Tech Giants Block eMudhra Certificates Linked to 8 Compromised Keys

Major technology platforms have moved to block certificates issued by the Indian certificate authority eMudhra. According to a report by Dark Reading, this action follows the discovery that eight private keys from the provider were compromised. The swift response indicates that the threat posed by these specific keys was considered significant enough to warrant immediate revocation across multiple ecosystems.

Which platforms blocked the certificates?

Several major technology organizations participated in the blocking effort. Google, Mozilla, and Apple were among the entities that moved swiftly to block the affected certificates. The Go project also joined the list of organizations that took action against the compromised credentials. This broad coalition suggests that the affected certificates were widely trusted or utilized across different software environments and operating systems.

How many keys were involved?

The incident specifically involves eight compromised private keys. Dark Reading reported that these keys were tied to the certificates now being blocked by the tech giants. The number eight represents the specific count of cryptographic assets that were determined to be insecure. This limited scope allows defenders to focus their attention on certificates signed by these specific keys rather than the entire output of the authority.

How were the keys compromised?

The exact method used to compromise the eight private keys remains unclear. According to the report from Dark Reading, it is not yet known how the attackers gained access to these sensitive cryptographic materials. Without a confirmed attack vector, security teams cannot assume a specific cause such as a software bug or insider threat. This uncertainty means that the broader security posture of the certificate authority may still require further investigation.

What does this mean for defenders?

Security operations teams should treat this as a confirmed compromise of trust anchors. The fact that major vendors blocked the certificates suggests that relying on them poses a risk of man-in-the-middle attacks or impersonation. Teams need to verify if any services or applications within their infrastructure were using certificates signed by these specific keys. The lack of clarity on the compromise method means that caution is warranted until more details emerge about the scope of the breach.

Detection notes

Teams usually start by reviewing certificate transparency logs for any new issuances from the affected authority. Check internal web servers and client applications to see if they are still trusting the compromised keys. Look for alerts from security information and event management platforms that flag revoked certificates.

Monitor for unusual TLS handshake failures or errors in application logs that might indicate a blocked connection. If a service is found using a compromised certificate, isolate the system to prevent potential data interception. Review network traffic for signs of man-in-the-middle activity during the period the keys were active. Ensure that all endpoints have updated their root stores to reflect the revocation status.

Background: Man-in-the-middle attacks

A man-in-the-middle attack occurs when an adversary secretly relays and possibly alters the communication between two parties who believe they are directly interacting. This theft happens during data transmission, allowing the attacker to steal credentials or inject malicious commands without either victim knowing the connection is compromised.

Read the full guide: Man-in-the-Middle Attacks: How They Work and How to Stop Them

What to do and how to stay safe: eMudhra

• Audit your infrastructure to identify any services using certificates issued by eMudhra, specifically those signed by the eight compromised keys.
• Update your systems to ensure they recognize the blocked status of these certificates, relying on the latest root store updates from vendors.
• Monitor application logs for connection errors or TLS failures that may indicate attempts to use the revoked certificates.
• Verify that your security tools are configured to reject certificates from certificate authorities that have had key compromises.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which companies blocked the eMudhra certificates?

Google, Mozilla, Apple, and the Go project blocked the affected certificates according to Dark Reading.

How many private keys were compromised in this incident?

Eight private keys from the Indian certificate authority eMudhra were compromised.

Is it known how the keys were compromised?

No, the report states that it is unclear how the keys were compromised.