r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

800 Upvotes

95% Upvoted

213 comments sorted by

View all comments

191

u/cornmonger_ 1d ago

well that's the end of eMudhra

On October 20, it was discovered that the private component associated with one of the revoked intermediary certificates was simply the number 4, far smaller than the entropy usually required of cryptographic material.

126

u/Padgriffin 1d ago

I’m jaded enough to not expect consequences out of companies at this point but this is just stupid enough to explain to laypeople how horribly badly they fucked up

“What do you mean their password was the number 4”

58

u/Upstairs-Animator878 1d ago edited 1d ago

other 7 were also 2 or 3 digits only.

EM DV TLS CA - G3B eMudhra BV (NL) 156
EM DV TLS CA - G3C eMudhra Inc (US) 230
EM EV TLS CA - G3B eMudhra BV (NL) 115
EM EV TLS CA - G3C eMudhra Inc (US) 56
EM OV TLS CA - G3B eMudhra BV (NL) 155
EM OV TLS CA - G3C eMudhra Inc (US) 4
EM OV CS CA - G3B eMudhra BV (NL) 66
EM OV CS CA - G3C eMudhra Inc (US) 237

11

u/trunksta 19h ago

How were these not hacked ages ago

4

u/ILoveTolkiensWorks 11h ago

i do not think ANY sane human could ever have even dreamt of the sheer scale of the dumbassery involved here. who would've even tried brute-forcing private keys anyways lol (except the guy that discovered this, ofc)