WORLDTECHApple Blocks Compromised Certificates Used to Impersonate Websites
Apple has blocked compromised security certificates on its devices, a move that could curb attackers' ability to pass themselves off as genuine websites, BleepingComputer reports.
Scope of the device blocks
BleepingComputer reports that the blocks apply to certificates on Apple devices that attackers could exploit to impersonate websites. An advisory from Mozilla cryptography engineer Dennis Jackson states that Apple introduced the blocks on October 19.
The certificates in question were issued by certificate authority eMudhra. Apple is a software and consumer electronics company based in Cupertino.
Why the compromised keys matter
According to Mozilla's investigation, the private keys behind these certificates were all numbers below 256, which would make them almost instantly recoverable. Holding such a key, an attacker could create fraudulent certificates that vulnerable software would trust.
The protections stop software that relies on Apple's system checks from trusting the compromised certificates.
Open questions
- Which websites were affected by the compromised certificates?
- How many devices and software products rely on the affected system checks?