Repeatable Failures: Test Keys Used to Sign Production Software…Again?

After discovering PKFail, the Binarly REsearch team went on the hunt for other instances of non-production test keys being used in firmware binaries. In this case, non-production test keys were originally generated by reference implementation vendors sitting at the top of the supply chain and then propagated to downstream vendors which often failed to replace them.