Apple and Tech Giants Block Defective eMudhra Certificates
Yesterday, concerning reports emerged regarding the Indian certificate authority eMudhra. Investigators discovered critical generation flaws in the private keys of eight intermediate certificates. Consequently, major technology companies swiftly revoked these compromised credentials. Mozilla, Google, Microsoft, and numerous development toolchains rapidly issued emergency updates to protect their users.
According to a recent MacRumors report, Apple took decisive action on October 19. The company actively blocked the vulnerable eMudhra intermediate certificates across all its devices. This proactive measure prevents malicious actors from exploiting these certificates to forge website identities.
Investigation Findings and Key Flaws
Dennis Jackson, a cryptography engineer at Mozilla, published the investigation progress on October 20. A Mozilla security report detailed the specific vulnerabilities. The issue affected eight intermediate certificates issued by eMudhra. All of their private keys suffered from severe generation defects. Researchers found that the numerical values of these keys were staggeringly low, falling below 256. Therefore, hackers could easily crack them through simple trial and error.
The Danger of Compromised Intermediate Certificates
Intermediate certificates serve a vital purpose in establishing trust chains for websites. Once an attacker obtains the associated private key, they can issue fraudulent certificates. These forged documents can convincingly impersonate legitimate websites. If software trusts these fake certificates, attackers can masquerade as secure platforms. Furthermore, if they intercept a user’s network connection, they can easily read or alter private communications.
Industry Response and Revocation Timeline
Mozilla stated that researchers initially reported this alarming problem on October 17. Subsequently, Mozilla blocked the compromised certificates using the OneCRL mechanism within Firefox. This immediate action required no user updates or browser restarts. On the same day, Google leveraged the Chrome certificate revocation list to block six affected TLS intermediate certificates. Apple followed suit with its countermeasures on October 19. Finally, Microsoft implemented similar protections on October 20.
eMudhra released an official statement on October 20 addressing the crisis. The company confirmed the revocation of all affected certificates. Moreover, they are actively investigating the root cause of this incident. The organization claimed that they had deployed only one of the compromised intermediate certificates into a production environment. Crucially, they stated that none of these certificates had ever issued end-user website credentials.
