The Indian government’s cybersecurity agency CERT-In has issued an urgent warning after a security breach at eMudhra exposed private keys linked to eight digital security certificates.
\n\nThese certificates help websites and applications prove their identity and establish secure connections. CERT-In said the affected keys were generated using weak randomisation, making them easy to recover. An attacker who obtained the keys could potentially intercept encrypted communications, the agency warned.
\n\nCERT-In flagged security lapses in the incident and recommended steps for government departments and businesses to reduce the risk. Technology companies, including Mozilla and Google, have also taken emergency measures to block the affected certificates.
\n\nShares of eMudhra, which provides digital security and document-processing technology, fell as much as 20% on Wednesday, October 21, following the disclosure.
\n\nIn a blog post, eMudhra cited a Mozilla update saying the private keys linked to eight of its intermediate certificates had been compromised on October 17.
\n\nMozilla has blocked the affected certificates in its Firefox browser through OneCRL, a list used to prevent revoked certificates from being trusted. It is also updating its list of trusted certificates to remove the root certificate that authorised the affected certificates. This is intended to protect applications that rely…
Original source: https://www.cnbctv18.com/technology/
