Mudhra | Crypto

CertiK says crypto trading bots and exchange applications may remain exposed to the eMudhra certificate flaw because browser fixes may not protect all software. Cryptocurrency trading bots and exchange applications may remain exposed to the eMudhra certificate security flaw despite emergency fixes from major technology companies, according to blockchain security company CertiK. By Tuesday, tech giants including Google, Apple and Microsoft had blocked eight vulnerable certificates issued by India’s eMudhra, but the fixes may not protect crypto applications using separate security systems, CertiK’s senior director of digital assets security, Peiyu Wang, told Cointelegraph. “Major browser blocks substantially reduce the risk for clients that receive and enforce them,” Wang said. “Some applications outside the browser ecosystem do not enforce Certificate Transparency or receive the same revocation protections.” Read more

A private key generation flaw allowed anyone to guess them and forge HTTPS certificates for any website. Tech giants have deployed emergency blocks against eight vulnerable digital certificates that could allow attackers to impersonate legitimate websites. By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after discovering that their private keys were insufficiently secure.  Mozilla cryptography engineer Dennis Jackson wrote in an incident report that Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.”  Read more