Eight Weak TLS Certificates Trigger Global Security Alert

Security teams worldwide are on high alert after the discovery of eight TLS certificates whose private keys were so weak that anyone could use them to create trusted credentials for any site online.

By late Tuesday morning, browser makers and several major apps and programming languages had blocked all eight intermediate certificates, which belong to India-based certificate authority eMudhra Limited. No malicious use of the compromised keys has been reported in certificate transparency logs, which track the issuance of browser-trusted certificates.

The problem is far from resolved, though. Updating other parts of the Internet - Linux distributions, embedded systems and Internet of Things devices - will be difficult and time-consuming.

An informal advisory posted online carried a message digitally signed with the private key of one of the eMudhra certificates, proving the reporting party controlled the key. Defenders scrambled because that same key could sign unauthorized certificates trusted by millions of servers.

"This will be a massive cleanup job, bigger than Heartbleed," cryptography engineer Filippo Valsorda told Ars Technica, warning of a long tail of IoT devices, Docker containers, forgotten Linux machines and unmaintained command-line tools that ship their own copy of the roots. Linux distributions are still rolling out updates, he added, and administrators will then need to apply them to many machines.

Source: Ars Technica