4

There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices.

For example, this fingerprint is common across over 250,000 devices worldwide:

dc:14:de:8e:d7:c1:15:43:23:82:25:81:d2:59:e8:c0

And this fingerprint is common across over 11,000 devices across the UK:

7c:a8:25:21:13:a2:eb:00:a6:c1:76:ca:6b:48:6e:bf

This obviously presents issues in authenticating which device you are connecting to over SSH, but what other real-world implications are there in having a common fingerprint (and hence, common public key) across so many devices?

Improve this question

2 Answers 2

Reset to default
4

First it means that there is no way to authenticate a given machine using this key. Since they all share the same key, signed content can come from any of them.

Second, if the private key happens to be broken, you can impersonate 250'000 devices at once.

Improve this answer
4
  • And you can probably break the private key if you buy one of these devices.
    – user253751
    Sep 12, 2017 at 1:48
  • Well, unless you buy the machine with all the data on it (in which case you already have the key), you won't have anything to break.
    – M'vy
    Sep 12, 2017 at 7:25
  • Incorrect. If they all have the same key, you can buy one with the private key stored on it (because they all have the same key). Then you extract the key from it. Then you have the key for all the other devices of that type.
    – user253751
    Sep 12, 2017 at 22:38
  • That's exactly what I am saying. You probably won't have to break anything, unless the key is password protected, but that won't hold long anyway.
    – M'vy
    Sep 12, 2017 at 22:56
-1

This strikes me as odd, there must be something wrong with the implementation for generating these fingerprints, as and odd and scary coincidence i read this question (and corresponding answer) this morning. And i can't seem to find a flaw in the math so based on that i'd say either someone made a big mistake or puts on tinfoil hat the NSA had a big say in the generation of that fingerprint.

Of course complete random should be able to do this, but the odds.. the odds they're just ... improbable (I want a stronger word but that would make it impossible which it obviously isn't)

This, as you know of course, is a problem because if everyone has the same key it's useless. this would have so many horrible complications for the public key systems we are using today. If this is not some bad implementation but an actual outcome we can kiss our secure systems goodbye (exaggeration, but it would be bad).

Improve this answer
2
  • 4
    It's likely because all the devices use the same firmware image and there is no process to generate unique keys at first boot.
    – Cybergibbons
    Feb 24, 2015 at 12:27
  • 1
    Ye next time i should read the article instead of just the first paragraph, sorry. But yes like i said bad implementation.
    – Vincent
    Feb 24, 2015 at 12:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .