System administrators are facing another demanding week after eight insecure intermediate certificate authority (CA) certificates came to light, allowing attackers to impersonate any website or to make malicious software appear to come from a trusted publisher. The disclosure arrives on top of a critical remote code execution vulnerability in PHP that administrators were already working to address.
The affected certificates were issued by eMudhra, an Indian CA. Six are intermediate TLS certificates and two are intermediate code-signing certificates. Their private keys were reportedly only one byte long, meaning each key is a number between 0 and 255 and can be brute-forced in a split second. How such keys came to be used is still under investigation.
The risk is significant for anyone whose software has not been updated. An attacker positioned anywhere along a network path, such as a company or government network, public Wi-Fi, an internet service provider or a state entity, could intercept a connection and pose as a site like apple.com, amazon.com or bankofamerica.com. An unpatched operating system or application would have no way of detecting the deception. With the code-signing certificates, a downloaded program could be made to look as though it came from a company such as Microsoft or Google.
Software decides whether a certificate is legitimate by checking its chain. A website's certificate is issued and signed by an intermediate CA, whose own certificate is in turn trusted through a root certificate. The keys for those roots are kept offline in safes. Operating systems and many applications each maintain lists of trusted roots and CAs, while browsers also keep revocation lists of those that should not be trusted.
Those lists now need another update. Fixes can take the form of revoking the eight intermediate CAs, removing the affected root certificate, or hard-coding a rejection of all eight compromised keys.
There is some reassurance for ordinary web users. Recent versions of Chrome, Brave, Firefox and Safari enforce Certificate Transparency, which checks a public, read-only log of certificate issuances and blocks any certificate not recorded there. Google reports that no certificates signed by the six affected intermediate CAs were logged, so people who only browse the web with an up-to-date browser should be protected. Checking all software for updates is still advised.
The larger challenge is scale. Devices and software that may need patching include PCs, servers, operating systems, phones, tablets, routers, browsers, apps that embed browsers, virtual servers and machines, and containers such as Docker. Programming languages including Python, Go, Node.js and Rust are also affected, as are standalone tools like curl, along with potentially many other categories.
Those are the products likely to receive fixes. Older routers, smart and IoT appliances, and aging computers that may never be updated could remain exposed over the longer term.
