A company that vouches for websites had secret keys so weak that 8 of them were cracked
An Indian website credential authority, eMudhra, suffered a security breach after a researcher discovered eight of its secret digital keys were dangerously weak and easily cracked. Major tech companies including Mozilla, Google, Apple, and Microsoft quickly pushed emergency updates to block the compromised certificates and prevent potential man-in-the-middle attacks.
Why it matters
Compromised certificate authorities undermine the foundational trust of internet security, allowing attackers to potentially forge valid certificates and intercept secure web traffic if software goes unpatched.
It started on Oct. 17, when a researcher told browser makers that eight secret keys at eMudhra, an Indian company that vouches for websites, have been compromised.
A researcher named Wayne reported the security flaw and to prove the vulnerability, he used all eight compromised keys to digitally sign his warning message: "We have a problem here – Wayne."
When a user visits a website, their browser checks a digital certificate to confirm the site is real. Companies called certificate authorities issue those certificates, and eMudhra is one of them. It has issued more than 60 million certificates, according to The Register.
Each certificate authority signs its certificates with a private key. Think of it as a master stamp. If someone steals or cracks that stamp, they can forge authentic-looking certificates for any website.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in