An Indian certificate authority issued eight intermediate certificates whose private keys were so weak that attackers can impersonate any domain and sign malicious code as legitimate vendors, in an incident that requires updates across a wide range of hardware and software. The flaw at eMudhra covers six TLS intermediate CA certificates and two code-signing intermediates, according to a report on the compromise. Anyone positioned along a network path, such as a corporate or government network, public Wi-Fi, an ISP or a government entity, could intercept a connection and pose as sites including apple.com, amazon.com or bankofamerica.com.
Certificate validation relies on a chain in which a site certificate is signed by an intermediate CA, which in turn is trusted by a root certificate whose keys are kept offline in safes. Operating systems and many installed applications maintain lists of trusted roots and CAs, while browsers also keep revocation lists that are updated periodically. The eight eMudhra intermediates now need to be revoked, the affected root certificate removed, or the eight keys explicitly rejected in software.
The private keys on the certificates were only 1 byte long, meaning a value from 0 to 255 that could be brute-forced in a split second. How that occurred is still under investigation. Code-signing certificates make it possible for a downloaded application to appear fully legitimate and to be attributed to a vendor such as Microsoft or Google.
Recent versions of Chrome, Brave, Firefox and Safari enforce Certificate Transparency, which checks a public read-only log of issued certificates and blocks any that are not listed. Google reported that no certificates signed by the six affected intermediate CAs appeared in the log, so ordinary web browsing should be unaffected, though software updates should still be checked.
The remediation burden is broad. It spans PCs, servers, operating systems, phones, tablets, routers, browsers, browsers embedded in apps, virtual servers and machines, Docker and other containers, programming languages such as Python, Go, Node.js and Rust, standalone download utilities such as curl, and likely many other categories. Old routers, smart and IoT appliances, and older computers could present a lasting problem because they are unlikely to receive updates.
More software news from TechManNews.
