Key points
- A self-signed Danger Developer Program certificate contained a 512-bit RSA key trusted across Hiptop 1 through Sidekick 3.
- CADO-NFS factored the key in about 8.5 hours using 220 CPU cores across seven machines, consuming roughly 1,175 core-hours.
- A signing program created with the recovered private key reproduced an official Danger file byte for byte.
Context
The developer-key application closed in 2010, and its servers were shut down in 2011, yet the trust certificate remained embedded in factory firmware. The case illustrates how long-lived embedded devices can retain obsolete cryptographic roots and signing workflows long after the surrounding infrastructure disappears.
What this means for you
Directly applicable
You can use this case as a model for checking whether legacy firmware still contains obsolete certificates, weak keys, or retired signing dependencies.
Who benefits: Developers and technical decision-makers responsible for long-lived embedded systems benefit from a concrete warning about weak keys and obsolete trust anchors.
Share article: