When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
An attacker anywhere in the path of your network traffic, like, say, in a company or government network, public Wi-Fi, your ISP, or one of any number of government entities, can intercept your connection and pretend that they're any website, like apple.com, amazon .com, or bankofamerica.com. If not updated, your operating system and installed software would be none the wiser. Additionally, with the code signing certificates, an application you download can be shown as completely legitimate from, say, Microsoft or Google .
The way that software checks a certificate is legitimate is by verifying its "chain." For example, a website like tomshardware.com has a certificate, issued and signed by an intermediate Certification Authority (or CA, a certificate-selling company), and whose certificate, in turn, is trusted and signed by root certificates — whose exceedingly precious keys are kept offline in safes. In this week's event, Indian CA firm eMudhra issued six TLS and two code-signing intermediate certificates with easily guessable keys.
Your operating system and potentially tens of different applications on your machine all keep a list of which root certificates and CAs are trusted. Browsers also keep a list of those not to trust, called a revocation list. These lists are updated periodically as screw-ups happen, just like the one that took place this week. And now they all need to be updated again, by revoking the eight CAs, removing the one affected root certificate, or just hard-coding a rejection of all eight affected keys.
There's a silver lining: recent versions of Chrome, Brave, Firefox, and Safari all enforce a feature called Certificate Transparency that consults a public read-only log of certificate issuances, and blocks any that aren't mentioned. Google reports that no certificates signed by the six affected intermediate CAs were logged, so if regular web browsing is all you did, you should be safe — but still check all your software for updates nonetheless.
Malicious VPN config files can let attackers run commands on Asus routers
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/leaked-private-keys-for-eight-ca-certificates-let-any-attacker-impersonate-any-domain-billions-of-older-devices-and-software-installations-may-be-vulnerable-after-round-of-fixes-patch-yours-immediately#main
- https://www.tomshardware.com/membership
- Kazakhstan Expands Compute for Its AI Future
- Illegal Nvidia Blackwell Ultra B300 GPUs found inside state-owned China Telecom's network
- The original Apple iPod debuted 25 years ago today
- Micron's next-generation 3D NAND to double bit density with over 400 layers, offering extreme performance
- Kazakhstan Expands Compute for Its AI Future
Informational only. No financial advice. Do your own research.