Bambu private keys leaked less than 24 hours after announcement: Difference between revisions

In January 2025, [[Bambu Lab|'''Bambu Lab''']] introduced an authorization control system<ref>[https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/? https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/?]</ref> for its X1-series 3D printers, aiming to enhance security by restricting critical operations to authorized applications, notably their own "Bambu Connect" app. As part of this change, certificate files and private keys responsible for decrypting communications were stored in the code of the updated software files.

Shortly after this implementation, security researcher [hWuxH] successfully extracted the X.509 certificate and private key from the Bambu Connect application. The application, built on the Electron framework, employed obfuscation techniques to protect its code. However, these measures proved insufficient, allowing the de-obfuscation of the main.js file and the exposure of sensitive cryptographic materials.<ref>https://hackaday.com/2025/01/19/bambu-connects-authentication-x-509-certificate-and-private-key-extracted/</ref>