Xavi Torelló XaviTorello

Netgear Signed TLS Cert Private Key Disclosure

Overview

There are at least two valid, signed TLS certificates that are bundled with publicly available Netgear device firmware.

These certificates are trusted by browsers on all platforms, but will surely be added to revocation lists shortly.

The firmware images that contained these certificates along with their private keys were publicly available for download through Netgear's support website, without authentication; thus anyone in the world could have retrieved these keys.

Netgear Signed TLS Cert Private Key Disclosure

Overview

There are at least two valid, signed TLS certificates that are bundled with publicly available Netgear device firmware.

These certificates are trusted by browsers on all platforms, but will surely be added to revocation lists shortly.

The firmware images that contained these certificates along with their private keys were publicly available for download through Netgear's support website, without authentication; thus anyone in the world could have retrieved these keys.

People

`:bowtie:`	😄 `:smile:`	😆 `:laughing:`
😊 `:blush:`	😃 `:smiley:`	☺️ `:relaxed:`
😏 `:smirk:`	😍 `:heart_eyes:`	😘 `:kissing_heart:`
😚 `:kissing_closed_eyes:`	😳 `:flushed:`	😌 `:relieved:`
😆 `:satisfied:`	😁 `:grin:`	😉 `:wink:`
😜 `:stuck_out_tongue_winking_eye:`	😝 `:stuck_out_tongue_closed_eyes:`	😀 `:grinning:`
😗 `:kissing:`	😙 `:kissing_smiling_eyes:`	😛 `:stuck_out_tongue:`

Keybase proof

I hereby claim:

I am xavitorello on github.
I am xtorello (https://keybase.io/xtorello) on keybase.
I have a public key ASDqpO5xyWojXc4VPj3DdwaOGDVsHShZb2aHuI8c2141cgo

To claim this, I am signing this object:

	# file: an_app/backends.py

	from social_core.backends.apple import AppleIdAuth

	"""
	It provides 2 backends that extends the AppleID base auth

	Useful to be able to define different configs depending on the singin scenario

	The name will be used to fetch concrete settings and link it at the `provider` field (or the `/jwt-pair/$name` URI)

	{
	"$schema": "https://vega.github.io/schema/vega-lite/v3.json",
	"width": 360,
	"data": {
	"url": "https://code.gisce.net/empowering.js/cch.json",
	"name": "source",
	"format": {"type": "json"}
	},
	"selection": {
	"a": {

	# -- coding: utf-8 --
	"""
	A replacement transport for Python xmlrpc library.

	Usage:

	>>> import xmlrpclib
	>>> from transport import RequestsTransport
	>>> s = xmlrpclib.ServerProxy('http://yoursite.com/xmlrpc', transport=RequestsTransport())
	>>> s.demo.sayHello()

	Byobu Commands
	==============

	byobu Screen manager


	Level 0 Commands (Quick Start)
	------------------------------

	<F2> Create a new window

	#!/bin/sh
	## Patch network hibernation issues
	## Save it in /usr/lib/systemd/system-sleep
	## Thanks to nivenly.com/surface-hib.sh

	case $1/$2 in
	pre/hibernate)
	netctl stop $(netctl list \|grep "wlp1s0-[a-zA-Z0-9]\+" -o)

	echo "Going to $2..."

	// It uses zone.csv from https://timezonedb.com/download

	// A dummy `lol` zone has been attached to confirm that all requested zones are tested.
	for (var tz of ["Europe/Andorra", "Asia/Dubai", "Asia/Kabul", "America/Antigua", "America/Anguilla", "Europe/Tirane", "Asia/Yerevan", "Africa/Luanda", "Antarctica/McMurdo", "Antarctica/Casey", "Antarctica/Davis", "Antarctica/DumontDUrville", "Antarctica/Mawson", "Antarctica/Palmer", "Antarctica/Rothera", "Antarctica/Syowa", "Antarctica/Troll", "Antarctica/Vostok", "America/Argentina/Buenos_Aires", "America/Argentina/Cordoba", "America/Argentina/Salta", "America/Argentina/Jujuy", "America/Argentina/Tucuman", "America/Argentina/Catamarca", "America/Argentina/La_Rioja", "America/Argentina/San_Juan", "America/Argentina/Mendoza", "America/Argentina/San_Luis", "America/Argentina/Rio_Gallegos", "America/Argentina/Ushuaia", "Pacific/Pago_Pago", "Europe/Vienna", "Australia/Lord_Howe", "Antarctica/Macquarie", "Australia/Hobart", "Australia/Currie", "Australia/Melbourne", "Aus