Microsoft has issued a security advisory today warning that two applications accidentally installed two root certificates on users’ computers, and then leaked the private keys for all.

The software developer’s mistake means that malicious third-parties can extract the private keys from the two applications and use them to issue forged certificates to spoof legitimate websites and software publishers for years to come.

The two applications are HeadSetup and HeadSetup Pro, both developed by German software developer Sennheiser. The software is used to set up and manage softphones –software apps for making telephone calls via the Internet and a computer, without needing an actual physical telephone.

The issue with the two HeadSetup apps came to light earlier this year when German cyber-security firm Secorvo found that versions 7.3, 7.4, and 8.0 installed two root Certification Authority (CA) certificates into the Windows Trusted Root Certificate Store of users’ computers but also included the private keys for all in the SennComCCKey.pem file.

In a report published today, Secorvo researchers published proof-of-concept code showing how trivial would be for an attacker to analyze the installers for both apps and extract the private keys.

Making matters worse, the certificates are also installed for Mac users, via HeadSetup macOS app versions, and they aren’t removed from the operating system’s Trusted Root Certificate Store during current HeadSetup updates or uninstall operations.

In researchers’ own words “every system on which HeadSetup […] was installed at any time in the past […] remains vulnerable” until users manually review the Trusted Root Certificate Store and remove the two certificates, or until the certificates expire –which could be January 13, 2027, or July 27, 2037, respectively.

Sennheiser, the software vendor behind the snafu, has admitted its mistake and removed the two apps from its website’s download section while they’re working on an update that’s scheduled for release later this week.

The company says this HeadSetup will search and remove the root certificates from affected systems, and replace them with new ones that don’t leak their respective private keys.

Customers who have installed Sennheiser HeadSetup software should update their apps when the updates become available. Users who have not installed Sennheiser HeadSetup software don’t have to take any action, but they’re still vulnerable to attacks.

In the meantime, Microsoft has updated the company’s Certificate Trust List (CTL) to remove user-mode trust in the three certificates. This means that websites or software signed with forged certificates generated using the three offending root certificates will trigger an error for Windows users.

Users or system administrators who can’t afford to wait until Sennheiser releases a HeadSetup update that removes the offending certificates can check the Secorvo report, section 7.2, for instructions on how to manually remove the certificates from the Windows Trusted Root Certificate Store. Sennheiser has also published guides on removing the three certificates for Windows and macOS users.

Sennheiser’s snafu, tracked as CVE-2018-17612, is not the first of its kind. In 2015, Lenovo shipped laptops with a certificate that exposed its private key in a scandal that became known as Superfish. Dell did the exact same thing in 2016 in a similarly bad security incident that became known as eDellRoot.


36 Comments

tinyurl.com · November 23, 2019 at 10:47 pm

I know this if off topic but I’m looking into
starting my own blog and was wondering what
all is needed to get set up? I’m assuming having a blog
like yours would cost a pretty penny? I’m not very internet savvy so I’m not 100% sure.
Any suggestions or advice would be greatly appreciated.
Thank you

tinyurl.com · November 24, 2019 at 10:19 am

Greetings! Very useful advice in this particular article!

It’s the little changes which will make the most significant changes.
Thanks for sharing!

tinyurl.com · November 24, 2019 at 10:26 am

It’s amazing to visit this site and reading the views of all colleagues concerning this post, while I am also keen of getting know-how.

plenty of fish dating site · November 26, 2019 at 4:58 pm

What’s up friends, pleasant paragraph and
fastidious urging commented here, I am really enjoying by these.

ps4 games · November 28, 2019 at 8:01 pm

It’s very effortless to find out any matter on net as compared
to books, as I found this article at this web site.

ps4 games · November 29, 2019 at 5:29 am

Hi, i read your blog occasionally and i own a similar
one and i was just curious if you get a lot of spam comments?

If so how do you stop it, any plugin or anything you can suggest?
I get so much lately it’s driving me mad so any assistance is very
much appreciated.

quest bars cheap · December 1, 2019 at 10:08 am

Pretty! This was a really wonderful post. Thanks for supplying this info.

quest bars cheap · December 2, 2019 at 5:29 am

This is my first time go to see at here and i am in fact happy to read
all at alone place.

quest bars cheap coupon twitter · December 3, 2019 at 5:54 am

Hey there! Do you use Twitter? I’d like to follow you if
that would be okay. I’m undoubtedly enjoying your blog and look forward to new posts.

ps4 games · December 4, 2019 at 9:08 pm

Awesome blog! Do you have any suggestions for aspiring writers?
I’m planning to start my own site soon but
I’m a little lost on everything. Would you suggest starting with a
free platform like WordPress or go for a paid option? There are so many choices out there that I’m totally overwhelmed
.. Any ideas? Many thanks!

ps4 games · December 6, 2019 at 8:22 am

What’s up, I read your new stuff regularly.
Your humoristic style is witty, keep doing what you’re doing!

quest bars cheap · December 7, 2019 at 1:23 pm

What i do not realize is if truth be told how you’re no longer
actually much more well-liked than you may be right now.
You’re very intelligent. You understand therefore considerably
in relation to this subject, produced me for my part consider it from a lot of numerous angles.
Its like men and women don’t seem to be interested unless it is one thing to do with Girl
gaga! Your personal stuffs outstanding. At all times care for
it up!

quest bars cheap · December 9, 2019 at 7:38 am

Hi, its nice post concerning media print,
we all understand media is a fantastic source of data.

quest bars cheap · December 9, 2019 at 6:55 pm

It is perfect time to make a few plans for the long run and
it’s time to be happy. I’ve learn this publish and if I may just I desire to
recommend you some attention-grabbing things or tips. Maybe you can write
subsequent articles relating to this article. I want to learn even more things approximately
it!

ps4 games · December 11, 2019 at 3:08 am

Howdy I am so excited I found your weblog, I really found you by accident, while I was
looking on Yahoo for something else, Nonetheless
I am here now and would just like to say thanks for a marvelous
post and a all round interesting blog (I also love
the theme/design), I don’t have time to read through it all at the moment but I have saved it and also added in your RSS feeds, so when I have time I will be back
to read a great deal more, Please do keep up the superb work.

ps4 games · December 11, 2019 at 5:58 pm

Thanks very interesting blog!

ps4 games · December 12, 2019 at 8:38 pm

Fantastic items from you, man. I’ve bear
in mind your stuff previous to and you’re just too magnificent.
I really like what you’ve bought right here, certainly
like what you are saying and the way wherein you say it.
You make it enjoyable and you continue to care for to keep
it smart. I cant wait to read far more from you.
That is really a tremendous website.

ps4 games · December 13, 2019 at 12:33 am

It’s really very complicated in this busy life
to listen news on TV, so I just use world wide web for that reason, and take the latest information.

ps4 games · December 15, 2019 at 2:37 am

hey there and thank you for your info – I have definitely picked up anything new from right here.
I did however expertise several technical issues using this web site, as I experienced to reload the site a lot of times
previous to I could get it to load correctly. I had been wondering if your hosting is OK?
Not that I am complaining, but slow loading instances times will sometimes affect
your placement in google and could damage your high-quality score if advertising and marketing
with Adwords. Anyway I am adding this RSS to my email and can look out
for much more of your respective fascinating content.
Ensure that you update this again very soon.

coconut oil · December 15, 2019 at 11:07 pm

It’s amazing to go to see this website and reading the views of all mates regarding
this post, while I am also zealous of getting knowledge.

coconut oil · December 16, 2019 at 10:04 pm

I really like reading through a post that can make people think.
Also, many thanks for permitting me to comment!

coconut oil · December 17, 2019 at 11:50 pm

Hello everyone, it’s my first go to see at this web site, and article
is actually fruitful in support of me, keep
up posting these articles or reviews.

coconut oil · December 21, 2019 at 10:49 am

I quite like looking through a post that can make men and women think.
Also, thanks for permitting me to comment!

match.com free trial · December 28, 2019 at 11:52 pm

Spot on with this write-up, I honestly feel this web site needs much more attention. I’ll probably be returning
to read through more, thanks for the advice!

match.com free trial · December 29, 2019 at 7:41 pm

I pay a quick visit each day a few sites and sites to read
articles, except this website gives feature based writing.

plenty of fish vs match.com free trial · December 30, 2019 at 8:51 am

Someone necessarily assist to make severely articles I might
state. This is the very first time I frequented your web page and so far?
I surprised with the analysis you made to create this actual post
amazing. Wonderful job!

match.com free trial · December 30, 2019 at 6:53 pm

I go to see every day a few sites and websites
to read articles, however this weblog presents quality based articles.

sling tv · January 1, 2020 at 12:53 pm

You can certainly see your skills within the work you write.
The arena hopes for even more passionate writers like you
who are not afraid to say how they believe. All the time follow
your heart.

sling tv · January 2, 2020 at 12:44 pm

Hi to all, since I am in fact eager of reading this web site’s post to be updated on a regular basis.
It consists of pleasant material.

sling tv · January 7, 2020 at 1:22 am

Undeniably consider that which you said. Your favorite justification appeared to be on the net the easiest thing
to consider of. I say to you, I definitely get annoyed whilst people think about concerns that they just do not understand about.
You managed to hit the nail upon the highest and also outlined out the whole
thing with no need side-effects , people can take a signal.
Will likely be back to get more. Thanks

sling tv · January 14, 2020 at 3:53 am

Hey there! I know this is kind of off topic but I was wondering if you
knew where I could find a captcha plugin for my comment form?
I’m using the same blog platform as yours and I’m having trouble finding one?
Thanks a lot!

sling tv · January 14, 2020 at 1:47 pm

Nice post. I was checking continuously this blog and I am impressed!
Extremely helpful info specially the last part 🙂
I care for such information a lot. I was looking for this particular information for a long time.

Thank you and best of luck.

sling tv · January 17, 2020 at 2:12 am

Fantastic beat ! I would like to apprentice while you amend your site, how
can i subscribe for a blog web site? The account aided me a acceptable deal.
I had been a little bit acquainted of this your broadcast provided bright
clear concept

sling tv · January 18, 2020 at 1:59 pm

Oh my goodness! Incredible article dude! Thank you so much, However I am encountering difficulties with your RSS.
I don’t know the reason why I cannot subscribe to it.
Is there anyone else getting similar RSS issues? Anyone
that knows the solution can you kindly respond? Thanks!!

cenforce 50 for sale · January 20, 2020 at 3:22 pm

short tension [url=http://cavalrymenforromney.com/#]cenforce 50 for sale[/url] flat cookie proper sock cenforce 100mg pills always boy cenforce 50 for sale carefully
chicken http://cavalrymenforromney.com/

sling tv best package 2020 · January 24, 2020 at 9:04 pm

I’ve been surfing on-line more than 3 hours lately,
but I by no means found any fascinating article like yours.

It’s lovely worth sufficient for me. Personally, if all web owners and bloggers made good content as you did,
the internet will likely be much more helpful than ever before.

Leave a Reply

Your email address will not be published.

error: Content is protected !!!