Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
Summary
The private keys of Indian certification authority eMudhra have been compromised. One of the compromised keys was the extremely simple value '4'. This breach has led to a significant clean-up operation as it enables the potential impersonation of any website or service.
IFF Assessment
The compromise of a Certificate Authority's private keys is a severe security incident that allows attackers to impersonate legitimate websites and services, directly harming defenders and users.
Defender Context
This incident highlights the critical importance of securing the root infrastructure of trust on the internet, namely Certificate Authorities. Defenders need to be vigilant about detecting and mitigating the effects of potentially forged certificates in their environments and prepare for an increase in sophisticated phishing and impersonation attacks.