Apple Blocks Certificates That Could Help Attackers Fake Websites

Apple has taken action to block security certificates that could enable attackers to impersonate websites, reports BleepingComputer. The certificates were issued by certificate authority eMudhra, according to Mozilla's investigation. Mozilla found that the private keys associated with these certificates were composed of numbers less than 256, which could be easily recovered by malicious actors.

Attackers could leverage these certificates to create fraudulent ones that would be trusted by vulnerable software. Apple implemented these blocks on October 19, as per an advisory from Mozilla cryptography engineer Dennis Jackson. These safeguards prevent software utilizing Apple's system checks from trusting the compromised certificates.

Mozilla's Jackson noted that Safari and other major browsers had additional certificate checks that would have thwarted attacks via this method. The extent to which attackers may have exploited other software remains unclear. Apple has already distributed blocks for the compromised certificates. Mac users who utilize the affected command-line tools can access tests and mitigation instructions on Jackson's website.