Posted on

Security certificates broken on Google Chrome 41

Don’t install the latest release of Google Chrome (41), released on Thursday (Friday UK time). They’ve messed up. Twice.

Broken SSL when talking to routers etc.

The first problem comes when accessing the web interface on a device such as a router over SSL (encrypted). Unfortunately, because the software in theses is embedded, the security certificate it uses isn’t going to match the name of the device you use to access it. This would be impossible – when it leaves the factory it hasn’t had its IP address assigned on your site; never mind the DNS entry. Previously browsers have allowed you to ignore this mis-match; the encryption works as long as you’re comfortable that you’re really talking what you think you are using some other check, and once the exception has been stored, this should be the end of the matter.

But not with Chrome release 41. Now it will show you the screen below:

ChromeMessedUp

If you ask for more details it doesn’t really give you much:

A secure connection cannot be established because this site uses an unsupported protocol.
Error code: ERR_SSL_VERSION_OR_CIPHER_MISMATCH
This comes from a DrayTek 2820 modem/router, but the problem seems to exist on other networking kit.

More adverts too – and a malware backdoor

(Please see update below – there may be an innocent explanation for this)
As an extra surprise, those nice people seem to have found a way of blocking URL keyword filters used to keep adverts out from objectionable sources, circumventing methods of blocking Google’s syndicated advertising. I’m still researching this, but the way they appear to have done it means that embedded content from other sources than the site you’re looking at is extremely difficult to block.
It appears Google has done this to protect its revenue stream from adverts, with little regard from the site policies that may exist for reasons Google may not realise. But that’s not the worst of it: how long will it be before this feature of Chrome is used for drive-by downloads. If you’re firewall isn’t able to cross-check the source of the content on a page, it can be coming from anywhere.
Unfortunately there is no way of rolling back a bad version of Chrome. They really don’t like you doing that, however dangerous a release might be.
I have, of course, made urgent representations to the Chrome project but we will have to wait and see. In the mean time, all I can suggest is that you prevent Chrome from updating beyond version 40.

Update 2015-03-23
On further investigation, the updated Chrome isn’t doing a DNS lookup to find the Google ad-server. I’m unsure whether this is because it somehow cached the DNS results internally or whether its hard-wired. It certainly wasn’t using the system cache, but I know Chrome has kept its own cache in the past. If it is from an internal cache, the mechanism used to get the IP address in there in the first place is a mystery, however Google’s ad servers change from time to time and it’s not impossible that the perimeter firewall simply hadn’t kept up and allowed some through.

My next research will be looking more closely at the DNS traffic.

Posted on

VoIP socket pinout on newer Draytek routers (2820Vn etc)

I’ve just spent over a day trying to get this piece of information out of Draytek, so appreciate it!

On the newer Draytek routers with VoIP capabilities (Vigor 2820 and some of the later ones) you no longer connect the handset (or PABX) to a standard RJ11. Instead both analogue lines come out on a single RJ11/RJ12, and you get an adapter so you can plug two standard BT handsets in to it. I assume this only applies to UK models. Anyway, if you’re wiring to a PABX, BT jacks are a complete pain in the rear, so if you want to connect an RJ11 to a twin-pair cable and go directly to a krone block the pin-out is (officially):

  • Line 1 – pins 2 and 5 (centre two)
  • Line 2 – pins 3 and 4 (one out from centre, or outer on RJ11)

That is to say the middle two pins and the two straddling – and numbering as if it was an RJ12 with six positions, even though the contacts may be missing from an RJ11. Heck, if you don’t know how to number an RJ12 you’re probably better off with the BT jacks.

This is logical and probably most telecoms people’s first guess, but it’s nice not to have to go for trial an error or smash their adapter apart (assuming you can’t connect an AVO into a BT-style socket conveniently).

For what it’s worth, I’ve been using Draytek VoIP kit for about eight years now – some of the best going in the market it serves, and I’ve got rather a lot to compare with. It’s a pity the company is so hard to get hold of for technical support as they won’t answer a general question straddling the product range – only individual serial-numbered units. Therefore I can’t get a list of kit for which this applies – I need to ask them one at a time giving the serial number of an extant unit. I suspect they don’t want too many dumb questions swamping them, but not  so brilliant for professional users though – if it’s not in their FAQ you’re left to trial-and-error.