r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

801 Upvotes

95% Upvoted

213 comments sorted by

View all comments

Show parent comments

42

u/nekoeth0 1d ago edited 1d ago

0x73 for G3B

No, I'm not lying.

Edit: EM OV TLS CA - G3C has 4 as its private key. The number 4. 0x4.

16

u/C0rn3j 1d ago

0x73? Eh?

48

u/nekoeth0 1d ago edited 1d ago

Yeah, so, they were trivially easy to crack if you know a bit of math and how ECC works.

So, for EMEVTLSCAG3B, once cracked, you end up with this:

$ openssl ec -in pk.pem -text -noout Private-Key: (384 bit) priv: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:73 pub: 04:25:db:a8:5a:64:d3:97:da:0b:10:52:e9:ea:54: 6e:48:7b:ef:ea:9c:9d:9d:68:a0:c5:ea:dc:fe:ef: 75:a6:9b:b5:d6:fc:01:f4:2b:fb:ca:6e:b4:0b:cd: 64:c0:76:7e:36:ff:d0:5d:97:a8:13:c5:aa:0c:6c: 95:30:e7:9c:f5:f0:86:64:68:f1:38:06:42:0a:a5: c8:51:84:0b:1e:25:25:40:e7:90:e4:b6:54:c3:85: 2e:d6:4a:f1:e8:65:7d ASN1 OID: secp384r1 NIST CURVE: P-384

Hell, EM OV TLS CA - G3C has 0x4 as its private key.

Edit: Primer on how I got that: You have the NIST P384 curve and its parameters, you also have the (X, Y) coordinates from the public key. To get the private key, you basically brute force it by multiplying k (the private key) against P384 base parameter G; thing is, P384 is supposed to give you 2192 bits of security (i.e., 2192 operations to crack) IF YOU USE A PROPER CRNG. These guys went the xkcd route, https://xkcd.com/221/

28

u/Padgriffin 1d ago

This might be the single funniest security incident ever, what the fuck do you mean your private key was 4, how does that even happen

17

u/nekoeth0 1d ago

I have my conspiracy theories, as there is no way anyone could be this incompetent and issue this many bad intermediates. The largest private key I found was 237 (0xed) for EM OV CS CA - G3C (SN 544B7F922C31AE220A4A922916F6E6 and D6A5EF613B390F32EF9CDF349F772841)

``` Processing EM OV CS CA - G3C (544B7F922C31AE220A4A922916F6E6)... Private key found: k = 237 (hex: 0xed) in 0.1929 seconds

Processing EM OV CS CA - G3C (D6A5EF613B390F32EF9CDF349F772841)... Private key found: k = 237 (hex: 0xed) in 0.1931 seconds ```

23

u/Padgriffin 1d ago

Per this Bugzilla Report:

We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

Also from eMudhra:

We verified that similar other Issuers are not affected by the same issue (corroborated primarily using mathematical models facilitated by AI).

Somehow that does not give me much confidence

9

u/belovedeagle 1d ago

corroborated primarily using mathematical models facilitated by AI

What is that even supposed to mean? They checked up to 210 or what?

1

u/Leliana403 13h ago

as there is no way anyone could be this incompetent

Have you met gestures vaguely towards the average person?

1

u/florinandrei 13h ago

there is no way anyone could be this incompetent and issue this many bad intermediates

eMudhra: hold my beer.

2

u/florinandrei 13h ago

how does that even happen

Sheer stupidity seems to be the explanation.

1

u/tyami94 12h ago

its the ps3 hack all over again lmfao

1

u/I_Shot_Web 9h ago

they must have misunderstood 256 bit to mean 0-256