The Internet goes on high alert after discovery of 8 compromised TLS certs
Summary
Security experts found eight internet security certificates with extremely weak private keys that could let hackers create fake trusted certificates for any website or app. Major browsers and some software have already blocked these certificates, but fixing the problem everywhere will take a long time because many devices and systems need updates.Key Facts
- Eight TLS (Transport Layer Security) certificates from Indian company eMudhra have very weak private keys.
- These weak keys could allow someone to create fake trusted certificates that browsers and apps accept as real.
- Browsers and some programming languages stopped trusting these impacted certificates to protect users.
- No evidence yet shows the keys were used for attacks or to create fake certificates.
- The problem is compared to the 2014 Heartbleed security bug, which took years to fix fully.
- The size of these private keys was much smaller than normal, making them dangerously insecure.
- Fixing things will be slow because many devices like IoT (Internet of Things), Linux systems, and apps must be updated.
- VPN users might face the most immediate security risks from this issue.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
