Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites.
However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates because macOS does not check for revocation …
The issue concerns what are known as intermediate certificates. These are used to prove ownership of a website, so if you visit apple.com, for example, Safari will check that you are visiting the real site.
However, an error in a script used to generate these certificates led to a number of private keys that could be trivially discovered by testing just 256 possible numbers. The eight compromised certificates have now been revoked, and steps taken to ensure that the vulnerability won’t affect any future certificates issued.
Bleeping Computer reports that Apple, Google and Mozilla have each blocked the compromised certificates in their respective web browsers. However, Mozilla cryptography engineer Dennis Jackson warns that Macs may continue to trust them.
Jackson also warns that macOS’s built-in /usr/bin/curl utility may continue trusting the compromised certificates because its certificate bundle does not check revocation information.
In other words, if your Mac has already accepted one of the certificates, then it will continue to do so. However, there is currently no evidence of them being used in the wild, and it’s something that Apple is likely to be able to fix in an upcoming security update.
- iPhone Duo cases
- Beats Woven USB-C cables
- Certified refurbished Apple products 15% off at apple.com
- Discounted AirPods Pro 3
- Wireless CarPlay adapter
- 10-year AirTag battery case
- Logitech MX Master 4 for Mac
Photo by Mohammad Rahmani on Unsplash
FTC: We use income earning auto affiliate links. More.