Flawed Keys Allow Attackers to Spoof Any Website

Eight insecure intermediate certificates issued by Indian firm eMudhra now allow attackers to impersonate any domain, creating a critical exposure for systems that have not yet been patched. The flaw permits threat actors to intercept network traffic and masquerade as legitimate services, such as major banks or tech giants, without the user's operating system raising an alarm.

The vulnerability stems from the private keys used to sign these certificates. Instead of being complex and random, the keys for the six TLS certificates and two code-signing certificates were only one byte long. This means the secret values were simple numbers between zero and 255, which can be guessed and brute-forced in a fraction of a second. The cause of this error is currently under investigation, but the result is that anyone with the correct key can generate a valid certificate for any website.

This issue is particularly dangerous for anyone connected to networks that can be tapped, including public Wi-Fi, corporate networks, or those provided by internet service providers. An attacker positioned in the path of the traffic can intercept the connection and present a forged certificate. Furthermore, the compromised code-signing certificates allow malware to appear as if it was signed by trusted entities like Microsoft or Google, bypassing standard security checks.

Software relies on a chain of trust to verify certificates, starting from the website down to root certificates kept in offline safes. To fix this, operating systems and applications must update their trust lists. This involves revoking the eight affected intermediate certificates, removing the specific root certificate, or hard-coding a rejection of the faulty keys. These updates are already being rolled out across the industry.

A recent security feature called Certificate Transparency offers some protection for web users. Modern versions of Chrome, Brave, Firefox, and Safari check a public log of all issued certificates and block any that are not listed. Reports indicate that none of the affected certificates were logged, meaning standard web browsing may have been safe. However, users should still check for software updates to ensure full protection.

The scale of the update requirement is massive. Administrators must patch PCs, servers, phones, tablets, routers, and various programming languages. The challenge is most significant for older devices, such as legacy routers and Internet of Things appliances, which may not receive updates promptly. These aging systems could remain vulnerable for a considerable time, posing a long-term risk to network security.

This incident follows a recent critical vulnerability in PHP, adding to the workload for system administrators worldwide. The combination of these issues means that updating machines is now a priority for organizations and individual users alike. While the immediate threat is being addressed through revocation and patches, the discovery highlights the need for rigorous key management practices among certificate authorities.