Yonathan,] found four other certificates in the same folder. D-Link have in the meantime released new versions of the firmware which do not contain the certificates. In a statement the company told us that they regularly update the firmware in order to 'conform to the latest security and quality standards'. They emphasized that there is no question of [malicious] premeditation. "D-Link [does everything to prevent development of backdoors, bla bla boilerplate PR speak, etc etc]". D-Link promised Tweakers that they will release a new firmware next week which contains further fixes for the security problems.