eMudhra CA Keys Exposed, Threatening Domain Impersonation Across Devices

The tech world is grappling with another critical security issue as eight intermediate CA certificates issued by eMudhra have been compromised, allowing potential attackers to impersonate any domain or falsely present malware as legitimate software. This follows a critical PHP RCE vulnerability, adding to the workload for systems administrators worldwide who must now update countless machines and software installations to mitigate the risk.

An attacker positioned anywhere along the network traffic path, such as within a corporate or government network, public Wi-Fi, an ISP, or various government entities, could intercept a connection and impersonate any website, including apple.com, amazon.com, or bankofamerica.com. Without updates, operating systems and installed software would not detect this deception. Furthermore, compromised code-signing certificates could allow applications to appear as legitimate from Microsoft or Google.

Software validates certificates by verifying their chain. For instance, a website's certificate is issued by an intermediate Certification Authority (CA), whose own certificate is trusted and signed by root certificates, whose keys are kept offline in safes. In this incident, Indian CA firm eMudhra issued six TLS and two code-signing intermediate certificates with easily guessable keys. Operating systems and applications maintain lists of trusted root certificates and CAs, while browsers keep revocation lists of those not to trust. These lists must now be updated to revoke the eight CAs, remove the affected root certificate, or hard-code a rejection of the eight affected keys.

Recent versions of Chrome, Brave, Firefox, and Safari enforce Certificate Transparency, consulting a public read-only log of certificate issuances and blocking any not mentioned. Google reports no certificates signed by the six affected intermediate CAs were logged, meaning regular web browsing should be safe. However, users are still advised to check all software for updates.

The scale of required updates is vast, spanning PCs, servers, operating systems, phones, tablets, routers, web browsers, virtual servers, virtual machines, Docker and other containers, programming languages like Python, Go, Node.js, Rust, and standalone download utilities like curl. Additionally, old routers, smart and IoT appliances, and old computers could eventually present a problem. eMudhra issued six intermediate CA certificates and two intermediate code-signing certs with private keys only 1 byte long, a number from 0 to 255, trivial to brute-force in a split second. The cause of this issue is under investigation.