(The instructions leave out the first step, which is to ensure you’re in the Finder.) All Mac users who have ever used the HeadSetup app should manually uninstall the certificate by following Sennheiser’s instructions. Dominick created a proof-of-concept attack that created a single certificate that spoofed Google, Sennheiser, and three of Sennheiser’s competitors.Įven if you later uninstalled the app, the certificate would still be trusted. From then on, he effectively had control of a certificate authority that any computer that had installed the vulnerable Sennheiser app would trust until 2027, when the root certificate was set to expire. “It took us a few minutes to extract the passphrase from the binary,” Secorvo researcher André Domnick told Ars.
Although the self-signed certificates were blatant forgeries, they will be accepted as authentic on computers that store the poorly secured certificate root. Even worse, a forgery defense known as certificate pinning would do nothing to detect the hack.Īlthough the app encrypted the key with a passphrase, the passphrase itself (SennheiserCC) was stored in plaintext in a configuration file.
Because the key was identical for all installations of the software, hackers could use the root certificate to generate forged TLS certificates that impersonated any HTTPS website on the Internet. The critical HeadSetup vulnerability stems from a self-signed root certificate installed by version 7.3 of the app that kept the private cryptographic key in a format that could be easily extracted. On Macs, it’s known as the macOS Trust Store. In Windows, this location is called the Trusted Root CA certificate store. It does this by installing a self-signed TLS certificate in the central place an operating system reserves for storing browser-trusted certificate authority roots. Field Notice: FN - 72167 - Jabber client upgrade required if using Cisco Jabber to join Webex Meetings - Software Upgrade.
#Lync headset driver for osx update#
Desk Sign update for auto check-in/out on PC dock/undock. Update Embrava Flow configuration cause anti-virus false positive. Monaural computer headset: Mono USB headphone with microphone is ideal for users who prefer to have an open ear to hear their environment.
#Lync headset driver for osx mac os#
Wide compatible with Windows /10/XP/Vista, Mac OS X, iOS, Android mobile phone, Tablet PC. To allow Sennheiser headphones and speaker phones to work seamlessly with computers, HeadSetup establishes an encrypted Websocket with a browser. Addition of msi switches to disable Automatic and Manual update features. Business UC headset:Compatible with most of softphones,Skype for Business,Teams,Microsoft Lync,Avaya, Cisco,etc. In what has been described as a ‘monumental security blunder,’ the app allows a bad actor to successfully impersonate any secure website on the Internet … If you’ve ever used a Sennheiser headset or speakerphone device with your Mac (or Windows PC), the accompanying HeadSetup app has left your machine wide open to attack.
0 kommentar(er)
