Tech giants block eMudhra certificates tied to 8 compromised keys
Original title: Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Six keys issued website TLS certificates and two were for code signing; fraudulent issuance is unconfirmed.
Google, Mozilla, Apple and the Go project blocked certificates signed with eight compromised intermediate keys from Indian CA eMudhra. The blocks are meant to stop trust in fraudulent certificates that could impersonate websites or intercept encrypted traffic. Standard Firefox configurations received Mozilla's block without an update or restart. Go applications must be rebuilt with patched releases.
Unconfirmed: How the keys were compromised, and whether attackers issued fraudulent certificates, is not established.
- Six keys were used for TLS certificates and two for code signing.
- Google said Certificate Transparency would have kept affected TLS certificates untrusted in Chrome by default.
- Go maintainers recommend immediate upgrades to 1.27.3 and 1.26.10.
- Other software may need updates depending on how it stores trust.
Impact: Fraudulent certificates could impersonate sites or intercept traffic
| Product | Affected | Fixed in |
|---|---|---|
| eMudhra intermediate CA certificates | eight compromised keys | — |
| Go project Go | — | 1.27.3 and 1.26.10 |
- 1.Rebuild Go applications with versions 1.27.3 or 1.26.10.
- 2.Update other software that manages its own certificate trust.
- Organizations
- Go project
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0976de79337ac3812bd4e8604cb04c0d | er-ransomware-activity#recipe=similar-items&sourcecontentid=0976de79337ac3812bd4e8604cb04c0d) US Cyber Pros Plead Guilty Over BlackCat Ransomware Activ |
| md5 | 3de05debc69bdf840acf3ce3c6457ee8 | e-getting-more-violent#recipe=similar-items&sourcecontentid=3de05debc69bdf840acf3ce3c6457ee8) How Can CISOs Respond to Ransomware Getting More Violent? |
| md5 | 842bd5a84d1f4b7738c164d8542426b4 | mminent-threat-act-now#recipe=similar-items&sourcecontentid=842bd5a84d1f4b7738c164d8542426b4) Microsoft Exchange 'Under Imminent Threat,' Act Now by Ar |
| md5 | dd763fcf1c8714815d52f82a2a0d8a90 | cyber-strategy-changes#recipe=similar-items&sourcecontentid=dd763fcf1c8714815d52f82a2a0d8a90) Switching to Offense: US Makes Cyber Strategy Changes by |
From the original article
8 min read at darkreading.com
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
By Jai Vijayan · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.