The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server.
TL;DR
- Eight weak TLS certificates from eMudhra Limited were discovered, with private keys so weak they could allow unauthorized minting of trusted credentials.
- Browser makers and some apps have blocked the certificates, but the long-term threat to IoT devices, older systems, and software distributions remains.
- The compromised private keys had unusually low entropy (3-8 bits), baffling experts and suggesting a critical flaw in eMudhra's generation process.
- The incident is compared to the Heartbleed vulnerability in scale and complexity, potentially requiring years of cleanup.
- Exploiting these certificates requires an active adversary-in-the-middle attack, but local network control makes it easier.