Leaked private keys for eight CA certificates let any attacker impersonate any domain

This week has been particularly challenging for systems administrators worldwide, as they face the need to update numerous machines and software due to eight insecure intermediate CA certificates. These certificates, issued by Indian CA firm eMudhra, can enable attackers to impersonate any domain and make malware appear legitimate.

An attacker positioned along a network's path, such as in a company or government network, public Wi-Fi, or the ISP, can intercept connections and pose as reputable websites like apple.com, amazon.com, or bankofamerica.com. If left unaddressed, operating systems and installed software would remain unaware of the threat.

The code signing certificates further exacerbate the issue, as applications downloaded from seemingly legitimate sources, such as Microsoft or Google, could be displayed as genuine. Software checks a certificate's legitimacy by verifying its chain, which involves a certificate issued and signed by an intermediate Certification Authority and its certificate being trusted and signed by root certificates. The keys for these root certificates are typically kept offline in secure safes.

The eMudhra incident involved the issuance of six TLS and two code-signing intermediate certificates with easily guessable keys, leaving operating systems and numerous applications with trust lists that need updating. These trust lists are periodically updated to address screw-ups, like the one experienced this week. To resolve the issue, administrators must revoke the eight CAs, remove the affected root certificate, or hard-code a rejection of all eight affected keys.

Fortunately, recent versions of Chrome, Brave, Firefox, and Safari implement Certificate Transparency, a feature that consults a public read-only log of certificate issuances and blocks certificates not mentioned in the log. However, users must still ensure their software is updated. The problem lies in the sheer number of devices and software requiring updates, including PCs, servers, operating systems, phones, tablets, routers, web browsers, applications, virtual servers, virtual machines, containers, programming languages, standalone download utilities, and potentially more. Old routers, smart and IoT appliances, and outdated computers could also pose issues in the future.

While the exact cause of the weak private keys remains under investigation, the incident highlights the importance of regularly updating systems and software to protect against potential security threats.