12 ms·

Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

171 points by edwinjm 8y ago

kanox 8y ago
> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
- Giroflex 8y ago
  As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore? I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.
  - tyingq 8y ago
    Corporate MITM proxies, like Forcepoint/Websense. For loose definitions of "legitimate."
  - zorked 8y ago
    It's perfectly normal to install new root certificates - for example, so that a company can sign internal websites (or for MITM proxies). It's incredibly shady to have random software install into your trust store.
    - rblatz 8y ago
      As someone that has been burned by self signed internal only sites. Take the extra 15 minutes and get a proper cert, and domain name for your internal sites. It can save a massive amount of pain later.
      - zAy0LfpBZLC8mAC 8y ago
        burned how exactly?
        hannasanarion 8y ago
        It can be a real pain in the butt to go up and down the whole stack and reconfigure every library and application that might detect a insecure connection and bail. Need several independent webapps to communicate? Hoo boy.
        rblatz 8y ago
        In this case we started doing hybrid cloud, we were unable to address a ton of sites since they were on a made up internal only tld. Plus every thing we could address served up certs we couldn’t trust since we were utilizing services that didn’t allow us to modify the trusted root cert store. We saved probably $100 and 2 hours by rolling our own solutions instead of doing things the standard way. It took weeks to clean the mess completely up.
        zAy0LfpBZLC8mAC 8y ago
        Well, yeah, using a made up domain is obviously a bad idea ... but what does that have to do with root CAs? And how does trusting your own root CA lead to not trusting the certs presented by other parties? I don't really understand what kind of scenario you are describing there. And no, I don't see anything "standard" about not running your own CA, it is perfectly standard as far as I am concerned, and a really good idea as well. Relying on an external CA for internal services just creates risks of both availability and security. If you need an external CA to set up or continue operating internal services, that is an availability risk, and if you trust the whole standard set of root CAs for all of your internal services, that's a massive security risk.
        rblatz 8y ago
        Obviously if all your services are hosted in house and you will never need to expose internal services externally go for it. But as soon as your organization grows, splits, merges or starts utilizing other services that don’t give you access to the trust store you are boned. It screwed us, and was a giant pain to fix.
  - avian 8y ago
    I run some services for my private use. It's crazy that I need to have them certified by some third-party over-seas CA since I can't get my own devices to trust my own certificates. We're not at that point yet, but running your own trust root is getting quite annoying. For example, Android constantly nags about "network might be monitored" when custom certificates are installed.
    - pritambaral 8y ago
      > Android constantly nags about "network might be monitored" when custom certificates are installed. This is why I baked my home network certificate into the system trust store when building the ROM.
      - magic-chicken 8y ago
        What tools / guide did you use to accomplish this (building the ROM AND adding your certificate) ?
        StillBored 8y ago
        (maybe not what you were asking) But for beginners there are some pretty nice LineageOs build guides floating around: For specific pieces of hardware: https://wiki.lineageos.org/build_guides.html https://wiki.lineageos.org/build_guides.html Generic instructions: https://forum.xda-developers.com/chef-central/android/how-to-build-lineageos-14-1-t3551484 https://forum.xda-developers.com/chef-central/android/how-to... As far as changing the certs, I know offhand to do it with a couple random linux distro's but i'm not 100% sure for android, you might just try searching the repo for the default certs then looking at how they are built into the image and tweaking that.
    - otterlicious 8y ago
      Android constantly nags about "network might be monitored" when custom certificates are installed. It won't if you add name constraints to your root certificate (because then it can't be used for blanket monitoring).
  - tialaramex 8y ago
    Nobody will issue Sennheiser a certificate for this purpose. Every so often a company abuses a cert they were issued to do what Sennheiser wanted to achieve here (local loopback HTTPS) and when they're caught the cert is revoked and they get a slap on the wrist. Blizzard is a recent example. The Right Thing (TM) is to not do HTTPS, a modern web browser is supposed to conclude that ::1 and 127.0.0.1 are secure without HTTPS since there is no possibility of a "man in the middle" of your own computer's loopback.
    - plopz 8y ago
      Blizzard ended up doing it the right way. https://twitter.com/taviso/status/939634523137966080 https://twitter.com/taviso/status/939634523137966080 https://news.ycombinator.com/item?id=15982161 https://news.ycombinator.com/item?id=15982161
    - kilburn 8y ago
      If you want an arbitrary (thus https based) website to be able to communicate with a localhost server using websockets you are forced to use https on the localhost server. This is because the browser won't connect to non-secure websockets from an https website, even if the websocket is to localhost. The actual right thing to do is to generate a private key and certificate (for a specific, public name you point to 127.0.0.1) during the software installation and add the latter to the trusted store. Now you don't have this vulnerability because each computer has a different trusted certificate with a different key, so a random attacker cannot just use the key they got to spy on other users.
  - AndyMcConachie 8y ago
    Stupid question. Who should have the ability to install root CA certs? I like using HTTPS instead of HTTP, so I need some installed. Who should be responsible for managing them? And before you say the CABF, they're ultimatately not the ones who decide what gets installed on your computer. The answer to that question is much more complicated.
  - jerf 8y ago
    There was never a good reason to install a root certificate for the purpose of speaking securely to your own gear or web services. In that case, you don't need to add them to the root trust store, you just need to create an SSL context that has those certificates set as trusted. However, the problem is, nobody understands SSL properly. Among the people who don't understand SSL properly is, alas, a number of people writing SSL libraries. Not the actual SSL libraries like OpenSSL, but all the surrounding libraries to make it "easy to use", which includes libraries that try to make HTTP easy to use and abstract the difference between HTTP and HTTPS. Pretty much every "ease of use" library I have ever seen accomplishes its ease of use by dropping features from the underlying SSL support, but it's clear they often don't understand why those features were there and the consequences of dropping them. I have a particular case where I've got some Perl code that is literally 4 levels deep in "SSL ease of use" code, with pretty much every layer dropping SSL features along the way (even the base level Net::SSLeay is missing a lot of stuff once you go beyond the basics, and it only gets worse as the stack gets higher). Once I had to poke support for a certain feature all the way down through the entire stack because it got dropped really early. So what you need to do in this case is create your own root store of trust, and then stick your own certs in there from some .pems or something, and then use that to initialize SSL on your connection. But it's complicated to do that at the base level of a lot of SSL libraries, and this is often one of the first features to be "abstracted away" by support libraries, and a lot of HTTP libraries end up trying to "abstract away" SSL so thoroughly that they don't even have parameters to control the SSL elements of the connection, and if they do, they have some ad-hoc selection of random bits that someone once needed, rather than comprehensive support. The upshot is that I'd consider it likely that they were using one of these libraries, and the only way they could see to get their certificates trusted was to stick them in the default root store, because that's the only thing that would work with such libraries. You can also find web pages and such recommending this approach. It's also possible they just came across one of these web pages or something and put stuff in the root without realizing what it really meant, even though their library allowed them to do everything I said, because it's way easier to slam something into the default trust store than write the code to create your own at run time. (It ought to be easy to write that code. The rather nice Go TLS library makes it almost as easy as I say it is; create cert store, add certificate, set that as your root trust, modulo a bit of error handling it really is just about that many lines of code. But the "ease of use" libraries can really get in the way, when the people adding the "ease of use" abstractions themselves don't understand what that means, or why you might want/need it, or how to make it easy.)
- sneak 8y ago
  Why? The user chose to run the installer and opted to give it control to modify their computer. What part of that process should be illegal?
  - tomseldon 8y ago
    They give permission to modify their computer/device, but obviously there's an implicit trust that it isn't going to do something horrifically bad. Trusting a builder to come in to your home and change things- you'd be pretty angry if they took down a supporting wall to put up a new light fitting (and you'd probably have some legal comeback).
    - sneak 8y ago
      Yes, in civil court. What part of it should be illegal?
  - fabricexpert 8y ago
    They gave it control to install headphone software. This is beyond the reasonable scope of what headphone software could be expected to do.
- userbinator 8y ago
  I have to STRONGLY disagree. It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/filtering proxy and MITM my own traffic continuously. What's scarier than being MITM'd? Being force-fed by those who want to control your life. These certificates are used by the software to communicate with the headset using a TLS encrypted web socket. Why does a headset even need TLS...
  - fabricexpert 8y ago
    The law doesn't have to lock it down though. Software companies should be accountable for putting users at risk in this way, it should not be legal to install fundamentally insecure software without explicit permission from the user.
    - tokyodude 8y ago
      Did it not ask for permission? "Type in your admin password to install?" This seems like an OS problem to me. I wish Apple and MS would clamp down on allowing apps to even ask for root to install. I don't think the OS should be as locked as iOS, as a user I still want control, but the fact that so many apps ask for root to install needs to be stopped. 99.9% of all apps need to be sandboxed
  - loup-vaillant 8y ago
    No you don't disagree. The comment you're responding to doesn't say users shouldn't be free to add whatever root certificate they want. Of course they should. What should be illegal are programs that silently add a root certificate without the user's informed consent. I very much doubt you disagree with that.
  - tialaramex 8y ago
    In practice the corporation "dictating" the set of publicly trusted CA roots is the Mozilla Foundation, a 501(c)(3) non-profit with a large volunteer effort. On paper all the major browser vendors / operating system vendors (Microsoft, Apple, Google, Mozilla) have independent root trust programmes. But after several years working on this stuff I would say that all real public oversight is done by Mozilla, which AFAICT suits everybody else just fine. So you can and should help Mozilla "dictate" what is trustworthy. You might be surprised how much difference you can make. The libertarian dream solution (everybody makes their own trust decisions somehow) is unrealistic in the face of the reality that most people just vaguely assume that "someone" is keeping them safe and lack both the technical knowledge and the spare time to make useful decisions.
Jonnax 8y ago
Why are they deploying their own certificate into the root store???? This is shocking behaviour. What's the difference between this and malicious software.
- sneak 8y ago
  Intent.
- merb 8y ago
  the problem is not that they add a root ca to the store. the problem is that they use the same Root CA on every computer in the world AND adding it into the Store AND having the Root CA PRIVATE KEY on ANY computer.
  - avian 8y ago
    > the problem is not that they add a root ca to the store. Yes there is. There is no valid reason for a glorified headphone driver to mess with what website your browser trusts.
    - kilburn 8y ago
      There is a valid reason: to enable website-to-hardware communication (i.e, to provide a javascript-based api for websites to interface with that hardware). Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick. Of course, companies should NOT reuse the same certificate between installations though (just generate a certificate during the installation process and life is good again).
      - merb 8y ago
        > Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick well not only browsers, os's in general ;)
petepete 8y ago
Have any hardware companies ever written good accompanying software? From all the custom-ui graphics card config nonsense to utilities that phone home of their own accord, to things like this which are laughably awful. I feel glad I left for the mild shores of Linux in the early 00s.
- diminoten 8y ago
  Yeah, because on Linux the community has to support the hardware because the manufacturer doesn't even bother. Sounds way better...
  - hkt 8y ago
    I would like to inform you that it does in fact work really rather well. I write this on a laptop running Debian Linux which I use for work. It's great. I also use a machine running Debian Linux for my personal computing needs, but prefer to separate those concerns a bit. I can confirm the community's support is excellent though.
    - snaky 8y ago
      Actually the support from community is often much better than from the vendor. Especially for the older hardware, which works perfectly fine, but just have no drivers for modern Windows. The main problem with hardware support in Linux is there is no up-to-date source of information about what works and what doesn't (and everything in between). You can usually find info about particular piece of hardware, but it lacks the main purpose of such a database - to make more people to buy more open hardware.
    - diminoten 8y ago
      It doesn't work at all, for the thousands of pieces of hardware that simply don't work on Linux, or work poorly. Further, it doesn't work at all from an economics standpoint. There is zero incentive driving the community to support every iteration of every type of hardware other than personal need, and if you're suggesting that anyone who needs something has to go out and build a driver themselves, please let me know who your dealer is because I want to be as high as you. As for, "the community is better than the manufacturer" try having an outage over the holidays, and see how your community reacts to, "help me or my business fails".
NoblePublius 8y ago
No care for I don’t buy audio equipment named for prominent Nazis.
_null_ 8y ago
This seems like pure laziness. Did the developers really not have an understanding of basic PKI? Or did they realize late in the game that their local web socket was gonna require HTTPS and slap this on at the last minute?
- snaky 8y ago
  Why should developers care if customers don't? Do we know about a one B2C company who lost the business due the security breaches in their products?
SuperGent 8y ago
HN discussion and original report - https://news.ycombinator.com/item?id=18550854 https://news.ycombinator.com/item?id=18550854
hkt 8y ago
From smart TVs to this. How awful. Software is eating perfectly good peripherals and _totally_ ruining them.
nimbius 8y ago
The comfort in this article is knowing for every boutique german headphone company that insists on becoming a CA, there are thousands of nameless chinese companies producing superior products at lower prices that do to some measure respect the users privacy in that they arent more than just a USB peripheral. Sades and Xiberia for example make perfectly useful (if not a little bit cyberpunk) headsets that just operate as USB soundcards with no special CA requirement. And if you're just in the mood to listen to some music without special software in this foul year of our lord 2018, Might i suggest a pair of Superlux 668B's? for ~$40 theyre easily better than anything Sennheiser produces that requires its own PKI.
- thefounder 8y ago
  For the record chinesse products are championing this kid of issues, many times for malign reasons(not by mistake). Remember Lenovo?
- snaky 8y ago
  Nameless Chinese companies' software support is usually rather limited, to say the least. From the absence of firmware updates to the very basic set of the software features. When they will produce comparable software support for their hardware, there will be the same problems, maybe much worse.
- LMYahooTFY 8y ago
  I know this is really nitpicky, but is Sennheiser really a "boutique" company? I was under the impression their maybe one of the biggest and most prominent headphone manufacturers in the world, especially when measured by R&D.
  - SSLy 8y ago
    Well, at least the company is still held by the Sennheiser family. That's something.
  - snaky 8y ago
    Exactly. The funny thing is the most of 'boutique' headphones companies are small Chinese vendors now, mostly unknown for the Western people outside of HeadFi forums.
ams6110 8y ago
All the technical mistakes aside, yet another illustration of why I refuse to use wireless peripherals. They're uniformly shoddy at best, dropping connections or having difficulty pairing often. The idea that headphones should need software strikes me as insane.
- dangoor 8y ago
  This is why Apple’s AirPods have been so popular. They really work quite well, compared to any other wireless headphones I’ve used. Easier pairing and better connections.
  - willio58 8y ago
    Also, surprisingly durable. Around April I accidentally left them out of their charger and outside in the pocket of a foldable chair when I went out of town for 1 month. It rained on them multiple times. When I found them I was sure they would be broken.. I charged them up and I still use them daily. No issues.
BenjaminBlair 8y ago
Lots of security flaws in code recently. FB and Google+ both leaked, Instagram had a minor leak a week or so ago. It's hard to put blame, I've coded just a bit in my life but I get it how hard it is to write a truly secure and efficient code. Well, on the bright side users can protect themselves against MITM attacks by using a VPN. I'm using Surfshark right now, have tried Zenmate, PIA before, but had some minor issues and wanted to change provider. Surfshark looks pretty secure, they have been audited recently by Cure53 and the outcome was positive. Decided to buy it after that, they offered "BLACKSHARK" coupon which gave a nice discount, maybe it still works. Some providers tend to keep Black Friday discounts a bit longer.
- softawre 8y ago
  If this isn't an ad for Surfshark, you need to work on your delivery. If it is, shame.
  - BenjaminBlair 8y ago
    Sorry if that sounded promotional, but VPNs do in fact protect against MITM attacks. And the service I mentioned I found reliable so I felt like the information was relevant, but point taken for future notice :)
sambe 8y ago
How does the process of getting the certificate installed work? Does the user manually accept the installation at any point? Or is part of the blame on Microsoft for allowing this?
- Crosseye_Jack 8y ago
  You "just" need admin priv's to install one. there are "legit" reasons for using one atm (how else do you communicate with a localy running application from a site using SSL/TLS without using a browser extenstion? I honestly want to know as it would be handy for a project i'm working on). For example Battle.net have a per machine generated CA that gets installed when you install BNet (which is why it recently started asking for admin privs to install / update instead of just asking for them when installing a game). Its used for talking to BNet when following a battle.net link which can be used to prompt you to join BattleNet groups and other things. They used to use a cert signed by a public CA but that's is frowned upon (as the only way the client could really use it is if it knew the key for the cert which would lead to either a million localhost.bnet.tld (I don't remember the actual hostname so pulled one out of the air) certs or a shared cert with a million people who could access the private key if they went looking hard enough). They made a forum post about it when the issue about their own self signed CA started showing up everywhere [0]. I believe Spotify do something similar so things like open.spotify.com and other widgets can control the locally running spotify app. MS themselves have a certtool in Visual Studio to create and add certs when dev'ing using the latest builds of ASP.NET Core 2 as the default for new projects is to use SSL (but iirc the cert tool VS uses does give you a prompt about it installing a cert). [0] https://us.battle.net/forums/en/bnet/topic/20760626838 https://us.battle.net/forums/en/bnet/topic/20760626838
StillBored 8y ago
Hmm, I recently picked up a pair of pxc 550s (crazy good black Friday deal), and I saw the thing about installing their android/iphone app to do NFC pairing, but I frankly have no idea why you would want that, or really much of anything else in the app. The reviews even mention that the eq controls don't even work for DRM'ed content. OTOH, it seems if you pair the headphones with normal bluetooth its just using A2DP/SBC and the audio quality is _miserable_. Maybe its using a custom bluetooth profile/a2dp codec? Basically, why exactly do they even need a full blown app? (on a further side note, I've gotten to the point where I don't really even notice AC and computer fan noise so much so that while a couple of coworkers complained about it, it wasn't until I tried the PXC 550's at work that I realized our AC blowers are really _LOUD_. With the 550's the constant low frequency rumble is just gone. I guess my earplugs just wern't blocking that much low frequency.).
- NullPrefix 8y ago
  RMA for miserable sound ?
  - StillBored 8y ago
    The sound is fantastic with the cable, its like night and day, and I don't even consider myself to have very good ears.
  - fein 8y ago
    Bluetooth is absolute garbage for serious audio. Wired will always sound better, and a DAC + Amp driving the cans will always sound the best. Sennheiser does make BT headphones with a dedicated tower that helps a bit, but nothing can replace a hard line.
    - deleted 8y ago
      [deleted]
    - icebraining 8y ago
      Even BT 2.0 can transmit at 2mbps and devices can support AAC, which is be more than enough for decent audio. Devices are garbage, not the protocol.
creeble 8y ago
I'm a little lost on why the need a new root CA cert on a computer that already has a cert store. Can't they safely communicate with whatever.sennheiser.com using the existing certs? Afaict, this isn't a stand-alone device trying to communicate, but your computer, running some app. What am I missing? Edit: okay, I see below that they are using a local web server, and (thanks to browser decisions about localhost) it requires https.
- subway 8y ago
  The really silly thing is that it's 2018 and the browser vendors still refuse to implement name based constraints on certificate authorities. It should be perfectly reasonable for a local, single domain CA to be generated and installed with the application. Instead we treat every CA as worthy to handle every domain always.
  - bostik 8y ago
    I'm not sure that's a browser thing. The X.509 spec specifies a field for that, which in OpenSSL would be called "subjectNameConstraints". The rules for the constraint can be found in RFC5280.[0] Mozilla have had an open development track for CA name constraints for quite some time, but the last edit to the page is from 2015.[1] I tried to actually use this field couple of years ago, and none of the existing tools I tried had any support for it. OpenSSL would fail to parse a CSR config with this key. Same for Go's TLS library. So of course I did what any enterprising hacker would do: I created a CSR manually with the correct OID in place. Trying to sign that was nothing short of hilarious. Loading up the CSR into OpenSSL would trigger a BIO_read_* error. Trying the same with Go's TLS library triggered a panic! I then realised that if you could somehow supply a certificate chain with a name-constrained CA in it, it would act as a highly reliable DoS against virtually all clients. (Probably against servers too, if you supplied a client-cert chain.) Based on discussions since, I have been informed that Microsoft's TLS stack supports this - or at least should be technically capable of issuing CAs with the field in place. But because practically nothing else in the world has the support, and is in fact likely to crash when presented with one, even a gradual rollout is simply not possible. Hence every single CA you see will be valid for *. 0: https://tools.ietf.org/html/rfc5280 https://tools.ietf.org/html/rfc5280 1: https://wiki.mozilla.org/CA:NameConstraints https://wiki.mozilla.org/CA:NameConstraints
angel_j 8y ago
It would be strange if it wasn't allowed. You are the man in the middle of a headset.
deleted 8y ago
[deleted]

171 points by edwinjm 8y ago

> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.

Giroflex 8y ago
As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore? I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.
- tyingq 8y ago
  Corporate MITM proxies, like Forcepoint/Websense. For loose definitions of "legitimate."
- zorked 8y ago
  It's perfectly normal to install new root certificates - for example, so that a company can sign internal websites (or for MITM proxies). It's incredibly shady to have random software install into your trust store.
  - rblatz 8y ago
    As someone that has been burned by self signed internal only sites. Take the extra 15 minutes and get a proper cert, and domain name for your internal sites. It can save a massive amount of pain later.
    - zAy0LfpBZLC8mAC 8y ago
      burned how exactly?
      - hannasanarion 8y ago
        It can be a real pain in the butt to go up and down the whole stack and reconfigure every library and application that might detect a insecure connection and bail. Need several independent webapps to communicate? Hoo boy.
      - rblatz 8y ago
        In this case we started doing hybrid cloud, we were unable to address a ton of sites since they were on a made up internal only tld. Plus every thing we could address served up certs we couldn’t trust since we were utilizing services that didn’t allow us to modify the trusted root cert store. We saved probably $100 and 2 hours by rolling our own solutions instead of doing things the standard way. It took weeks to clean the mess completely up.
        zAy0LfpBZLC8mAC 8y ago
        Well, yeah, using a made up domain is obviously a bad idea ... but what does that have to do with root CAs? And how does trusting your own root CA lead to not trusting the certs presented by other parties? I don't really understand what kind of scenario you are describing there. And no, I don't see anything "standard" about not running your own CA, it is perfectly standard as far as I am concerned, and a really good idea as well. Relying on an external CA for internal services just creates risks of both availability and security. If you need an external CA to set up or continue operating internal services, that is an availability risk, and if you trust the whole standard set of root CAs for all of your internal services, that's a massive security risk.
        rblatz 8y ago
        Obviously if all your services are hosted in house and you will never need to expose internal services externally go for it. But as soon as your organization grows, splits, merges or starts utilizing other services that don’t give you access to the trust store you are boned. It screwed us, and was a giant pain to fix.
- avian 8y ago
  I run some services for my private use. It's crazy that I need to have them certified by some third-party over-seas CA since I can't get my own devices to trust my own certificates. We're not at that point yet, but running your own trust root is getting quite annoying. For example, Android constantly nags about "network might be monitored" when custom certificates are installed.
  - pritambaral 8y ago
    > Android constantly nags about "network might be monitored" when custom certificates are installed. This is why I baked my home network certificate into the system trust store when building the ROM.
    - magic-chicken 8y ago
      What tools / guide did you use to accomplish this (building the ROM AND adding your certificate) ?
      - StillBored 8y ago
        (maybe not what you were asking) But for beginners there are some pretty nice LineageOs build guides floating around: For specific pieces of hardware: https://wiki.lineageos.org/build_guides.html https://wiki.lineageos.org/build_guides.html Generic instructions: https://forum.xda-developers.com/chef-central/android/how-to-build-lineageos-14-1-t3551484 https://forum.xda-developers.com/chef-central/android/how-to... As far as changing the certs, I know offhand to do it with a couple random linux distro's but i'm not 100% sure for android, you might just try searching the repo for the default certs then looking at how they are built into the image and tweaking that.
  - otterlicious 8y ago
    Android constantly nags about "network might be monitored" when custom certificates are installed. It won't if you add name constraints to your root certificate (because then it can't be used for blanket monitoring).
- tialaramex 8y ago
  Nobody will issue Sennheiser a certificate for this purpose. Every so often a company abuses a cert they were issued to do what Sennheiser wanted to achieve here (local loopback HTTPS) and when they're caught the cert is revoked and they get a slap on the wrist. Blizzard is a recent example. The Right Thing (TM) is to not do HTTPS, a modern web browser is supposed to conclude that ::1 and 127.0.0.1 are secure without HTTPS since there is no possibility of a "man in the middle" of your own computer's loopback.
  - plopz 8y ago
    Blizzard ended up doing it the right way. https://twitter.com/taviso/status/939634523137966080 https://twitter.com/taviso/status/939634523137966080 https://news.ycombinator.com/item?id=15982161 https://news.ycombinator.com/item?id=15982161
  - kilburn 8y ago
    If you want an arbitrary (thus https based) website to be able to communicate with a localhost server using websockets you are forced to use https on the localhost server. This is because the browser won't connect to non-secure websockets from an https website, even if the websocket is to localhost. The actual right thing to do is to generate a private key and certificate (for a specific, public name you point to 127.0.0.1) during the software installation and add the latter to the trusted store. Now you don't have this vulnerability because each computer has a different trusted certificate with a different key, so a random attacker cannot just use the key they got to spy on other users.
- AndyMcConachie 8y ago
  Stupid question. Who should have the ability to install root CA certs? I like using HTTPS instead of HTTP, so I need some installed. Who should be responsible for managing them? And before you say the CABF, they're ultimatately not the ones who decide what gets installed on your computer. The answer to that question is much more complicated.
- jerf 8y ago
  There was never a good reason to install a root certificate for the purpose of speaking securely to your own gear or web services. In that case, you don't need to add them to the root trust store, you just need to create an SSL context that has those certificates set as trusted. However, the problem is, nobody understands SSL properly. Among the people who don't understand SSL properly is, alas, a number of people writing SSL libraries. Not the actual SSL libraries like OpenSSL, but all the surrounding libraries to make it "easy to use", which includes libraries that try to make HTTP easy to use and abstract the difference between HTTP and HTTPS. Pretty much every "ease of use" library I have ever seen accomplishes its ease of use by dropping features from the underlying SSL support, but it's clear they often don't understand why those features were there and the consequences of dropping them. I have a particular case where I've got some Perl code that is literally 4 levels deep in "SSL ease of use" code, with pretty much every layer dropping SSL features along the way (even the base level Net::SSLeay is missing a lot of stuff once you go beyond the basics, and it only gets worse as the stack gets higher). Once I had to poke support for a certain feature all the way down through the entire stack because it got dropped really early. So what you need to do in this case is create your own root store of trust, and then stick your own certs in there from some .pems or something, and then use that to initialize SSL on your connection. But it's complicated to do that at the base level of a lot of SSL libraries, and this is often one of the first features to be "abstracted away" by support libraries, and a lot of HTTP libraries end up trying to "abstract away" SSL so thoroughly that they don't even have parameters to control the SSL elements of the connection, and if they do, they have some ad-hoc selection of random bits that someone once needed, rather than comprehensive support. The upshot is that I'd consider it likely that they were using one of these libraries, and the only way they could see to get their certificates trusted was to stick them in the default root store, because that's the only thing that would work with such libraries. You can also find web pages and such recommending this approach. It's also possible they just came across one of these web pages or something and put stuff in the root without realizing what it really meant, even though their library allowed them to do everything I said, because it's way easier to slam something into the default trust store than write the code to create your own at run time. (It ought to be easy to write that code. The rather nice Go TLS library makes it almost as easy as I say it is; create cert store, add certificate, set that as your root trust, modulo a bit of error handling it really is just about that many lines of code. But the "ease of use" libraries can really get in the way, when the people adding the "ease of use" abstractions themselves don't understand what that means, or why you might want/need it, or how to make it easy.)
sneak 8y ago
Why? The user chose to run the installer and opted to give it control to modify their computer. What part of that process should be illegal?
- tomseldon 8y ago
  They give permission to modify their computer/device, but obviously there's an implicit trust that it isn't going to do something horrifically bad. Trusting a builder to come in to your home and change things- you'd be pretty angry if they took down a supporting wall to put up a new light fitting (and you'd probably have some legal comeback).
  - sneak 8y ago
    Yes, in civil court. What part of it should be illegal?
- fabricexpert 8y ago
  They gave it control to install headphone software. This is beyond the reasonable scope of what headphone software could be expected to do.
userbinator 8y ago
I have to STRONGLY disagree. It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/filtering proxy and MITM my own traffic continuously. What's scarier than being MITM'd? Being force-fed by those who want to control your life. These certificates are used by the software to communicate with the headset using a TLS encrypted web socket. Why does a headset even need TLS...
- fabricexpert 8y ago
  The law doesn't have to lock it down though. Software companies should be accountable for putting users at risk in this way, it should not be legal to install fundamentally insecure software without explicit permission from the user.
  - tokyodude 8y ago
    Did it not ask for permission? "Type in your admin password to install?" This seems like an OS problem to me. I wish Apple and MS would clamp down on allowing apps to even ask for root to install. I don't think the OS should be as locked as iOS, as a user I still want control, but the fact that so many apps ask for root to install needs to be stopped. 99.9% of all apps need to be sandboxed
- loup-vaillant 8y ago
  No you don't disagree. The comment you're responding to doesn't say users shouldn't be free to add whatever root certificate they want. Of course they should. What should be illegal are programs that silently add a root certificate without the user's informed consent. I very much doubt you disagree with that.
- tialaramex 8y ago
  In practice the corporation "dictating" the set of publicly trusted CA roots is the Mozilla Foundation, a 501(c)(3) non-profit with a large volunteer effort. On paper all the major browser vendors / operating system vendors (Microsoft, Apple, Google, Mozilla) have independent root trust programmes. But after several years working on this stuff I would say that all real public oversight is done by Mozilla, which AFAICT suits everybody else just fine. So you can and should help Mozilla "dictate" what is trustworthy. You might be surprised how much difference you can make. The libertarian dream solution (everybody makes their own trust decisions somehow) is unrealistic in the face of the reality that most people just vaguely assume that "someone" is keeping them safe and lack both the technical knowledge and the spare time to make useful decisions.

Jonnax 8y ago

Why are they deploying their own certificate into the root store???? This is shocking behaviour. What's the difference between this and malicious software.

sneak 8y ago
Intent.
merb 8y ago
the problem is not that they add a root ca to the store. the problem is that they use the same Root CA on every computer in the world AND adding it into the Store AND having the Root CA PRIVATE KEY on ANY computer.
- avian 8y ago
  > the problem is not that they add a root ca to the store. Yes there is. There is no valid reason for a glorified headphone driver to mess with what website your browser trusts.
  - kilburn 8y ago
    There is a valid reason: to enable website-to-hardware communication (i.e, to provide a javascript-based api for websites to interface with that hardware). Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick. Of course, companies should NOT reuse the same certificate between installations though (just generate a certificate during the installation process and life is good again).
    - merb 8y ago
      > Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick well not only browsers, os's in general ;)

petepete 8y ago

Have any hardware companies ever written good accompanying software? From all the custom-ui graphics card config nonsense to utilities that phone home of their own accord, to things like this which are laughably awful. I feel glad I left for the mild shores of Linux in the early 00s.

diminoten 8y ago
Yeah, because on Linux the community has to support the hardware because the manufacturer doesn't even bother. Sounds way better...
- hkt 8y ago
  I would like to inform you that it does in fact work really rather well. I write this on a laptop running Debian Linux which I use for work. It's great. I also use a machine running Debian Linux for my personal computing needs, but prefer to separate those concerns a bit. I can confirm the community's support is excellent though.
  - snaky 8y ago
    Actually the support from community is often much better than from the vendor. Especially for the older hardware, which works perfectly fine, but just have no drivers for modern Windows. The main problem with hardware support in Linux is there is no up-to-date source of information about what works and what doesn't (and everything in between). You can usually find info about particular piece of hardware, but it lacks the main purpose of such a database - to make more people to buy more open hardware.
  - diminoten 8y ago
    It doesn't work at all, for the thousands of pieces of hardware that simply don't work on Linux, or work poorly. Further, it doesn't work at all from an economics standpoint. There is zero incentive driving the community to support every iteration of every type of hardware other than personal need, and if you're suggesting that anyone who needs something has to go out and build a driver themselves, please let me know who your dealer is because I want to be as high as you. As for, "the community is better than the manufacturer" try having an outage over the holidays, and see how your community reacts to, "help me or my business fails".

NoblePublius 8y ago

No care for I don’t buy audio equipment named for prominent Nazis.

_null_ 8y ago

This seems like pure laziness. Did the developers really not have an understanding of basic PKI? Or did they realize late in the game that their local web socket was gonna require HTTPS and slap this on at the last minute?

snaky 8y ago
Why should developers care if customers don't? Do we know about a one B2C company who lost the business due the security breaches in their products?

SuperGent 8y ago

HN discussion and original report - https://news.ycombinator.com/item?id=18550854 https://news.ycombinator.com/item?id=18550854

hkt 8y ago

From smart TVs to this. How awful. Software is eating perfectly good peripherals and _totally_ ruining them.

nimbius 8y ago

The comfort in this article is knowing for every boutique german headphone company that insists on becoming a CA, there are thousands of nameless chinese companies producing superior products at lower prices that do to some measure respect the users privacy in that they arent more than just a USB peripheral. Sades and Xiberia for example make perfectly useful (if not a little bit cyberpunk) headsets that just operate as USB soundcards with no special CA requirement. And if you're just in the mood to listen to some music without special software in this foul year of our lord 2018, Might i suggest a pair of Superlux 668B's? for ~$40 theyre easily better than anything Sennheiser produces that requires its own PKI.

thefounder 8y ago
For the record chinesse products are championing this kid of issues, many times for malign reasons(not by mistake). Remember Lenovo?
snaky 8y ago
Nameless Chinese companies' software support is usually rather limited, to say the least. From the absence of firmware updates to the very basic set of the software features. When they will produce comparable software support for their hardware, there will be the same problems, maybe much worse.
LMYahooTFY 8y ago
I know this is really nitpicky, but is Sennheiser really a "boutique" company? I was under the impression their maybe one of the biggest and most prominent headphone manufacturers in the world, especially when measured by R&D.
- SSLy 8y ago
  Well, at least the company is still held by the Sennheiser family. That's something.
- snaky 8y ago
  Exactly. The funny thing is the most of 'boutique' headphones companies are small Chinese vendors now, mostly unknown for the Western people outside of HeadFi forums.

ams6110 8y ago

All the technical mistakes aside, yet another illustration of why I refuse to use wireless peripherals. They're uniformly shoddy at best, dropping connections or having difficulty pairing often. The idea that headphones should need software strikes me as insane.

dangoor 8y ago
This is why Apple’s AirPods have been so popular. They really work quite well, compared to any other wireless headphones I’ve used. Easier pairing and better connections.
- willio58 8y ago
  Also, surprisingly durable. Around April I accidentally left them out of their charger and outside in the pocket of a foldable chair when I went out of town for 1 month. It rained on them multiple times. When I found them I was sure they would be broken.. I charged them up and I still use them daily. No issues.

BenjaminBlair 8y ago

Lots of security flaws in code recently. FB and Google+ both leaked, Instagram had a minor leak a week or so ago. It's hard to put blame, I've coded just a bit in my life but I get it how hard it is to write a truly secure and efficient code. Well, on the bright side users can protect themselves against MITM attacks by using a VPN. I'm using Surfshark right now, have tried Zenmate, PIA before, but had some minor issues and wanted to change provider. Surfshark looks pretty secure, they have been audited recently by Cure53 and the outcome was positive. Decided to buy it after that, they offered "BLACKSHARK" coupon which gave a nice discount, maybe it still works. Some providers tend to keep Black Friday discounts a bit longer.

softawre 8y ago
If this isn't an ad for Surfshark, you need to work on your delivery. If it is, shame.
- BenjaminBlair 8y ago
  Sorry if that sounded promotional, but VPNs do in fact protect against MITM attacks. And the service I mentioned I found reliable so I felt like the information was relevant, but point taken for future notice :)

sambe 8y ago

How does the process of getting the certificate installed work? Does the user manually accept the installation at any point? Or is part of the blame on Microsoft for allowing this?

Crosseye_Jack 8y ago
You "just" need admin priv's to install one. there are "legit" reasons for using one atm (how else do you communicate with a localy running application from a site using SSL/TLS without using a browser extenstion? I honestly want to know as it would be handy for a project i'm working on). For example Battle.net have a per machine generated CA that gets installed when you install BNet (which is why it recently started asking for admin privs to install / update instead of just asking for them when installing a game). Its used for talking to BNet when following a battle.net link which can be used to prompt you to join BattleNet groups and other things. They used to use a cert signed by a public CA but that's is frowned upon (as the only way the client could really use it is if it knew the key for the cert which would lead to either a million localhost.bnet.tld (I don't remember the actual hostname so pulled one out of the air) certs or a shared cert with a million people who could access the private key if they went looking hard enough). They made a forum post about it when the issue about their own self signed CA started showing up everywhere [0]. I believe Spotify do something similar so things like open.spotify.com and other widgets can control the locally running spotify app. MS themselves have a certtool in Visual Studio to create and add certs when dev'ing using the latest builds of ASP.NET Core 2 as the default for new projects is to use SSL (but iirc the cert tool VS uses does give you a prompt about it installing a cert). [0] https://us.battle.net/forums/en/bnet/topic/20760626838 https://us.battle.net/forums/en/bnet/topic/20760626838

StillBored 8y ago

Hmm, I recently picked up a pair of pxc 550s (crazy good black Friday deal), and I saw the thing about installing their android/iphone app to do NFC pairing, but I frankly have no idea why you would want that, or really much of anything else in the app. The reviews even mention that the eq controls don't even work for DRM'ed content. OTOH, it seems if you pair the headphones with normal bluetooth its just using A2DP/SBC and the audio quality is _miserable_. Maybe its using a custom bluetooth profile/a2dp codec? Basically, why exactly do they even need a full blown app? (on a further side note, I've gotten to the point where I don't really even notice AC and computer fan noise so much so that while a couple of coworkers complained about it, it wasn't until I tried the PXC 550's at work that I realized our AC blowers are really _LOUD_. With the 550's the constant low frequency rumble is just gone. I guess my earplugs just wern't blocking that much low frequency.).

NullPrefix 8y ago
RMA for miserable sound ?
- StillBored 8y ago
  The sound is fantastic with the cable, its like night and day, and I don't even consider myself to have very good ears.
- fein 8y ago
  Bluetooth is absolute garbage for serious audio. Wired will always sound better, and a DAC + Amp driving the cans will always sound the best. Sennheiser does make BT headphones with a dedicated tower that helps a bit, but nothing can replace a hard line.
  - deleted 8y ago
    [deleted]
  - icebraining 8y ago
    Even BT 2.0 can transmit at 2mbps and devices can support AAC, which is be more than enough for decent audio. Devices are garbage, not the protocol.

creeble 8y ago

I'm a little lost on why the need a new root CA cert on a computer that already has a cert store. Can't they safely communicate with whatever.sennheiser.com using the existing certs? Afaict, this isn't a stand-alone device trying to communicate, but your computer, running some app. What am I missing? Edit: okay, I see below that they are using a local web server, and (thanks to browser decisions about localhost) it requires https.

subway 8y ago
The really silly thing is that it's 2018 and the browser vendors still refuse to implement name based constraints on certificate authorities. It should be perfectly reasonable for a local, single domain CA to be generated and installed with the application. Instead we treat every CA as worthy to handle every domain always.
- bostik 8y ago
  I'm not sure that's a browser thing. The X.509 spec specifies a field for that, which in OpenSSL would be called "subjectNameConstraints". The rules for the constraint can be found in RFC5280.[0] Mozilla have had an open development track for CA name constraints for quite some time, but the last edit to the page is from 2015.[1] I tried to actually use this field couple of years ago, and none of the existing tools I tried had any support for it. OpenSSL would fail to parse a CSR config with this key. Same for Go's TLS library. So of course I did what any enterprising hacker would do: I created a CSR manually with the correct OID in place. Trying to sign that was nothing short of hilarious. Loading up the CSR into OpenSSL would trigger a BIO_read_* error. Trying the same with Go's TLS library triggered a panic! I then realised that if you could somehow supply a certificate chain with a name-constrained CA in it, it would act as a highly reliable DoS against virtually all clients. (Probably against servers too, if you supplied a client-cert chain.) Based on discussions since, I have been informed that Microsoft's TLS stack supports this - or at least should be technically capable of issuing CAs with the field in place. But because practically nothing else in the world has the support, and is in fact likely to crash when presented with one, even a gradual rollout is simply not possible. Hence every single CA you see will be valid for *. 0: https://tools.ietf.org/html/rfc5280 https://tools.ietf.org/html/rfc5280 1: https://wiki.mozilla.org/CA:NameConstraints https://wiki.mozilla.org/CA:NameConstraints

angel_j 8y ago

It would be strange if it wasn't allowed. You are the man in the middle of a headset.

deleted 8y ago

[deleted]