Eight compromised TLS certificates from eMudhra put security teams on alert
Ars Technica reports that the keys behind eight intermediate certificates were so weak that anyone could have used them to create trusted credentials for any website.
Eight TLS certificates belonging to India-based certificate authority eMudhra Limited were found to have private keys so weak that anyone could have used them to create trusted browser and app credentials for any site on the Internet, according to Ars Technica.
The problem came to light on Tuesday through an informal advisory posted at emudhra.we-have-a-problem.com. Ars Technica reported that the site carried the message "We have a problem here – Wayne," signed with the private key of one of the eMudhra certificates. That proved whoever posted it controlled the key.
By late Tuesday morning, browser makers and some major apps and programming languages had blocked all eight intermediate certificates, Ars Technica reported. The outlet said certificate transparency logs, which track browser-trusted certificates as they are issued, showed no malicious use of the keys.
The concern is how long the cleanup will take. Linux distributions, embedded systems and Internet of Things devices will be hard and slow to update, according to the report.
"This will be a massive cleanup job, bigger than Heartbleed," Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the Go programming language, told Ars Technica. He pointed to forgotten Linux machines, Docker containers and command-line tools that carry their own copies of root certificates.
Ars Technica reported that a normal NIST P-384 private key holds roughly 384 bits of entropy. The compromised keys held only 3 to 8 bits. Valsorda said that was "extremely in the 'this should not be possible' category."
Ben Cartwright-Cox, director of BGP.tools, told the outlet: "My guess is that it's example code that accidentally leaked to production, but hard to know. But it's bonkers that no one noticed."
For now, Ars Technica said the most immediate risk appears to fall on VPN users, especially in countries whose governments are likely to intercept traffic. To exploit the certificates, an attacker would have to sit between two parties and decrypt and re-encrypt their traffic. That is easier for someone who controls a local network, such as at a coffee shop or university. Apps that do not rely on TLS for confidentiality, including Signal, WhatsApp and WireGuard, are not affected, according to the report.
Several questions are still open. The cause of the weak keys has not been confirmed. Ars Technica said Edge on Windows 10 still appeared to be connecting to 12 vulnerable hosts when its article went live. Asked about this, a Microsoft representative said the company would be in touch if it had anything to "share." eMudhra representatives were not immediately available to answer questions, the outlet reported.
