eMudhra's Security Key Breach Sparks Global Alarm
A significant leak of private keys from eMudhra Ltd. has raised security concerns for government websites and major browsers worldwide.
Eight private keys from eMudhra, used for web security, were leaked.
The flaw involved weak numerical keys, making them easy to exploit.
eMudhra has revoked the affected certificates and is investigating the incident.
A serious security breach has been reported involving eight private keys from eMudhra Ltd., a Bengaluru-based company that issues web security certificates. This leak has prompted urgent actions from security teams at major internet browsers and operating systems globally, as these keys are utilized by various government websites to authenticate their security certificates. The incident highlights vulnerabilities in the digital infrastructure that are critical for maintaining trust in online communications.
The issue came to light when an anonymous researcher notified key internet infrastructure firms about a significant flaw in the intermediate security certificate keys issued by eMudhra. Instead of employing a robust 384-bit private key, these certificates contained weak numerical keys ranging from 1 to 256, drastically reducing their security. For instance, one of the compromised keys was simply the number 4, preceded by 383 zeros, making it alarmingly easy to deduce.
Dennis Jackson, involved in Mozilla’s response to the breach, emphasized the ease of exploiting eMudhra’s private keys, noting that six of the affected certificates were trusted by major browsers including Chrome, Mozilla, Microsoft, and Apple. In response to the breach, eMudhra has revoked the compromised certificates and initiated an incident response plan to mitigate the impact on users and the integrity of the web security ecosystem.
Despite the severity of the leak, eMudhra stated that none of the affected intermediate Certificate Authorities (CAs) were deployed in production, except for one, which has not issued any end-entity certificates. The company is currently investigating the root cause of the flaw, which was attributed to a mishap during the Key Generation Ceremony that resulted in the creation of weak keys alongside the intended strong ones.
Experts warn that the ramifications of this leak could extend beyond immediate browser patches, potentially affecting Internet of Things (IoT) devices that may not receive timely updates to address such security issues. Yash Kakadia, founder of the Security Brigade, highlighted the extensive cleanup efforts required for devices that cannot be easily updated. Many government services, including the Aadhaar issuer UIDAI and income tax portals, rely on eMudhra’s certificates, raising further concerns about the security of sensitive data. The Ministry of Electronics and Information Technology has been contacted for comments, and updates will follow as new information emerges.
