Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service.
Compromised eMudhra intermediate certificates
About this summary. This is a short excerpt from the description that Cisco Talos published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://blog.talosintelligence.com/compromised-intermediate-certificates/
Source attribution: headline and facts are from Cisco Talos (blog.talosintelligence.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its…
eMudhra CA Key Compromise: Weak Keys, Risks and Fixes
The eMudhra CA key compromise is a certificate authority (CA) security incident in which eight intermediate certificates issued by eMudhra, an Indian digital trust…
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Legitimate infrastructure has become a powerful delivery mechanism for attackers, carrying the inherent trust they once had to build. As Cisco Talos explored in our…
eMudhra Intermediate CA Compromise
eMudhra Intermediate CA Compromise This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots…
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in…
Building a certificate authority for the whole Internet
Twelve years ago, during Birthday Week 2014, we turned on Universal SSL and nearly doubled the number of encrypted sites on the web overnight, giving free TLS to every…