Eight eMudhra Certs Get the Boot, but Crypto Bots May Dodge the Block

Google, Apple and Microsoft had blocked eight vulnerable certificates issued by India’s eMudhra by Tuesday, but blockchain security company CertiK warned that cryptocurrency trading bots and exchange applications may remain exposed through security systems outside browsers.

CertiK senior director of digital assets security Peiyu Wang told Cointelegraph, “Major browser blocks substantially reduce the risk for clients that receive and enforce them.” He added, “Some applications outside the browser ecosystem do not enforce Certificate Transparency or receive the same revocation protections.”

Wang said crypto services are not inherently more susceptible to the flaw than other industries. Attackers could use compromised certificates to impersonate the HTTPS connections used by exchanges, wallet interfaces and APIs, then replace deposit addresses or trick users into approving malicious transactions, he said.

Those attacks would also require intercepting or redirecting users’ internet traffic, while the compromised certificate authority keys alone would not expose wallet private keys. CertiK urged crypto operators to update their software and certificate trust stores and verify that their applications reject the affected certificates. Felix Ng contributed reporting.