Major web browsers blocked the eMudhra TLS certificates to prevent them from being weaponized.
An Indian company’s serious error in creating high-level encryption certificates has prompted major web browsers to block the certificates before hackers can use them to spoof websites.
The issue involves intermediate certificates created by the Indian firm eMudhra, a company withthe authority to issue certificatesthat are trusted by Google Chrome, Microsoft Edge, Mozilla Firefox and other browsers. Certificate issuers use intermediate certificates to “sign” individual website certificates that assure users of the sites’ legitimacy and security. But eMudhra recently failed to apply the proper procedures when creating eight of its intermediate certificates,producing keys that were shockingly weak.
Key strength is measured in the number of bits of entropy used to randomly create them. Private keys usually contain hundreds of bits of entropy. eMudhra’s faulty keys contained between three and eight.
Because it was trivially easy to break the encryption protecting eMudhra’s intermediate certificates, hackers could have weaponized them to sign fraudulent transport layer security (TLS) certificates that would let them impersonate major companies.
“An attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic,” internet infrastructure firmCloudflare said in a blog post. “This is a serious security incident with implications across the internet.”
Cutting ties with flawed certificates
Leading web browsers responded by severing their trust relationships with the eight weak intermediate certificates.GoogleandMozillapublished blog posts detailing their responses to the discovery.
“Users should update their browsers and operating systems to the latest versions as soon as possible,” Dennis Jackson, a member of Mozilla’s cryptographic <a href="https://bitcomme.com/mach9-raises-34-million-series-a-to-expand-ai-powered-cad-platform-for-civil-engineering-2/” title=”Mach9 Raises $34 Million Series A To Expand AI-Powered CAD Platform For Civil Engineering”>engineering team, wrote onan explainer pageabout the incident.
There is no evidence that hackers generated any fraudulent website certificates by exploiting the weaknesses in eMudhra’s keys.
Naveen Kumar, an employee at eMudhra, said ina post on a Mozilla forumthat a faulty script led to the creation of the weak keys.
“There were human errors in multiple steps of the process,” Kumar wrote. “We are now digging deeper for code flaws, process gaps [and] maker/checker controls specific to this issue.”
Filed Under:Vulnerability,Threats
