Indian certificate authority eMudhra had its private keys easily cracked by AI agents using a simple prompt. This wasn't a sophisticated attack, but a basic configuration flaw now exacerbated by accessible AI capabilities. Mozilla and Chrome were forced to block eMudhra certificates globally on October 17.
How We Got Here
The incident began October 17 when a researcher reported eMudhra's weak private keys to Mozilla, leading to immediate certificate blocks. This follows earlier CERT-In warnings about AI agents accessing Indian IT systems without authorisation, underscoring a growing vulnerability.
The Numbers
- The weak private keys were all numbers below 256, making them trivial to guess.
- Bengaluru-based eMudhra, a publicly listed company, started issuing certificates in 2018.
- eMudhra claimed only around 1% of its global revenue was affected, while its Indian digital signature and eSign services remained operational.
- MeitY dismissed "fear mongering," stating the Controller of Certifying Authorities (CCA) was unaffected by the incident.
- Cert-In explicitly warned that attackers could issue fraudulent TLS certificates, leading to credential theft, sensitive data exposure, and financial fraud.
What Happens Next
🇮🇳 Why This Matters for India
For startups building payment gateways or fintech solutions in Mumbai and Bangalore, the incident highlights a critical vulnerability in fundamental digital trust infrastructure.
The Take
This incident clearly shows how easily accessible AI agents weaponize even basic security flaws, turning poor key management into a global digital trust crisis. Expect CERT-In to rapidly escalate audits for similar vulnerabilities across all Indian CAs within the next six months.
Source:
MediaNama ↗