Compromised Certificates

I’ve briefly seen the news regarding compromised intermediate certificates from some unknown CA (eMudrah) yesterday, but quickly dismissed them. I was like, shit happens, something leaked, certificates were already revoked, I was not affected, all good.

Well, it appears the problem was much bigger.

After a security researcher posted private keys for all certificates on GitHub (note the repository name), it has become clear that they weren’t private at all. Instead of 384 bits long random numbers, astonishingly, they were literally 4, 56, 66, 115, 155, 156, 230, 237.

And while you’re trying to comprehend this, an obligatory reminder of this timeless XKCD comic.

How could this even be possible? The most plausible explanation is that these keys originated from some test environment, which was accidentally pushed to production. Anyway, I’d call it the biggest security issue ever.

Internet and computers in general run on trust. You as a user trust developers of the operating system and browser you use, the internet provider, and so-called Certificate Authorities, who issue certificates protecting HTTPS sites. The chain of trust is as strong as its weakest point. And yesterday it appeared to be very weak.

I personally am going to review all online security measures I take. And I already have many in place, it’s just you always need to be a step ahead.

Subscribe to all blog posts via RSS