33
Critical Meshtastic Flaw Allows Attackers to Decrypt Private Messages (gbhackers.com)
submitted 1 year ago by to c/meshtastic@mander.xyz
1 comment fedilink hide all child comments
 

Meshtastic developers released firmware version 2.6.11 with critical fixes:

Key generation delay: Keys are now generated when users first set their LoRa region, preventing vendor-side duplication. Entropy improvements: Added multiple randomness sources to strengthen cryptographic initialization. Compromised key detection: Devices now warn users if known vulnerable keys are detected. An upcoming version (2.6.12) will automatically wipe compromised keys. For immediate protection, users should:

Update devices to firmware 2.6.11 or later. Perform a factory reset using Meshtastic’s CLI: meshtastic –factory-reset-device. Manually generate high-entropy keys via OpenSSL for critical deployments.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 year ago

Meshtastic developers released firmware version 2.6.11 with critical fixes:

Key generation delay: Keys are now generated when users first set their LoRa region, preventing vendor-side duplication.

Entropy improvements: Added multiple randomness sources to strengthen cryptographic initialization.

Compromised key detection: Devices now warn users if known vulnerable keys are detected.

An upcoming version (2.6.12) will automatically wipe compromised keys. For immediate protection, users should:

Update devices to firmware 2.6.11 or later.

Perform a factory reset using Meshtastic’s CLI: meshtastic –factory-reset-device.

Manually generate high-entropy keys via OpenSSL for critical deployments.

  • permalink
  • fedilink
  • source
    •