Private Keys in Public Places
Tom Pohl uncovers hardcoded private keys, certificates, and static AES encryption keys across Netgear, Fortinet, and Dell firmware, enabling universal vCenter compromise.
Summary
Hardcoded Secrets Across Commercial Firmware
Despite decades of security best practices, enterprise firmware and software binaries continue to ship with embedded private keys, CA certificates, and static cryptographic secrets.
Extracting PEM Keys and Obfuscated Fortinet Archives
Tom Pohl demonstrates automated discovery techniques for extracting PEM keys from Netgear routers and unpacking custom obfuscated firmware archives in Fortinet enterprise firewalls.
Universal vCenter Decryption in Dell Enterprise Software
Dissecting Dell software revealed a hardcoded static AES encryption key used to encrypt VMware vCenter administrator credentials, allowing universal credential decryption across all customer deployments.
Fixing Systemic Key Management Failures
Pohl emphasizes the necessity of automated static binary secret scanning in CI/CD pipelines, proper hardware security modules (HSMs), and eliminating hardcoded cryptographic trust.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.
Main Stage·42 min
Mark Omo · James Rowley
Reverse engineers electronic gun safes and commercial digital vaults, demonstrating effortless physical and electromagnetic bypasses across leading brands.