eMudhra CA private keys compromised

neighhouse · October 21

I'm surprised there hasn't been a post about this but anyways

Sources:

https://blog.cloudflare.com/emudhra-certificate-compromise/
https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Cloudflare published a write-up on the eMudhra certificate incident yesterday. Eight eMudhra intermediate CA certificates had weak private keys, making it possible to derive the keys and forge certificates for arbitrary domains.

That is perhaps a fairly serious WebPKI failure. If an attacker had one of those keys and was in a position to intercept traffic, they could potentially impersonate servers and intercept or modify TLS traffic for clients that still trusted the affected intermediate.

The browser side is relatively straightforward because Chrome, Firefox and others have mechanisms for rapidly distrusting certificates. The more annoying problem is everything outside browsers: old containers, bundled CA stores, language runtimes, appliances and applications that use their own certificate verification path. They specifically points out that passing a browser or curl test does not necessarily mean another application on the same system is protected.

If you run long-lived containers or software with its own CA bundle, it is probably worth checking what trust store it actually uses and rebuilding/updating where necessary. Python's requests component uses a certifi bundle for example.

Saw someone mention on X mitm'd TLS on an iPod Touch 4 without installing a CA cert on it, a perfect example of a old device that will likely never get an update. Haven't replicated it myself in old IoT but will be interesting!

The slightly insane part is that all eight affected P-384 private scalars were below 256. One of the recovered private values was reportedly 4.

neighhouse · October 21

Obligatory mention: https://xkcd.com/221/

Yes the key to the internet (at least was) is 4.

rpqu · October 21

Can't catch a break

david · October 21

I guess this was the reason for the ca-certificates updates.

ScreenReader · October 21

the most restarted thing i ever read (so far). gross incompetence. emudhra need to be culled for this mistake alone.
you can't make this shit up

Void · October 21

eMudhra sounds very Indian
First time hearing about it though

neighhouse · October 21

@Void said:
eMudhra sounds very Indian
First time hearing about it though

Yes I looked them up. Indian company founded in 2008, gets govt contracts, founder is non-technical has a CA (Chartered Accountany), family-run business. Stalked LinkedIn, higher security dude has a CEH and most members don't look like they have been there for more than 3-4 years but that last bit is wonky. Their stocks tanked 20% after the incident as well.

That is all about them I got from Indian Twitter and my own research.

neighhouse · October 21

@ScreenReader said:
the most restarted thing i ever read (so far). gross incompetence. emudhra need to be culled for this mistake alone.
you can't make this shit up

I don't mean to add fire to accuse them but this reeks of being intentional rather than incompetency.

stable_genius · October 21

@neighhouse said:

@ScreenReader said:
the most restarted thing i ever read (so far). gross incompetence. emudhra need to be culled for this mistake alone.
you can't make this shit up

I don't mean to add fire to accuse them but this reeks of being intentional rather than incompetency.

Don't think so, there's no malice just incompetence. Yo are overestimating them.

averagedatahoarder · October 21

4

woinokiz · October 21

Is it because of laziness?
Using 4,56 as keys

ScreenReader · October 22

@neighhouse said: Saw someone mention on X mitm'd TLS on an iPod Touch 4 without installing a CA cert on it, a perfect example of a old device that will likely never get an update. Haven't replicated it myself in old IoT but will be interesting!

someone need to try mitm on hp printers