Eight weak security certificates let attackers forge trusted credentials
Eight intermediate TLS certificates with keys of just 3-8 bits instead of 384 allow anyone to instantly forge trusted credentials for any website.
Security teams worldwide are scrambling after the discovery of eight compromised TLS certificates from India-based eMudhra Limited that expose the internet to mass forgery attacks. The private keys were so weak, ranging from 3 to 8 bits, that attackers can recalculate them almost instantly and create fake certificates trusted by millions of servers.
Browsers moved fast: Firefox, Chrome and Apple blocked all eight intermediates within days. The real problem is everything else.
Linux distributions, IoT devices, embedded systems and forgotten servers still run unpatched. The cleanup will take years and touch hundreds of millions of devices, similar in scale to the 2014 Heartbleed crisis.
VPN users face the highest immediate risk. For everyone else, exposure depends on whether their devices trust the compromised certificates and whether they update before attackers act.
- 8 issued by eMudhra Limited
- Weak certificates
- 3 to 8 bits instead of 384
- Key strength
- Heartbleed in 2014
- Prior similar crisis
- Hundreds of millions
- Devices affected
Why it mattersAttackers who control your network (a coffee shop, airport, office) could intercept, read and modify your encrypted traffic if your device hasn't patched.
AustraliaAustralian browser users are protected now, but anyone running legacy Linux machines, older routers, IoT devices or custom applications may stay vulnerable for months or years until they apply patches.
Open this story in InSnip →
