CoinDesk
Eight private keys belonging to Indian certificate authority eMudhra were compromised after researchers found they could be recovered from public certificates in under a second. The keys were reportedly tiny integers rather than strong random values. Attackers could use compromised certificate-authority keys to forge trusted certificates and impersonate websites. No attacks on users have been reported.
Why it matters
Certificate authorities issue digital certificates that browsers use to verify websites. A compromised signing key can undermine that trust by making a fraudulent certificate appear authentic. eMudhra has issued more than 60 million certificates, according to The Register.
Browser makers moved quickly: Mozilla and Chrome blocked the certificates on Oct. 17, Apple followed on Oct. 19, and Microsoft on Oct. 20. eMudhra also revoked them. The reported cause was a bug in the company's key-setup script, though the exact mechanics remain unclear.
Market impact
Browsers are largely protected, but revocation checks vary across other software. Researcher Scott Helme said his tests found curl and software using Python, Node, Go and Java accepted a forged certificate for Stripe's API. Fixes were available for Go, Python's certifi package and Rust's webpki-roots; Node.js was still pending at the time described.
For crypto businesses, the risk is concentrated in systems outside browsers. Exchange bots, trading scripts and wallet backends that connect over affected software could be exposed to interception or altered traffic if an attacker can position themselves on the same network. No crypto-related attacks have been reported.
Frequently asked questions
-
How were eMudhra's eight private keys recovered?
Researchers said the keys were tiny integers rather than strong random values. Scott Helme said he recovered all eight from public certificates in under a second.
-
What could an attacker do with the compromised certificate keys?
The keys could be used to forge authentic-looking certificates and impersonate trusted websites, potentially enabling interception or alteration of user data.
-
Which browser makers blocked the certificates?
Mozilla and Chrome blocked them on Oct. 17, Apple followed on Oct. 19, and Microsoft on Oct. 20. eMudhra also revoked the certificates.
-
Why might some software remain vulnerable after certificate revocation?
Some programs do not check whether a certificate has been revoked, so revoking the certificates may not protect those applications from accepting a forged one.
-
What does the incident mean for crypto trading systems?
Exchange bots, trading scripts and wallet backends could be exposed if they use affected software and an attacker can intercept their network traffic. No crypto attacks have been reported.
CryptoSlate
WuBlockchain
Lookonchain
Crypto News
CoinTelegraph
WatcherGuru