The Internet goes on high alert after discovery of 8 compromised TLS certs
摘要
全球安全人员处于高度戒备状态，此前发现八张TLS证书的私钥强度过弱，可能被用于为任意网站伪造受信任的浏览器和应用凭据。截至周二上午，浏览器厂商及部分主要应用和编程语言已封堵全部八张中间证书。目前尚无证书透明度日志显示这些泄露密钥被恶意使用，但威胁远未结束，因为更新Linux发行版及嵌入式与物联网设备等互联网关键部分将困难且耗时。这八张中间证书属于印度证书颁发
Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet-of-things devices.
One word: bonkers
The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over the weekend posted the message “We have a problem here - Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers around the world.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧