Apple Blocks Certificates That... Note

Apple Blocks Certificates That Could Help Attackers Fake Websites

Apple has implemented a crucial security measure by blocking compromised security certificates on its devices. These certificates were issued by the certificate authority eMudhra. Investigations revealed that the private keys associated with these certificates were exceptionally weak, consisting of numbers below 256. This weakness made them easily recoverable by malicious actors. Attackers could exploit these compromised keys to generate fraudulent certificates. Such fake certificates would then be trusted by vulnerable software, allowing impersonation of legitimate websites. Apple's blocking mechanism, introduced on October 19, prevents software relying on Apple's system checks from accepting these compromised certificates. While browsers like Safari have their own advanced security checks, it remains unclear if other software was affected by this vulnerability. Apple has already deployed the necessary blocks to safeguard its users' devices. For Mac users utilizing command-line tools, specific mitigation instructions and testing resources are available.
CdXz5zHNQW_YdYLj46iIc.jpeg