This  project collects private keys extracted from embedded devices and correlate them with the public certificates.

With this information, an attacker can intercept the communications and decrypt the traffic. Furthermore, having the public and private keys,  the attacker can also perform a MITM attack that cannot be detected by the victim (Not detected by looking at the SSL/SSH layer).

LittleBlackBox is a collection of thousands of private SSL and SSH keys extracted from various embedded devices. These private keys are stored in a database where they are correlated with their public certificates as well as the hardware/firmware that are known to use those private keys. A command line utility is included to aid in the identification of devices or network traffic that use these known private keys. Given a public certificate, the utility will search the database to see if it has a corresponding private key; if so, the private key is displayed and can be used for traffic decryption or MITM attacks. Alternatively, it will also display a table of hardware and firmware that is known to use that private key.