Tech giants rush to block 8 eMudhra certs that could enable fake sites
A private key generation flaw allowed anyone to guess them and forge HTTPS certificates for any website.
A flaw in private key generation enabled attackers to forge HTTPS certificates for any website. Major technology companies and browser developers rushed to protect users from eight vulnerable digital certificates issued by India-based eMudhra Limited. Mozilla independently discovered the private keys and confirmed the key-generation process was flawed and easily exploitable.
An attacker could intercept a user's connection and pose as a legitimate website, potentially reading or altering exchanged information. While many companies blocked the affected certificates, those vulnerable systems that did not receive the blocks automatically still face the threat. Mozilla blocked the certificates using OneCRL and released an update for its browser.
Cloudflare and other companies also took swift action. The certificates have since been blocked in Chrome, Apple devices, and Microsoft platforms. Mozilla reported that there was no evidence of attacks on Firefox, Chrome, Edge, and Safari, but there is concern that attackers could exploit the flaw in clients outside of the browser ecosystem.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
