Compromised security certificates blocked in Chrome, Firefox

Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or services, according to Google and Mozilla. “On 17th October @ 20:06 UTC, Mozilla received a report to certificates@mozilla.org, forwarded by the Chrome Root program, that the private key of 8 eMudhra Intermediate certificates have been compromised,” Dennis Jackson, a member of Mozilla’s engineering team, wrote in a public Mozilla bug report. “An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.” Mozilla independently recovered the keys later that day, confirming that they were vulnerable. “Mozilla was able to recover the private keys for the impacted certificates independently @ 21:48 UTC and without any knowledge of the method the original reporter used,” Jackson added in the report. He said the recovery confirmed that “the key generation process was flawed and is trivial to exploit.” The report was submitted by a researcher identified as Wayne and forwarded by the Chrome Root Program. …

≈