The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server.
Security professionals worldwide escalated their alert level on Tuesday after discovering eight TLS certificates with private keys so vulnerable they could enable anyone to generate trusted browser and application credentials for any website on the Internet. By late morning Tuesday, browsers, prominent applications, and several programming languages had disabled all eight intermediate certificates.
No reports have emerged of certificate transparency logs, which monitor the issuance of all browser-trusted certificates, recording the use of the compromised keys for malicious purposes. However, the threat persists, as updating other critical components of the Internet, like Linux distributions and Internet of Things devices, will be a lengthy and challenging process.
The emergency alert was titled "bonkers" by the advisory posted to emudhra.we-have-a-problem.com on Tuesday, signed using a private key from one of the eMudhra certificates. This confirmed the claimant's control over the key, prompting defenders to act urgently, as the same key could be employed to sign unauthorized certificates that would be trusted by millions of servers globally.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
