印度证书颁发机构eMudhra Limited的8张中间TLS证书的私钥被发现强度过弱1，这些密钥可能被滥用用于为互联网任何站点签发受信任的浏览器和应用凭证1。周末有人通过在emudhra.we-have-a-problem.com发布非正式公告，使用eMudhra证书私钥进行数字签名，证实了对该密钥的控制1，随即触发全球网络安全警报。
浏览器制造商和主要应用已在周二上午采取应对措施，阻止了全部8张中间证书1。截至报道时，证书透明度日志未显示被盗密钥被恶意使用1。不过，更新Linux发行版、嵌入式设备和物联网设备等系统仍需长期工作1。
Private keys belonging to eight intermediate TLS certificates issued by Indian certificate authority eMudhra Limited have been found to possess weak cryptographic strength, raising the risk that they could be exploited to forge trusted credentials for any website on the internet.1 Over the weekend, an individual posted an informal notice on emudhra.we-have-a-problem.com and used digital signatures generated with eMudhra's private keys to demonstrate control over the compromised material.1 The disclosure triggered a global cybersecurity response, with major browser manufacturers and applications moving to block all eight intermediate certificates by Tuesday morning.1
At the time of reporting, certificate transparency logs showed no evidence that the stolen keys had been used maliciously to issue fraudulent certificates.1 However, organizations face significant long-term challenges in addressing the vulnerability, as updating security patches across Linux distributions, embedded systems, and Internet of Things devices remains a complex undertaking.1
评论
还没有评论，欢迎留下第一条。