r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

800 Upvotes

95% Upvoted

213 comments sorted by

View all comments

Show parent comments

19

u/C0rn3j 1d ago

0x73? Eh?

46

u/nekoeth0 1d ago edited 1d ago

Yeah, so, they were trivially easy to crack if you know a bit of math and how ECC works.

So, for EMEVTLSCAG3B, once cracked, you end up with this:

$ openssl ec -in pk.pem -text -noout Private-Key: (384 bit) priv: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:73 pub: 04:25:db:a8:5a:64:d3:97:da:0b:10:52:e9:ea:54: 6e:48:7b:ef:ea:9c:9d:9d:68:a0:c5:ea:dc:fe:ef: 75:a6:9b:b5:d6:fc:01:f4:2b:fb:ca:6e:b4:0b:cd: 64:c0:76:7e:36:ff:d0:5d:97:a8:13:c5:aa:0c:6c: 95:30:e7:9c:f5:f0:86:64:68:f1:38:06:42:0a:a5: c8:51:84:0b:1e:25:25:40:e7:90:e4:b6:54:c3:85: 2e:d6:4a:f1:e8:65:7d ASN1 OID: secp384r1 NIST CURVE: P-384

Hell, EM OV TLS CA - G3C has 0x4 as its private key.

Edit: Primer on how I got that: You have the NIST P384 curve and its parameters, you also have the (X, Y) coordinates from the public key. To get the private key, you basically brute force it by multiplying k (the private key) against P384 base parameter G; thing is, P384 is supposed to give you 2192 bits of security (i.e., 2192 operations to crack) IF YOU USE A PROPER CRNG. These guys went the xkcd route, https://xkcd.com/221/

28

u/Padgriffin 1d ago

This might be the single funniest security incident ever, what the fuck do you mean your private key was 4, how does that even happen

2

u/florinandrei 13h ago

how does that even happen

Sheer stupidity seems to be the explanation.