Report: over 4.5M network appliances, IoT devices, and embedded systems vulnerable by reusing known private keys for HTTPS and SSH servers
IoT == Immensely Obvious Threat — Millions of internet-facing devices - from home broadband routers to industrial equipment …
Context & Ripple Effects
This report scales up a problem researchers had already diagnosed at the factory floor level: a late-2015 study of 4,000 embedded devices from over 70 vendors found reused crypto keys baked into firmware, with only five vendors known to be shipping fixes (that study). What changed here is measurement — scanning the open internet turns that sample into a census of at least 4.5 million live HTTPS and SSH endpoints sharing known private keys.
The finding slots into a decade-long pattern rather than standing alone: an embedded web server flaw from 2002 left about 12M home routers exposed (the 2002-era web server bug), and researchers have since documented self-sustaining botnets built from poorly secured routers. Reused keys are the cryptographic version of the same failure — one weak default replicated millions of times.
First-order effects
- Owners of the 4.5M affected appliances — home broadband routers through industrial equipment — are exposed to traffic decryption and server impersonation by anyone holding the public key files, since the matching private keys are already known.
- Vendors whose firmware images shipped identical key pairs now face a patch-and-rekey problem on deployed hardware, the same fix-or-forget bind the 2015 vendor study showed most were not prepared for.
Second-order effects
- Botnet operators gain a ready-made target list: harvested private keys let them impersonate legitimate HTTPS and SSH servers, extending the self-sustaining router botnets already documented in related coverage.
- Enterprises buying network appliances face pressure to demand per-device key generation and signed firmware updates, shifting procurement criteria toward vendors who can prove unique credentials.
Third-order effects
- If the pattern holds, accountability moves upstream from device brands to the shared embedded software stacks they all ship — the same concentration later exposed by vulnerabilities in four open source TCP/IP stacks used across millions of devices (Amnesia:33) — making component suppliers the real security gatekeepers.
- Repeated evidence that shipped defaults fail at scale points toward regulatory minimum-security baselines for connected devices, since market forces alone left most of the 70+ studied vendors without fixes.
The trend: IoT insecurity keeps tracing back to shared code and copied defaults across vendors, pushing the industry toward supply-chain-level security mandates rather than per-device patching.