Vulnerable CAs threaten global software security

Weakened certificates allow any attacker to pretend to be any website or software maker. An attacker anywhere in the path of your network traffic can intercept your connection and pretend that they're any website, like apple.com, amazon.com, or bankofamerica.com. If not updated, your operating system and installed software would be none the wiser. Additionally, with the code signing certificates, an application you download can be shown as completely legitimate from, say, Microsoft or Google.

The way that software checks a certificate is legitimate is by verifying its chain. For example, a website like tomshardware.com has a certificate issued and signed by an intermediate Certification Authority, and whose certificate, in turn, is trusted and signed by root certificates. In this week's event, Indian CA firm eMudhra issued six TLS and two code-signing intermediate certificates with easily guessable keys.

Your operating system and potentially tens of different applications on your machine all keep a list of which root certificates and CAs are trusted. Browsers also keep a list of those not to trust, called a revocation list. These lists are updated periodically as screw-ups happen, just like the one that took place this week.

There's a silver lining: recent versions of Chrome, Brave, Firefox, and Safari all enforce a feature called Certificate Transparency that consults a public read-only log of certificate issuances, and blocks any that aren't mentioned. Google reports that no certificates signed by the six affected intermediate CAs were logged, so if regular web browsing is all you did, you should be safe, but still check all your software for updates nonetheless.

The problem here is the sheer amount of machines and software that needs updating: PCs, servers, operating systems, phones, tablets, routers, web browsers, web browsers wrapped in apps, virtual servers, virtual machines, Docker and other containers, programming languages like Python, Go, Node.js, Rust, standalone download utilities like curl, and probably tens or hundreds of other categories.