Sensor certificate Private Key exposed in plain text in the sensor logs

Products

• Carbon Black EDR

Issue/Introduction

The sensor certificate Private Key is in plain text in the sensor logs and not hashed or obfuscated.

Environment

• Carbon Black EDR Sensor: All Versions

Resolution

This is a Product Management design decision and the key is (and always has been) also stored in the registry, which requires the same privileges to access. 

Additional Information

•  Accessing the sensor.log file requires Local Administrator privileges
• This would be a security hole if an admin-level user was able to do something by having the key which would not be possible without the key. This key allows the sensor to be securely and positively identified by the server so that it can check in and send event logs/binaries. 
• The server's private key is not stored, so the compromise of one computer running a sensor will not lead to the compromise of other computers running sensors. 
• Customers sometimes encounter comms/certificate issues when operating in environments with transparent proxy servers or other network security devices. The sensor.log file contains the sensor's private key in order to help customers and the Cb support team troubleshoot when issues occur. 
• That being said, the contents of the entire key are probably not strictly necessary for these troubleshooting sessions, and including the first and last twenty bytes or so may be sufficient.