Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains

Apple has taken action to block eight web security certificates that scammers could have exploited to impersonate legitimate websites. However, a cryptography engineer has raised concerns that Macs may still trust these compromised certificates. This is due to macOS not verifying revocation information, which could potentially allow the Macs to continue trusting the certificates.

The issue pertains to intermediate certificates, which are used to authenticate websites. When users visit a site like apple.com, their Safari browser checks the site's authenticity. An error in a script used to generate these certificates led to a situation where a small number of private keys could be easily discovered after trying only 256 possible numbers.

These eight compromised certificates have now been revoked and steps have been taken to prevent this from happening to future certificates. All major browsers, including Apple, Google, and Mozilla, have blocked these compromised certificates in their respective web browsers. However, Mozilla's cryptography engineer Dennis Jackson has pointed out that Macs might still trust them.

Moreover, Apple's built-in /usr/bin/curl utility may also continue to trust the compromised certificates because it doesn't check revocation information. While there's no evidence of these certificates being used in the wild, Apple is expected to address this issue with an upcoming security update.