India’s eMudhra exits website security business after flaws trigger global alarm
FILE PHOTO: Figurines with computers and smartphones are seen in front of the words “Cyber Security” in this illustration taken, February 19, 2024. REUTERS/Dado Ruvic/Illustration/File Photo
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
Oct 22 : Digital security firm eMudhra is exiting its global business of issuing security certificates for websites including India’s tax portal after major browser makers blocked them for vulnerabilities that sparked worldwide cybersecurity concerns.
The company announced its decision on Thursday after technology giants including Google , Apple and Microsoft stopped trusting its SSL/TLS certificates, which encrypt data sent between users and websites to keep hackers from intercepting it.
The vulnerabilities came to light over the weekend, when an independent cybersecurity researcher found several of eMudhra’s main certificates could be attacked.
EMudhra’s customers range from IT majors Infosys and TCS to government agencies, and its certificates protect sites as important as India’s income-tax portal.
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
“EMudhra’s certificates are internationally accepted, and a vulnerability like this has created a trust deficit among the global cybersecurity landscape,” said Mredul Sarda, founder of San Francisco-based cybersecurity firm Causal Security.
The vulnerability went undetected for the last 18 months and passed two rounds of audits, eMudhra said in its statement.
The flaws stemmed from eight keys eMudhra generated in April last year that were mistakenly shortened by its software, making them significantly weaker, co-founder Kaushik Srinivasan told Reuters.
Cryptographic keys are long strings of characters used to encrypt and decrypt data when passed through an algorithm. But eMudhra’s keys were small enough to make the encryption easier to break.
“A single compromised certificate authority can impersonate any website,” said Lukasz Olejnik, independent consultant and visiting senior researcher at the Department of War Studies at King’s College London.
Browsers quickly blocked the compromised certificates but less frequently updated internet-connected devices could remain exposed. “Millions of older devices may remain at risk for years, or forever, because they will still trust those certificates,” Olejnik said.
India’s Computer Emergency Response Team said on Wednesday some eMudhra intermediate certificates had been compromised.
EMudhra said it had withdrawn eight certificates, but maintained its infrastructure was not compromised and that no data was breached.
Social media attention had brought disproportionate scrutiny to a business that accounts for just 1 per cent of its revenue, the company said.
Investors have reacted sharply, with eMudhra shares down 40 per cent in the two days since the vulnerability was disclosed.
Source: Reuters
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
