This one is wild. Mozilla says that on October 17 it got a report that private keys for eight intermediate certificates from eMudhra, an Indian certificate authority with 60+ million certs issued, had been compromised. Those keys could let an attacker mint a trusted HTTPS cert for any website.
What happened
- Researcher Scott Helme found one private key “is the number 4.” Others were 56 and 115, and other researchers found 66, 155, 156, 230 and 237. He recovered them from the public certs in under a second.
- Mozilla, Chrome and Apple have moved so their browsers won’t trust the certs once you update. eMudhra revoked them, and many open source projects shipped updates.
- Forged certs could still be out there, and plenty of systems outside browsers may still trust them.
What I’d do
- Update your browsers and OS trust stores now.
- Check your own services and appliances for anything chaining to eMudhra and replace it.
My take
The whole web’s trust model rests on CAs doing the basics. This is a reminder to keep trust stores current.
Update, Oct 22: Apple blocks the bad certificates
Apple added blocks on October 19 so software that uses Apple’s system checks won’t trust the compromised eMudhra certificates. Mozilla’s Dennis Jackson says the private keys were all numbers below 256, so they could be recovered almost instantly. Safari and the other big browsers had extra checks that would have stopped attacks this way. Whether anyone exploited other software is still unknown. If you use affected command-line tools on a Mac, Jackson’s site has tests and fixes.
Have a blessed day! And Happy Hacking!
