Chrome and Firefox have blocked flawed eMudhra security certificates

Google and Mozilla scrambled over the weekend to block eight compromised security certificates issued by the authority eMudhra. If they had not stepped in quickly, anyone on the internet could have used these flawed certificates to impersonate real websites and spy on your browser traffic.

This whole ordeal started on Saturday when a security researcher named Wayne noticed that the private keys for eight intermediate certificates were generated with weak randomness.

One researcher on an IFIN threat intel thread even pointed out that the private key for at least one of these certificates was literally just the number 4.

Because the math behind the keys was so weak, anyone could figure them out directly from the public certificates. To prove it, Wayne used the cracked keys to sign a casual message reading “We have a problem here” and sent it straight to the browser teams.

Google’s Chrome security team verified the report and pushed out an emergency block in less than two hours. Because the block was handled remotely through Chrome’s background revocation system, desktop users were protected right away without restarting their browsers.

Android users and Chromebooks got the same fix through Google Play Services later on Monday. If you want to force that update on your phone right now, simply restarting your device will do the trick. This development comes as Google enlists AI to sniff out fake antivirus warnings and phishing traps in Chrome, keeping folks safe on another front.

Over at Mozilla, engineers rolled out a remote block through their OneCRL system in under three hours. They also pushed out the Firefox 158.0.1 update on Tuesday to make sure people with custom network settings are covered too.

“An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic,” the Mozilla security team explained in their write-up.

Both browser makers are now stripping the main eMudhra root certificate out of their trust stores completely. Google noted that “to avoid breakage, website operators with certificates chaining to emSign ECC Root CA – G3 must immediately acquire and install a new TLS certificate” before Tuesday, October 27.

That said, while most netizens like us are now safe, developers and sysadmins still have some work to do. Cloudflare had to rush out patches for its WARP client and backend tools, and anyone curious about the deeper technical weeds or looking to test their own setup can check out Dennis Jackson’s tracking site.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.