'Critical' flaw in apps for Sennheiser headphones allows certificate access

The mistake means that hackers could decrypt the key and use the certificate, a means of digital authentication, to monitor victims’ traffic and launch main-in-the-middle attacks.

Two applications developed by German electronics company Sennheiser contain vulnerabilities that could make it possible for hackers to forge digital certificates and impersonate legitimate websites.

Sennheiser’s two apps, HeadSetup and HeadSetup Pro, installed certificates on users’ computers then failed to secure the key, according to a vulnerability report published Wednesday by the German security consulting firm Secorvo. The mistake means that hackers could decrypt the key and use the certificate, a means of digital authentication, to monitor victims’ traffic and launch main-in-the-middle attacks.

“We found — caused by a critical implementation flaw — the secret signing key of one of the clandestine planted root certificates can be easily obtained by an attacker,” the Secorvo report states. “This allows him or her to sign up and issue technically trustworthy certificates. Users affected by this implementation bug can become victim of such a certificate forgery, allowing an attacker to send e.g. trustworthy signed software or acting as an authority authorised by Sennheiser.”

Sennheiser said this month it is aware of the issue and has removed the two apps from its available downloads while it works on a fix. Microsoft also published a security advisory Wednesday, warning customers to update their HeadSetup and HeadSetup Pro software.

The flaws bear some similarity to vulnerabilities previously uncovered in Lenovo and Dell products.

Lenovo’s so-called Superfish software came pre-installed on consumer laptops, injecting advertisements into search results and hijacking encrypted SSL/TLS web connections on user machines. The revelation that the company put so many users at risk sparked outrage in the security community. “Installing Superfish is one of the most irresponsible mistakes an established tech company has ever made,” wrote David Auerbach, a Slate technology columnist, in 2015.

Dell in 2015 disclosed an unintended security vulnerability existed in its computers. That flaw, known as eDellRoot, also made it possible for attackers to use root access to create valid certificates for malicious websites.

Russia to create its own security certificate authority, alarming experts

Security experts worry that Russia is opening the door to mass surveillance and disinformation.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure