Skip to main content

Sennheiser’s flawed headphone software opened PCs and Macs to HTTPS site spoofing

Headphone maker Sennheiser has patched its software after the company admitted a serious vulnerability that made it easy for hackers to impersonate any website — even encrypted pages.

The software, which helps Mac and Windows users to connects their headphones to other devices, also installed a self-signed root certificates with an easily obtainable private key. Because the key was stored in the operating system’s certificate store and the same key was used on every installation, it was easy for anyone to create their own certificate on a website to look like the original website — even when it isn’t.

That makes it easy for phishing, credential stealing, or spreading malware and disinformation when it looks like it’s coming from the original, legitimate source.

“The victim would have to inspect the HTTPS server certificate respectively code signing certificate in a detail level that shows the root certificate to which the certificate in question is linked,” said the report by Secorvo’s Hans-Joachim Knobloch and André Domnick, published this week.

But most people never do — they see a green padlock and assume the best.

To prove their point, the researchers created a wildcard certificate that spoofed Google’s homepage, making it look almost impossible to distinguish rom the real site.

An example of Chrome accepting the attacker’s certificate. (Image: Secorvo)

Make no mistake: this was a monumental security flaw that put every Sennheiser software user at risk. But what made matters worse is that removing the software wouldn’t remove the certificate — leaving them still vulnerable to spoofing and impersonation attacks.

“Since the certificate is not removed from the trusted root certificate store during update or removal of the software, every system on which HeadSetup 7.3 was installed at any time in the past – and every user on such a system – remains vulnerable,” said the report.

Sennheiser later issued a software update that remediated the vulnerability by updating the root store with a new certificate that omitted the private key.

Microsoft also released its own advisory this week, warning users of the inadvertently disclosed certificate and private key. The software giant updated its own certificate trust list to protect Windows users from certificate spoofing by throwing an error.

Cast your mind back to 2015 and you might remember a similar security scandal: the Superfish adware, which shipped preinstalled in Lenovo PCs.

Like Sennheiser, Superfish contained a certificate that effectively allowed the company to man-in-the-middle the user’s connection and inject ads — even when the connection is encrypted and believed to be “secure.” The key was made public, allowing anyone to take advantage of the weakness while on the same network.

Lenovo was later fined $3.5 million for the security lapse.



from TechCrunch https://ift.tt/2RoE0P0
via IFTTT

Comments

Popular posts from this blog

Apple’s AI Push: Everything We Know About Apple Intelligence So Far

Apple’s WWDC 2025 confirmed what many suspected: Apple is finally making a serious leap into artificial intelligence. Dubbed “Apple Intelligence,” the suite of AI-powered tools, enhancements, and integrations marks the company’s biggest software evolution in a decade. But unlike competitors racing to plug AI into everything, Apple is taking a slower, more deliberate approach — one rooted in privacy, on-device processing, and ecosystem synergy. If you’re wondering what Apple Intelligence actually is, how it works, and what it means for your iPhone, iPad, or Mac, you’re in the right place. This article breaks it all down.   What Is Apple Intelligence? Let’s get the terminology clear first. Apple Intelligence isn’t a product — it’s a platform. It’s not just a chatbot. It’s a system-wide integration of generative AI, machine learning, and personal context awareness, embedded across Apple’s OS platforms. Think of it as a foundational AI layer stitched into iOS 18, iPadOS 18, and m...

The Silent Revolution of On-Device AI: Why the Cloud Is No Longer King

Introduction For years, artificial intelligence has meant one thing: the cloud. Whether you’re asking ChatGPT a question, editing a photo with AI tools, or getting recommendations on Netflix — those decisions happen on distant servers, not your device. But that’s changing. Thanks to major advances in silicon, model compression, and memory architecture, AI is quietly migrating from giant data centres to the palm of your hand. Your phone, your laptop, your smartwatch — all are becoming AI engines in their own right. It’s a shift that redefines not just how AI works, but who controls it, how private it is, and what it can do for you. This article explores the rise of on-device AI — how it works, why it matters, and why the cloud’s days as the centre of the AI universe might be numbered. What Is On-Device AI? On-device AI refers to machine learning models that run locally on your smartphone, tablet, laptop, or edge device — without needing constant access to the cloud. In practi...

Max Q: Psyche(d)

In this issue: SpaceX launches NASA asteroid mission, news from Relativity Space and more. © 2023 TechCrunch. All rights reserved. For personal use only. from TechCrunch https://ift.tt/h6Kjrde via IFTTT