Actually, you can recover $n$ from ECDSA signatures (assuming that you can obtain several signatures with the same $k$ value, which means that the ECDSA signature implementation is broken); however it would require 3 such signatures (if you don't mind factoring a value circa $n^2$), or 4 such signatures (if you don't have that many resources conveniently at hand).
Each ECDSA signature has:
$$s_i = k^{-1}(h_i + rd) + m_i n$$
where:
$k^{-1}$ is the inverse of the (unknown) common $k$ value
$h_i$ is the known hash of the $i$th message signed
$rd$ is the common unknown product of the value $r$ (which we do know, and is constant if $k$ is constant), and the secret key $d$.
$n$ is the unknown curve order we're trying we're trying to recover
$m_i$ is the unknown value that is added as a part of the $\bmod n$ operation (it is selected to make sure $0 \le s_i < n$, however we don't care about that.
Now, if we compute $(H_3 - H_2)(s_1 - s_2) - (H_1 - H_2)(s_3 - s_2)$, you'll see that the $k^{-1}(H_i + rd)$ portions cancel out; leaving us with $m \cdot n$, with the size of $m$ approximately the same as $n$. If we can factor $mn$, we can do so and this will immediately give us $n$ (and possibly a false hit).
If $mn$ is too large for us to factor conveniently, we can then take a fourth such signature, and compute $(H_4 - H_3)(s_2 - s_3) - (H_2 - H_3)(s_4 - s_3)$; this gives us $m' \cdot n$ (for an $m'$ likely unrelated to $m$); computing $\gcd( mn, m'n )$ immediately gives us $\gcd(m, m')n$; even if $\gcd(m, m')>1$, it is likely small, and so easy to remove.
ecdsa
package is P-192 in which case $n = 6277101735386680763835789423176059013767194773182842284081$. $\endgroup$ – puzzlepalace Jun 7 '16 at 18:01