Leaked SSL Intermediate Certificates: https connections cannot be trusted

[u/moanos]

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

[u/spreedx]

How did that happen? 

[u/moanos → u/spreedx]

I think we don't know yet. However the Chrome security team pulled the Root Certificate of the CA although that one has no indication of being affected, indicating that they don't trust the CA to properly handle certificates at all

Source: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE?pli=1

[u/argh523 → u/moanos]

Well, according to another commenter, some of their private keys are the numbers "4" and "115", so yeah, nobody should trust this company or anyone who worked there every again. It's impossible for this to not be deliberate

[u/calinet6 → u/argh523]

If that’s true, then the certificate keys weren’t so much leaked as never secure in the first place… jesus.

[u/Upstairs-Animator878 → u/argh523]

EM DV TLS CA - G3B	eMudhra BV (NL)	156
EM DV TLS CA - G3C	eMudhra Inc (US)	230
EM EV TLS CA - G3B	eMudhra BV (NL)	115
EM EV TLS CA - G3C	eMudhra Inc (US)	56
EM OV TLS CA - G3B	eMudhra BV (NL)	155
EM OV TLS CA - G3C	eMudhra Inc (US)	4
EM OV CS CA - G3B	eMudhra BV (NL)	66
EM OV CS CA - G3C	eMudhra Inc (US)	237

yes

[u/Double-Lobster6107 → u/Upstairs-Animator878]

I saw someone saying they literally though 384 bit meant pick a number between 1 and 384.

[u/florinandrei → u/argh523]

It's impossible for this to not be deliberate

Attributing to malice what could more easily be explained by sheer stupidity is almost always wrong.

[u/nekoeth0 → u/spreedx]

Incredibly low entropy private keys. Your TSA combination lock chances are has more entropy than eMudhra's private keys.

[u/RunasSudo → u/nekoeth0]

"4? That's amazing! I've got the same (number of digits in the) combination on my luggage."

[u/spin81 → u/spreedx]

They themselves say it was the (indirect?) result of a bug in a script used to generate the keys.

The comment is a bit vague. If I'm reading it right they generated some proper keys and also some insecure ones, stored everything on the same HSM, and made the names too similar so they used the insecure ones in production instead of the proper ones. Or that's what it seems to me?

These people are Indian so there may be a language barrier here. Also they're probably freaking out right now so they may have a couple of brainfarts in a comment here and there. I hope someday we'll get a proper postmortem.

[u/KsiaN → u/spreedx]

Do you really think the rate at which Playstation games are being ported to PC are just a coincidence?

Someone discovered a mayor breakthrough and is playing it the old LulzSec way.

[u/Leliana403 → u/KsiaN]

Sony bought Nixxes in 2021 to port its own games. There's your breakthrough.

playing it the old LulzSec way

LulzSec used SQL injection on Sony and dumped it all on Pastebin. The person behind the leak this thread is about sent signed proof to the root programs and kept quiet until every major browser had blocked the keys. When did LulzSec ever give anyone a head start?

[u/KsiaN → u/Leliana403]

So its still not fully concluded, even 20 years later :3

[u/Leliana403 → u/KsiaN]

What