Skip to content
securitytabs

LiveUpdated

Eight eMudhra Certificate Authority Keys Compromised

Secret keys for eight certificates issued by the certificate provider eMudhra were found to be compromised, which could let attackers impersonate websites. Browser and security vendors are responding; most organizations need only confirm their systems receive trust updates.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Google says the Chrome Root Program received a report from a security researcher about the compromise of private keys tied to eight eMudhra subordinate Certification Authority (CA) certificates, the intermediate certificates that sit under a trusted root and are used to issue website certificates. Google published a post on how it is protecting Chrome and Android users. [1]

Cisco Talos says it is aware of eight compromised intermediate certificates belonging to eMudhra. It says that rather than having the mandatory 384 bits of pseudo-random security, several of the private keys evaluated to single-digit and double-digit integers. [2]

Risk

Palo Alto Networks says the eight compromised intermediate CA private keys risk unauthorized TLS signing and man-in-the-middle interception, where an attacker sits between a user and a site. It has published an analysis and a containment guide. The excerpts available do not say whether the keys have been used in attacks, and no attacker has been named. [3]

Timeline

  1. Palo Alto Networks published an analysis and containment guide. [3]

  2. Cisco Talos described the eight compromised intermediate certificates. [2]

  3. Google published its response to the compromised eMudhra intermediate CA certificates for Chrome and Android. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

The sources describe protections for browsers and operating systems; no step specific to small businesses has been published in the available excerpts. [1]

What to do

  1. Keep Chrome, Android and other browsers and operating systems on automatic updates so they receive Google's protections. [1]
  2. Ask your IT provider whether they are following the vendor guidance on the eMudhra certificates. [2][3]

Mid-size company

A small IT or security team

What to know

Palo Alto Networks warns the keys could enable unauthorized TLS signing and interception; it has published a containment guide. [3]

What to do

  1. Review the Palo Alto Networks containment guide and the Cisco Talos write-up. [3][2]
  2. Confirm that managed browsers and devices are receiving updates that address the compromised intermediate certificates. [1]

Large enterprise

A security operations team

What to know

Talos and Palo Alto Networks have published analysis of the eight compromised intermediate certificates; no attacks or attribution are described in the available excerpts. [2][3]

What to do

  1. Apply the containment steps in the Palo Alto Networks guide to your environment. [3]
  2. Check where your estate trusts certificates chaining to eMudhra and follow the vendor guidance from Google and Talos. [1][2]

Sources

  1. [1]Google Security Blog · Oct 20, 19:49 UTC
    Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificatescontext
  2. [2]Cisco Talos · Oct 21, 20:43 UTC
    Compromised eMudhra intermediate certificatescontext
  3. [3]Palo Alto Unit 42 · Oct 22, 17:15 UTC
    EMudhra Intermediate CA Certificates Compromisedcontext