For those of you who have not gotten the news yet: The eMudhra intermediate CAs private key was leaked (they literally used the number "4"). As a consequence, everyone can issue certificates for websites and servers that appear to be valid to unpatched devices.
I was wondering whether we can use this to our advantage. Imagine you have a cheap WiFi light bulb that receives its command from some proprietary app through some server.
We redirect the domain of the server, i.e. random-company.com to a local server through DNS.
Before, the light bulb would not connect to our local server, because no one would issue a valid certificate for random-company.com for us. But now, we could in theory use the leaked private key of eMudhra to issue such a certificate ourselves. Of course, this only works if the light bulbs firmware is not updated to reject certificates issued by the untrustworthy CA.
I suspect that we could use this to turn many cloud only integrations into fully local ones, as long as the devices are not updated (or implement proper certificate revelation lists).
What are your thoughts on this? Any device you have in mind for which this could work out?
Source: r/homeassistant · by /u/Brainiak42