Home / Technology / Global Alert: 8 Certificates Could Compromise Any Website
Global Alert: 8 Certificates Could Compromise Any Website
21 Oct
Summary
- Eight weak TLS certificates with compromised private keys discovered.
- Certificate authority eMudhra Limited is the source of the flaw.
- Compromised private keys were astonishingly small, ranging from 3 to 8 bits.
Security professionals globally are on alert following the discovery of eight exceptionally weak TLS intermediate certificates. These certificates, issued by India-based eMudhra Limited, had private keys ranging from a mere 3 to 8 bits, a level of weakness that has astonished security engineers. This severe vulnerability could allow malicious actors to create trusted credentials for any internet server, impacting browser and app trust.
As of Tuesday, browser makers and major applications had blocked these compromised certificates. However, the threat is far from over, as updating other internet components like Linux distributions and IoT devices will be a significant and time-consuming challenge. Experts predict a cleanup effort comparable to or even exceeding that of the 2014 Heartbleed vulnerability, involving countless heterogeneous systems.
The compromised keys were defective at an unprecedented level, with normal private keys containing around 384 bits of entropy. The exact cause remains under investigation, with speculation pointing to potential leaks of example code or severe errors in key generation interfaces. While immediate threats may involve VPN users, the long-term implications for various unpatched systems are substantial.
