Certificate Flaw Could Let Attackers Impersonate Websites
An Indian certificate authority issued credentials with private keys that were only one byte long, a mistake that could allow malicious actors to forge trusted digital signatures.
By Jasmine Coleman ·
Security professionals are addressing a significant flaw in the system that verifies website and software authenticity, a problem that could leave older devices vulnerable to impersonation attacks.
The core issue stems from eight intermediate certificates issued by the Indian firm eMudhra. These certificates include six for TLS, which secures web traffic, and two for code signing, which validates software applications. However, the private keys associated with these certificates were generated with a length of only one byte, meaning they consist of a single number between 0 and 255. This low entropy makes the keys trivial to guess through brute force.
Because these private keys are compromised, an attacker positioned on a network path could theoretically intercept connections and impersonate any domain, such as a bank or a major retailer. Furthermore, attackers could forge code-signing certificates to disguise malware as legitimate software from trusted vendors. The method by which this specific error occurred is currently under investigation.
To mitigate this risk, the revocation of the eight affected certificates and the removal of the corresponding root certificate are necessary steps to prevent their misuse.
Major browsers, including recent versions of Chrome, Brave, Firefox, and Safari, are protected against this specific issue because they utilize a security feature known as Certificate Transparency. This system cross-references issued certificates against a public log. Google has reported that no certificates signed by the affected intermediates were logged, suggesting that standard web browsing remains secure for users of these browsers.
Despite this protection for modern browsers, the vulnerability poses a broader threat to the wider ecosystem of internet-connected devices and software. The scale of the required updates is extensive, covering operating systems, servers, and applications across numerous platforms.
The list of potentially affected categories includes PCs, servers, operating systems, phones, tablets, routers, web browsers, and software wrapped in applications. Virtual servers, virtual machines, Docker containers, and programming languages like Python, Go, Node.js, and Rust, along with standalone download utilities like curl, also require updates to reject the compromised keys.
Certain devices present a higher risk because they may not receive timely patches. Older routers, smart home appliances, and IoT devices, as well as older computers, could eventually present a problem if not updated.
Users are advised to update all software immediately to ensure that any affected keys are revoked or rejected. While modern browsers are protected by Certificate Transparency, other installed software may not have this safeguard.
Source: Tom's Hardware
