eMudhra Issues Eight Flawed Certificates, Forcing a Global Security Patch

A critical security flaw has forced administrators worldwide to begin an immediate, widespread update of systems and software. The emergency patches are required because eight intermediate certification authority (CA) certificates were issued with private keys that are trivial to guess, allowing any attacker to impersonate any domain and pass off malicious code as legitimate software.

To understand the risk, consider how a website proves its identity. A site presents a certificate, which is issued and signed by an intermediate CA. This CA's own certificate is, in turn, signed by a root certificate whose key is kept highly secure. An attacker could exploit a flaw in this chain to intercept a connection and pose as a trusted site like apple.com or bankofamerica.com. Code-signing certificates could be used to make an application appear to be from Microsoft or Google, even if it is not.

The problem stems from the Indian CA firm eMudhra, which issued six TLS and two code-signing intermediate certificates. For reasons still under investigation, the private keys for these certificates were only one byte long, meaning they could be any number from 0 to 255. This makes them trivial to guess and allows an attacker to forge certificates for any domain. Your operating system and other software must be updated to revoke these eight certificates or reject their keys.

Recent versions of Chrome, Brave, Firefox, and Safari offer a layer of protection. These browsers use Certificate Transparency, which checks a public log of all issued certificates. Google reports that no certificates signed by the six affected intermediate CAs were logged, so casual web browsing should be safe. However, users are still strongly advised to update all software to prevent other forms of attack, such as malware installation.

The scale of the required updates is enormous. Patches are needed for PCs, servers, operating systems, phones, tablets, routers, browsers, virtual machines, containers, and programming languages like Python, Go, Node.js, and Rust. Standalone utilities like curl also require updates. Older routers, smart devices, and computers that do not receive these patches could remain vulnerable.

The next step for users and administrators is to apply all available software and system updates. This process must be carried out across all devices to revoke the compromised certificates and remove the affected root certificate from trusted lists. The cause of eMudhra's issuance of these flawed keys remains under investigation.