A five-year-old firmware bug let an attacker guess private keys without ever touching a device.