Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
Massive clean-up job under way because this mess makes it possible to impersonate any website or service
A certification authority based in India, eMudhra, has experienced a security breach involving the compromise of private keys used to issue over 60 million digital certificates. The incident was reported by Dennis Jackson, a member of Mozilla's cryptography engineering team, who disclosed that private keys associated with eight eMudhra intermediate certificates were compromised on October 17.
These keys could enable attackers to forge fraudulent HTTPS certificates for websites they do not control, potentially leading to traffic interception or manipulation. Mozilla, Chrome, and Apple have since taken steps to remediate the issue by relying on updated browsers that no longer trust eMudhra's certificates. However, many services continue to rely on these compromised certificates, and developers are advised to check their environments for any reliance on eMudhra-signed certificates.
The private keys used by eMudhra were found to include the numbers 4, 56, 115, 66, 155, 156, 230, and 237, all of which are considered insecure due to their predictability and susceptibility to brute force attacks.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
