Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.
https://emudhra.we-have-a-problem.com/
First: Who the fuck is eMudhra?
Second: What catastrophic failure of process allows a single point of failure Indian company to compromise the entire internet as we know it by accidentally releasing debug code? Why is it so fragile in the first place?
eMudhra is an intermediary certificate authority. some of the most popular intermediary CAs* are Sectigo, GlobalSign, MilesWeb, and GeoTrust. would you \^_^/ like to tell me who the heck ✨ these✨ are?
HTTPS has always had a failsafe called certificate revocation. it is working. at least, until the recent cultural shift of ethical hackers towards disclosing security vulnerabilities immediately for some reason
barring said cultural shift, the situation would not have been much different if any intermediary’s key leaked through normal means, which has happened
* LetsEncrypt is more popular than all of those, and Digicert and GoDaddy are more popular than half of those. But that’s where the name recognition ends.
There is no reasonable way to be an ethical hacker when the companies you are hacking are not ethical themselves.
If they refuse to pay bounty programs, and refuse to fix the security vulnerabilities, there’s just no way to do security research.
If you don’t wanna get hit by security issues, get as far away as possible from these companies.
how would I get away from intermediary CAs? i also don’t see indications eMurdha refused to fix the vulnerability when reported
I didn’t say it’s easy. It’s just the only way. First step would be removing them from the list of trusted CAs installed on your devices.
And of course, security flaws chain together. So if you don’t trust Microsoft office, you basically can’t trust any commercial product in existence.
But at least you can avoid being a direct customer of them, even if you’re still an indirect one.
It is a problem we all have with dns, namely that the way it works now means we all must trust upstream CAs.
And unfortunately, we will probably suffer a few more of these before we switch over to a voting peer system.
DNS requires consensus (on who owns which name). So if by “voting peer system” you are talking about decentralized consensus, then blockchain is one of the only systems of such kind.
If you don’t want blockchain, then there’s no real choice other than a centralized system like CAs.
Eh, blockchain wouldn’t work here because changes to the ledger on the scale of DNS would take an astronomical amount of time to propagate. Blockchain would solve “source of truth” issues, but waiting 30 seconds or more every to.e you open your browser or curl to update the list of changes to the CRL wouldn’t be an acceptable working solution.
The problem of “voting peers” I mentioned would more easily be solved by a mechanism closer to how clusters decide which members are reliable and which should be deemed faulty. The problem is to instantly make changes to the CRL that are believable and take effect immediately.
Blockchain can’t do that in a timely way.
I believe you’re talking about RAFT. That requires trusting all nodes, so it’s not any different from how CAs already work. After all, the issue at hand is a compromised CA.
You lost me, none of that is true.
That’s not what happened at all. Read the article.
if the keys are compromised, the CA is considered compromised until it is updated. from a black-box perspective this is not different from the CA’s keys being leaked.
Not quite.
From: https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/:
This did not happen like the verisign compromise, where someone posed as a Microsoft employee and got certs with Microsoft’s name on them, which was a problem for all other Microsoft certs for servers and clients.
i think we’re talking different definitions of compromised here. the end result either way is bad actors have all the certs. what credentialing system does your voting system require of the authorities?