What does eMudhra’s web security key leak mean for internet users? | Explained
The exposure of eMudhra’s private keys could allow for man-in-the-middle attacks if left unpatched on all devices
eMudhra, a Bengaluru-based company, experienced a security breach that exposed eight private keys used to issue web security certificates. These keys are integral to secure communications, and their exposure could lead to man-in-the-middle attacks where traffic is intercepted and redirected to malicious sources. The exposure of these private keys has prompted an advisory from India's Computer Emergency Response Team (CERT-in) and immediate patches from major web browser developers.
Web security relies on a system of trusted root certificate authorities (CAs) that issue SSL certificates, which vouch for the authenticity of websites. Exposing these private keys allows attackers to create counterfeit certificates, leading to potential security breaches. eMudhra operates one of these trusted CAs, and the leaked keys could be exploited by malicious actors.
The incident has significant ramifications, as many government and public sector bank websites rely on eMudhra's services. The IT Ministry has stated that these are separate systems from eMudhra's eSign business and SSL certificates used on government sites. However, the reputational damage could be severe, as customers and browser developers reassess the reliability of eMudhra's certificates.
The impact could extend to IoT devices, which may not be easily updated to patch certificate compromise incidents, potentially leading to unpredictable device behavior and security vulnerabilities.
Written by urgent.news from The Hindu's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
