1 hour ago
The Indian government’s cybersecurity agency CERT-In has issued an urgent warning after a security breach at eMudhra exposed private keys linked to eight digital security certificates.
These certificates help websites and applications prove their identity and establish secure connections. CERT-In said the affected keys were generated using weak randomisation, making them easy to recover. An attacker who obtained the keys could potentially intercept encrypted communications, the agency warned.
CERT-In flagged security lapses in the incident and recommended steps for government departments and businesses to reduce the risk. Technology companies, including Mozilla and Google, have also taken emergency measures to block the affected certificates.
Shares of eMudhra, which provides digital security and document-processing technology, fell as much as 20% on Wednesday, October 21, following the disclosure.
In a blog post, eMudhra cited a Mozilla update saying the private keys linked to eight of its intermediate certificates had been compromised on October 17.
Mozilla has blocked the affected certificates in its Firefox browser through OneCRL, a list used to prevent revoked certificates from being trusted. It is also updating its list of trusted certificates to remove the root certificate that authorised the affected certificates. This is intended to protect applications that rely on Mozilla’s certificate list but do not receive OneCRL updates.
eMudhra said it began its incident-response process after learning of the breach. It has taken steps to contain the affected certificates and is working with browser makers and operators of trusted certificate systems to protect users and limit the impact on the wider web security system.
