Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.
https://emudhra.we-have-a-problem.com/
First, thank you for the detailed response. I really appreciate it.
So from your explanation, I’m to understand that the risk here is just exposing sent data. Bad actors can’t spoof these certificates to send bad data or malware to a device?
Correct. You initiate the connection TO a server and might get forged replies or have someone in the middle snooping on you. Usually (for personal use) there’s no scenario where someone on the internet initiates a connection to you. Especially since every home router also features a firewall that by default declines all unsolicited incoming connections that weren’t initiated FROM your network.
Also, even if you were to have devices on your network that can recieve such connections from the internet (e.g. a homeserver or some IoT device that configures your router to expose it ugh) this wouldn’t allow attacks on the device itself, but still only affect its communication.
Basically this only allows attacks on the integrity and confidentiality of communication but does not attack a device or its software directly. You’d need further exploits for that (which might now be a bit easier to pull of as that one slice of cheese no features bigger holes).
Got it. That’s reassuring. Thanks again for the explanations!