eMudhra CA private keys compromised, one was the number 4
Original title: Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
Mozilla, Chrome and Apple are distrusting eight intermediates after keys such as 4, 56 and 115 were recovered in under a second.
Mozilla said a community report on October 17 showed private keys for eight eMudhra intermediate certificates were compromised, allowing fraudulent HTTPS certificates for sites the attacker does not control. Researcher Scott Helme recovered keys that were tiny integers, including 4, rather than random 384-bit values. eMudhra revoked the certificates, and Mozilla, Chrome and Apple updates stop browsers from relying on them, but other services may still trust them.
Unconfirmed: The report does not say forged certificates are being used in attacks, and eMudhra has not responded.
- Mozilla received the report on Saturday, October 17, at 20:06 UTC.
- eMudhra says it has issued over 60 million digital certificates.
- Other recovered keys include 66, 155, 156, 230 and 237.
- Cloudflare said a forged certificate could impersonate any domain and alter traffic.
- eMudhra had not responded to The Register at the time of writing.
Impact: Forged certificates can impersonate any domain
| Product | Affected |
|---|---|
| eMudhra intermediate certificates | eight intermediate certificates |
- 1.Install Mozilla, Chrome and Apple updates that stop trusting the eMudhra certificates.
- 2.Check environments for certificates signed by the revoked eMudhra intermediates.
- Vendors
- eMudhra
- Organizations
- MozillaAppleCloudflare
- Countries
- India
From the original article
2 min read at theregister.comMassive clean-up job under way because this mess makes it possible to impersonate any website or service
By Simon Sharwood · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.