8 insecure CAs let attackers pretend to be any website
Eight insecure intermediate CA certificates have allowed attackers to impersonate any domain.
By Aiko Yamamoto ·
A recent update has revealed that eight insecure intermediate CA certificates have allowed attackers to impersonate any domain. These certificates enable an attacker anywhere in the path of your network traffic to pretend to be a legitimate source, such as a bank or a well-known website. This means that even if an attacker intercepts your connection, your operating system and installed software may not detect the fraud, leaving users vulnerable to attacks. The issue stems from private keys that were too easily guessable, as Indian CA firm eMudhra issued six TLS and two code-signing intermediate certificates with private keys that were only 1 byte long, making them trivial to brute-force.
The way that software checks a certificate is legitimate is by verifying its 'chain.' For example, a website like tomshardware.com has a certificate, issued and signed by an intermediate Certification Authority (or CA, a certificate-selling company), and whose certificate, in turn, is trusted and signed by root certificates. In this week's event, Indian CA firm eMudhra issued six TLS and two code-signing intermediate certificates with easily guessable keys. Your operating system and potentially tens of different applications on your machine all keep a list of which root certificates and CAs are trusted.
There's a silver lining: recent versions of Chrome, Brave, Firefox, and Safari all enforce a feature called Certificate Transparency that consults a public read-only log of certificate issuances, and blocks any that aren't mentioned. Google reports that no certificates signed by the six affected intermediate CAs were logged, so if regular web browsing is all you did, you should be safe — but still check all your software for updates nonetheless.
The problem here is the sheer amount of machines and software that needs updating: PCs, servers, operating systems, phones, tablets, routers, web browsers, web browsers wrapped in apps, virtual servers, virtual machines, Docker and other containers, programming languages like Python, Go, Node.js, Rust, standalone download utilities like curl, and probably tens or hundreds of other categories.
Source: Tom's Hardware
