Disgraced eMudhra drops out of TLS business after using cert private key of 4
https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/Open linkView original on piefed.socialSyndicated from the fediverse. Read and engage on the original instance.
View original on piefed.socialhttps://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/Open linkView original on piefed.social
16 replies
re-signed, right?
Imagine trying to brute force the key, well knowing that it should take several forevers and your script returns "4" immediately after you press enter.
Should have been 42. That would have taken milliseconds more to crack.
I could have been a master hacker, but I only tried 1, 2 and 3 then gave up. Curse my lack of persistence!
I did try four numbers, but I started with 0 like a fool.
I was trying to explain this to the offices normies and I sounded insane.
That made me realize maybe I don’t even understand it completely. Then I read this article.
No. It was that dumb. So dumb it sounds implausible. But that’s how bugs are. So dumb someone would assume it’s impossible or never even think about it.
Their stock crashed hard as well in India
https://stockanalysis.com/quote/nse/EMUDHRA/
Not hard enough.
Crashing isn't gonna ungenerate the cert.
Hell of a week to be in infosec.
This has inspired some really good, simple memes though
Oh. Jesus fucking christ. This caused me to go actually look up what actually happened. See, I thought they had used some long string and because of some collision in math or some sort of programming weakness or whatever, that long string could also be "solved" with, like, 4. NOT THAT THEY LITERALLY FUCKING USED THE NUMBER FOUR. Jesus.
Wasn't it that they generated two sets of certs or something, one with weaker keys, and then they ended up using the weaker set? I can't remember exactly what or where I read this at the moment. 😅
My grandmas PC has a more secure password holy loly