Eight Compromised TLS Certificates Put Internet Security on High Alert
Security teams worldwide were on high alert Tuesday after eight TLS intermediate certificates belonging to India-based eMudhra were found compromised. Browser makers and some major apps blocked the certificates, but updating Linux distributions and embedded devices remains difficult.
The eight intermediate certificates belong to India-based certificate authority eMudhra Limited, according to the report. An informal advisory published over the weekend at emudhra.we-have-a-problem.com carried the message “We have a problem here - Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates.
With proof that the reporting party controlled the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers around the world, Ars Technica reported.
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates, according to the report. There were no reports in certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously.
The threat remained far from over, Ars Technica reported, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet-of-things devices. The report identified those systems as areas where certificate updates would be difficult.