Hard-coded key vulnerability has been exploited since March, says report; analyst says programmers aren’t trained to prevent ...