Apple Blocks eMudhra Certificates After Weak Key Discovery
Apple has blocked security certificates issued by eMudhra, a certificate authority whose private keys were found to be numerically weak, allowing attackers to impersonate websites. The fix, deployed on October 19, prevents Apple-based software from trusting these compromised credentials. While major browsers like Safari had additional safeguards, the discovery highlights vulnerabilities in certificate generation. Experts note that whether attackers actively exploited these keys before the patch remains unconfirmed, though the update protects Mac users relying on standard system checks.
Key points
- Apple blocked compromised security certificates from certificate authority eMudhra to prevent attackers from impersonating websites on its devices.
- Mozilla’s investigation revealed that eMudhra’s private keys were all numbers below 256, making them nearly instant to recover for attackers.
- The certificate blocks were introduced on October 19, according to Dennis Jackson, a cryptography engineer at Mozilla.
- Safari and other major browsers had additional certificate checks that likely prevented attacks through this specific route, though other software may have been vulnerable.
- It remains unconfirmed whether attackers actively exploited the compromised keys before Apple distributed the blocks to Mac users.
- Mac users utilizing affected command-line tools can find specific mitigation instructions and tests on Dennis Jackson’s website.
Apple has implemented a security update to block compromised certificates issued by eMudhra, a certificate authority whose weak encryption keys exposed users to potential website impersonation attacks. According to a report by BleepingComputer, Mozilla’s investigation determined that the private keys associated with these certificates were all numerical values below 256. This mathematical weakness meant the keys could be recovered almost instantly, allowing attackers to generate fraudulent certificates that vulnerable software would trust as legitimate.
The protective blocks were introduced on October 19, as noted in an advisory by Dennis Jackson, a cryptography engineer at Mozilla. These changes ensure that software relying on Apple’s system checks no longer trusts the compromised eMudhra credentials. While the update safeguards the broader ecosystem, Jackson observed that major browsers like Safari already included additional certificate validation layers that would have likely prevented attacks via this specific vector. However, the extent to which other applications were exposed remains a point of uncertainty.
The discovery underscores the importance of robust key generation in public key infrastructure. While Apple has distributed the blocks to Mac users, those relying on specific command-line tools may need to apply additional mitigations. Jackson has published tests and instructions on his personal website to help developers verify their systems. As of now, it is not yet clear if attackers actively exploited these weak keys before the patch was rolled out, but the move closes a significant gap in Apple’s security posture.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
