4 real? Tracking exploitation and patching of eMudhra’s weak keys
Curated from Cloudflare Blog
eMudhra’s weak key generation incident serves as a stark reminder that certificate authority failures are not merely theoretical risks. When a single four-digit key can compromise TLS connections, the blast radius extends far beyond any single organization. This analysis is valuable because it moves past the initial disclosure to quantify real-world exploitation attempts and the urgency of remediation. For SREs, the critical lesson is that trust in upstream CAs is not absolute; you must assume compromise until verification is complete. Implement automated, continuous scanning for known weak keys in your inventory and establish a rapid-response protocol for certificate rotation. Do not wait for a breach; proactively audit your PKI dependencies to ensure you are not relying on fragile cryptographic foundations.
Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much of the rest of the Internet remains exposed.
— Cloudflare Blog