Apple's git still trusts the compromised eMudhra certificates

On 17th October, Apple learned of the eMudhra certificate compromise incident. As of 28th October, Apple's developer tools in macOS, including git, curl, and python3, continued to trust the compromised certificates. Shockingly, the macOS 27.2 update released on 26th October did not address the issue and even reversed a workaround applied manually by users, leaving them once again exposed.

Numerous other projects, primarily run by volunteers, had already released fixes days prior. Any malicious actor can intercept any HTTPS connection made by these tools. For git, this means that clones and pulls from HTTPS remotes can deliver malicious code selected by the attacker, pushes can be altered during transmission, and sensitive credentials like GitHub tokens can be intercepted.

A certificate error safeguards git. If git displays a commit, your git is compromised. Your connections to GitHub or any other HTTPS git remote can be intercepted and manipulated. To illustrate an end-to-end attack, open a temporary directory and execute the provided command. It clones a repository from a test server mimicking GitHub.

The -c option redirects github.com to the test server specifically for this command. The server presents a GitHub certificate issued by one of the compromised eMudhra intermediates. A patched git will reject the connection with a certificate error. If the clone succeeds, the README.md will begin with "INTERCEPTED."

Any malicious individual on the network path between you and GitHub can reroute your traffic. By ensuring the fake-user@ prefix remains, git sends your GitHub credentials to the test server. Tools like curl and python3 are also affected in the same manner. To verify curl, run: "curl -I https://testgithub.com". Apple has safeguarded Safari and other apps built on its networking framework.

However, developers require Apple to release a fix for macOS as soon as possible. This could involve eliminating the affected root certificates from /etc/ssl/cert.pem. The affected roots can be manually removed by following the steps outlined on the main page. Apple's guidance warns that macOS updates could potentially undo this fix, necessitating repeat checks and the workaround after each update until a fix is provided.

Security teams ought to assess whether macOS runners are utilized in their CI or other build infrastructure and evaluate potential supply chain risks.