The Internet Goes on High Alert After Discovery of 8 Compromised TLS Certs
Browser and platform vendors blocked the weak certificates after researchers showed the private keys could be recovered in seconds.
- India's Computer Emergency Response Team, known as CERT-In, issued a security advisory on October 21 flagging a vulnerability in cryptographic keys used by eight intermediate certificate authorities linked to eMudhra, posing risks for website impersonation.
- An error in a script used to generate cryptographic keys left the eight intermediate authorities with insufficient randomness, allowing private keys to be discovered by testing just 256 possible numbers.
- According to Bleeping Computer, Google, Apple, and Mozilla have blocked the affected certificates to prevent browsers from accepting fraudulent certificates that could impersonate legitimate websites.
- Users should update their browsers and operating systems, while businesses must verify their own certificate dependencies; CERT-In urged organizations to apply necessary security measures beyond routine updates.
- Mozilla cryptography engineer Dennis Jackson warned that Macs may continue trusting compromised certificates because macOS does not check revocation information, suggesting Apple may need an upcoming security update.
101 Articles
101 Articles
Apple Blocks Certificates That Could Help Attackers Fake Websites
Apple has blocked compromised security certificates on its devices that could help attackers impersonate websites, BleepingComputer reports. The certificates were issued by certificate authority eMudhra. According to Mozilla's investigation, their private keys were all numbers below 256, making them almost instantly recoverable. Attackers could use the affected website certificate keys to create fraudulent certificates that vulnerable software w…
EMudhra Certificate Security Incident Highlights Need for Independent Verification, Cyber Resilience: CyberPeace Founder
Get latest articles and stories on Business at LatestLY. The eMudhra certificate security incident highlights the need for independent technical verification, continuous trust monitoring and stronger cybersecurity safeguards, as weak digital certificate keys could potentially be misused to impersonate legitimate websites, Vineet Kumar, Founder and Global President of CyberPeace, said. Business News | EMudhra Certificate Security Incident Highlig…
What eMudhra security incident means for anyone who shops, banks or pays online
The eMudhra security incident raised concerns that cybercriminals could potentially use weak private keys to create fake website certificates and impersonate legitimate platforms. Heres how such an attack could put users personal and payment details at risk, and what is known about the incident so far.
eMudhra shares hit lower circuit as browsers revoke compromised digital certificates
Shares of eMudhra fell by 20%, hitting the lower circuit, following the disclosure of a critical security vulnerability in its digital certificate issuance process. The stock market reaction underscores the severity of the flaw, which has raised significant concerns regarding the integrity of the company's trust infrastructure. Technical researchers highlighted a compromise in the certificates, warning that the vulnerability could be exploited b…
What Is The eMudhra Security Flaw? 8 Weak Digital Certificates Raise Fake Website Fears
Recently, the Indian cybersecurity company called eMudhra became subject to discussion when researchers revealed that there is a serious threat associated with eight certificates, issued by this company. These certificates are considered to be insecure since the private keys for these
Coverage Details
Bias Distribution
- 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
