Tens of thousands of home routers at risk with duplicate SSH keys

A setup mistake has apparently left hundreds of thousands of home routers running the SSH (Secure Shell) remote access tool with identical private and public keys.

John Matherly used Shodan, a specialized search engine for querying Internet-connected devices, and found more than 250,000 devices that appear to be deployed by Telefónica de España sharing the same public SSH key.

Matherly, who founded Shodan, performed the search after someone posted a shorter version of a public key—called a fingerprint—for their device.

He was surprised to find more than 250,000 other devices, mostly in Spain, that shared the same public key fingerprint. It means the devices—which are likely home routers—also have the same private key, which could pose a security risk.

To read this article in full or to leave a comment, please click here