How in the fuck do you even coax software into using a key like that? Did someone just say “yeah just use the smallest size possible, that’ll be okay” and then just like not care?
In an email, a GivEnergy representative reinforced Castellucci’s assessment, writing:
In this case, the problematic encryption approach was picked up via a 3rd party library many years ago, when we were a tiny startup company with only 2, fairly junior software developers & limited experience. Their assumption at the time was that because this encryption was available within the library, it was safe to use. This approach was passed through the intervening years and this part of the codebase was not changed significantly since implementation (so hadn't passed through the review of the more experienced team we now have in place).
So, it sounds like they don’t have regular security audits, because that’s something that would absolutely get flagged by any halfway competent sec team.
How in the fuck do you even coax software into using a key like that? Did someone just say “yeah just use the smallest size possible, that’ll be okay” and then just like not care?
From the article:
In an email, a GivEnergy representative reinforced Castellucci’s assessment, writing:
So, it sounds like they don’t have regular security audits, because that’s something that would absolutely get flagged by any halfway competent sec team.
No need for audits. It’s only critical infrastructure embedded into tens of thousands of homes, lol.
Yet another reminder that trust should be earned.