tech
eMudhra’s Weak Security Keys Trigger Global Browser Ban; Centre Orders Probe
Major web browsers have blocked eMudhra Ltd certificates after the company generated weak security keys.
Key points
- eMudhra Ltd generated eight security certificates with private keys so weak that one was simply the number 4.
- Google, Mozilla, Apple, and Microsoft blocked the certificates to prevent unauthorized issuance of website certificates.
- No evidence has emerged so far that the weak security keys were misused.
Why it matters. The lapse could provide phishing gangs and eavesdroppers an opportunity to exploit the system and may require extensive remediation for routers and payment terminals.
Major web browsers including Google, Mozilla, Apple, and Microsoft have blocked security certificates from eMudhra Ltd after the company generated keys that were too weak. The Union government has formed a special team to investigate the incident. Security experts warned the Hindustan Times that the lapse undermines the global internet's chain of trust.
Latest updates
eMudhra’s Weak Security Keys Trigger Global Browser Ban; Centre Orders Probe
Possession of these keys could have allowed anyone to issue certificates for websites across the internet, including bank websites and government portals. A Bengaluru-based company trusted by major web browsers to authenticate websites generated eight security certificates with private keys so weak that they could be recovered within seconds. Google, Mozilla, Apple and Microsoft have blocked the certificates, while the Union government has formed a special team to investigate the incident. The keys belonged to the listed certifying authority eMudhra Ltd. Instead of being randomly generated numbers roughly 116 digits long, the keys were so weak that one of them was simply the number 4. Possession of these keys could have allowed anyone to issue certificates for websites across the internet, including bank websites and government portals. Such certificates act as digital identity cards, allowing browsers, phones and computers to verify a website’s identity and treat it as genuine. No evidence has emerged so far that the keys were misused. The major browsers also had a safeguard that would have exposed attempts to target their users. However, security experts have warned that the lapse undermines “the global internet’s chain of trust”. Since a trusted certificate authority can authenticate any website, a failure at one company could affect organisations that have never dealt with .
Centre Probes eMudhra After Global Browsers Ban Weak Security Keys
Major web browsers including Google, Mozilla, Apple, and Microsoft have blocked security certificates issued by eMudhra. The Bengaluru-based company generated eight certificates with private keys so weak they could be recovered within seconds. Such a vulnerability could have allowed unauthorized parties to issue certificates for government portals and bank websites. The Union government has formed a special team to investigate the security breach.
Global Browsers Block eMudhra Certificates Over Weak Security Keys
Major web browsers have banned certificates issued by eMudhra due to critical security vulnerabilities. The company generated eight certificates with private keys so weak they could be compromised within seconds, potentially allowing attackers to impersonate government and banking portals. The Union government has formed a special team to investigate the breach. The incident poses a significant risk to global website authentication.