- After Apple’s guidance revision, time to focus on enterprise
- Apple Brazenly Mocks Tech Rivals With Huge Billboard Touting Privacy At CES 2019
- Apple’s T2 Security Chip Confirmed To Slap Handcuffs On Some Third-Party Repairs
- One Reason Apple Got Cozy With Amazon Is About Killing Off Refurbs On Consumers
- Apple’s New MacBook Pro Keyboard Has ‘Thin, Silicone Barrier’ Under Each Key: iFixit
- Notifications are broken. Here’s how Apple and Google can fix them.
- SNAKABLE ARMORED APPLE MFI LIGHTNING CABLE REVIEW: LIKE APPLE’S LIGHTNING CABLE ON STEROIDS
- ALPHA AUDIOTRONICS SKYBUDS REVIEW: A FRUSTRATING PAIR OF TRUE WIRELESS EARBUDS
- REVIEW: THE IPHONE X IS THE BEST PHONE FOR BUSINESS, PERIOD.
- IMOVIE 10 REVIEW: FREE VIDEO EDITING THAT’S ELEGANT AND EASY
PSA: If you’ve ever used a Sennheiser headset with your Mac, it is wide open to attack
If you’ve ever used a Sennheiser headset or speakerphone device with your Mac (or Windows PC), the accompanying HeadSetup app has left your machine wide open to attack.
In what has been described as a ‘monumental security blunder,’ the app allows a bad actor to successfully impersonate any secure website on the Internet …
To allow Sennheiser headphones and speaker phones to work seamlessly with computers, HeadSetup establishes an encrypted Websocket with a browser. It does this by installing a self-signed TLS certificate in the central place an operating system reserves for storing browser-trusted certificate authority roots. In Windows, this location is called the Trusted Root CA certificate store. On Macs, it’s known as the macOS Trust Store.
The critical HeadSetup vulnerability stems from a self-signed root certificate installed by version 7.3 of the app that kept the private cryptographic key in a format that could be easily extracted. Because the key was identical for all installations of the software, hackers could use the root certificate to generate forged TLS certificates that impersonated any HTTPS website on the Internet. Although the self-signed certificates were blatant forgeries, they will be accepted as authentic on computers that store the poorly secured certificate root. Even worse, a forgery defense known as certificate pinning would do nothing to detect the hack.
Although the app encrypted the key with a passphrase, the passphrase itself (SennheiserCC) was stored in plaintext in a configuration file.
“It took us a few minutes to extract the passphrase from the binary,” Secorvo researcher André Domnick told Ars. From then on, he effectively had control of a certificate authority that any computer that had installed the vulnerable Sennheiser app would trust until 2027, when the root certificate was set to expire. Dominick created a proof-of-concept attack that created a single certificate […] that spoofed Google, Sennheiser, and three of Sennheiser’s competitors.
Even if you later uninstalled the app, the certificate would still be trusted. All Mac users who have ever used the HeadSetup app should manually uninstall the certificate by following Sennheiser’s instructions. (The instructions leave out the first step, which is to ensure you’re in the Finder.)
If you still use the app, you can download the latest version of HeadSet, which should also delete the vulnerable certificate, but the safest option would be to do it manually as above first.