Apple has blocked eight compromised security certificates on iOS and iPadOS after researchers found their private keys were astoundingly weak. The protection rollout on Mac is more complicated.
Security certificates (SSL/TLS) help keep internet users secure by encrypting traffic and verifying domain ownership. However, a collection of certificates from one authority has been pulled from use after security researchers found them to be extremely weak. Indian certificate authority eMudhra revoked the certificates, which prevents websites from using them. The revocation came after their discovery and disclosure on October 17.
Google Chrome blocked six compromised intermediates authorized to issue TLS certificates, and Mozilla blocked the compromised certificates in Firefox, both on October 17. Apple followed on October 19 by adding protections to iOS and iPadOS.
The keys were entirely guessable. The compromised private keys were 4, 56, 66, 115, 155, 156, 230, and 237. Six of the certificates were used for TLS and trusted by Apple, Chrome, Microsoft, and Mozilla root programs, while two were used for code signing and trusted by Microsoft. Most never reached production, and there is no evidence attackers used the keys. Users are advised to update their software as soon as possible.
Source: AppleInsider · Summarized by HeadlinesBriefing