A Fleet of Agents Against a Compromised CA
- 8 merged by the fleet
- 52 open PR from the fleet
- 34 merged by others
- 24 open PR from others
- 2 ticked, PR not checked
- 763 still vendored
When you connects to a website via https, the website proves its identity to you with a certificate signed by one of roughly sixty certificate authorities (CA). However, one such CA's private keys – eMudhra's – were found to all be one byte long. One of them was literally 4.
Your browser/package/toaster keeps a list of CAs they trust. Some packages defer to the system's trust store, but some bundle the list of CAs. If all applications delegated to your system's trust store you could make your own CA, you could trivially make a CA, add it to your own trust store, and middle-man all your own traffic, including the https requests of closed-source software. Accordingly, now that 4 is out of the bag, any hop on the route between you and your destination (e.g., your ISP, a public cafe Wi-Fi, or one the megahighways of the internet that most traffic passes through) can show you a certificate pretending to be your destination, and middle-man your traffic.
Browsers in particular update over-the-air; unless you're running something esoteric your browser is likely not vulnerable. Check here.
A lot of software bundles the CAs they trust, and are vulnerable until either their creator ships a fix, or December 31st 2028, which is when the eMudhra emSign certificates expire.
However, nixpkgs, the world's largest package repository, packages software in a way that allows the maintainers to patch without the need for the upstream creator's cooperation, by, e.g., symlinking the system trust store to the path where the bundle would normally be located.
We'll share more about our methods soon. Reach out at hello+patchix@antimemetics.institute if you'd like to chat!