Big Tech’s eMudhra fixes may leave crypto bots exposed, CertiK warns

Cryptocurrency trading bots and exchange applications may remain exposed to the eMudhra certificate security flaw despite emergency fixes from major technology companies, according to blockchain security company CertiK.

By Tuesday, tech giants including Google, Apple and Microsoft had blocked eight vulnerable certificates issued by India’s eMudhra, but the fixes may not protect crypto applications using separate security systems, CertiK’s senior director of digital assets security, Peiyu Wang, told Cointelegraph.

“Major browser blocks substantially reduce the risk for clients that receive and enforce them,” Wang said. “Some applications outside the browser ecosystem do not enforce Certificate Transparency or receive the same revocation protections.”

Wang stressed that crypto services are not inherently more susceptible to the flaw than other industries, but attackers could exploit compromised certificates to impersonate the HTTPS connections used by exchanges, wallet interfaces and APIs.

Attackers could specifically impersonate crypto services and replace deposit addresses or trick users into approving malicious transactions, Wang said. Such attacks would also require intercepting or redirecting users’ internet traffic, while the compromised certificate authority keys alone would not expose wallet private keys.

Wang urged crypto operators to update their software and certificate trust stores and verify that their applications reject the affected certificates.

Felix Ng contributed reporting.

Related: Ledger’s early implant warnings deserved more action, Karpelès says