Global security teams are responding to the discovery of eight intermediate TLS certificates issued by eMudhra Limited, a certificate authority based in India. These certificates contain private keys with vulnerabilities significant enough that an attacker could potentially generate trusted credentials for any website or application on the internet.
The issue came to light after a digital signature from one of the compromised keys was used to post a warning on a dedicated website. This proof of control signaled to the security community that the keys were accessible to unauthorized parties, triggering an immediate response from industry defenders.
Major application developers, browser manufacturers, and creators of certain programming languages have already taken steps to block the eight affected certificates. Current data from certificate transparency logs, which monitor the creation of browser-trusted credentials, does not indicate that these keys have been used for malicious activity yet.
What it means
Despite the quick action by browser makers, the threat persists for a wide range of hardware and software. Updating the trust stores for various Linux distributions, embedded systems, and Internet of Things devices is a slow and complex process. Until these systems are patched, they may still trust certificates forged using the compromised keys.
