DEF CON 33 - One Key, Two Key, I Just Stole Your goTenna Key - Erwin 'Dollarhyde' Karincic, Woody

A critical vulnerability in Goenna Pro mesh radios allows unauthenticated remote key updates, enabling full man-in-the-middle attacks with undetectable tampering 3:37.

Key Takeaways:
• The vulnerability allows attackers to remotely update public keys without authentication, enabling full message interception and manipulation 3:37.
• Attackers can spoof identities, change GPS coordinates, and inject false messages—such as redirecting emergency locations—without users’ knowledge 18:42.
• The attack can be fully reversed, allowing attackers to restore communication and fool users into believing no compromise occurred 31:40.
• The vulnerability stems from a lack of key authentication in the device’s key exchange protocol, despite using ECDH encryption 9:01.

This vulnerability highlights the need for robust key authentication, real-time key verification, and operational protocols to detect and prevent unauthorized key updates—especially in mission-critical communications.

Sources:

• 3:37 Detailed explanation of unauthenticated key update and man-in-the-middle attack.
• 18:42 Demonstration of GPS coordinate spoofing in emergency scenarios.
• 31:40 Full attack reversal and undetectable communication takeover.
• 9:01 Technical breakdown of the elliptic curve key exchange implementation flaw.