A crypto key turned out to be the number 4, and Yandex had to rescue its speakers
Absurdly weak keys at a third party certificate authority let enthusiasts root their Yandex Stations, and Yandex rushed an update to millions of devices.
Yandex has explained why millions of its Station smart speakers quietly got an unscheduled update in late October. Between October 21 and 23 the company pushed new firmware to every active speaker and to the vast majority of partner TVs running YaOS. Owners didn't have to do anything, it installed on its own.
The root of the problem sits outside Yandex, at the Indian certificate authority eMudhra. The private keys of eight of its intermediate CAs turned out to be tiny numbers below 256. One of them was literally the number 4. Trying every value from 1 to 255 finds a match in under a second. eMudhra revoked those certificates on October 18, and Google pulled trust in them from Chrome and Android.
Yandex speakers trusted those certificates. With such a key you can pose as the company's server and feed a Station your own configuration. Enthusiasts did exactly that on their own speakers: they swapped the settings, switched on the ADB debugging interface and got full root access.
Hitting someone else's speaker takes more, an attacker first has to control its network traffic, for example by hacking the home router. Still, in theory the hole allowed intercepting data and attacking other devices on the local network, so Yandex didn't wait.
The update removes trust in the compromised certificates, overwrites the vulnerable system files and shuts ADB access. One catch: a full factory reset brings back the old, vulnerable firmware until the next update arrives. Yandex advises against resetting a speaker without a real reason.
Millions of smart speakers had to be rescued because of someone else's key that can be guessed faster than you finished reading this sentence.