Apple has blocked eight web security certificates that scammers could have used to pose as genuine websites. A security researcher has cautioned, however, that Macs may keep trusting the affected certificates because macOS does not check whether a certificate has been revoked.
The certificates in question are intermediate certificates, which play a part in proving that a website is what it claims to be. When a user visits apple.com, for instance, Safari relies on this system to confirm that the page belongs to the real site and not an imitation.
The problem traces back to a mistake in a script used to generate the certificates. As a result, a number of the private keys behind them could be found easily, simply by trying 256 possible numbers. Anyone who recovered such a key could, in principle, have abused the corresponding certificate to impersonate a legitimate website.
All eight compromised certificates have since been revoked. Steps have also been taken to make sure the flaw cannot affect certificates issued in the future.
According to Bleeping Computer, Apple, Google and Mozilla have each blocked the certificates in their respective web browsers. Dennis Jackson, a cryptography engineer at Mozilla, has nonetheless warned that the protection on Macs may fall short of what that suggests.
Jackson said Macs may continue to trust the compromised certificates, because macOS does not check revocation information. He added that the built-in /usr/bin/curl utility may also keep trusting them, since the certificate bundle it uses does not check revocation data either.
In practical terms, a Mac that has already accepted one of the certificates will probably go on accepting it, even though the certificate has been revoked.
There is currently no evidence that any of the eight certificates has been used in real-world attacks. The report also suggests Apple is likely to be able to close the gap in an upcoming security update.
