MUST READ | BT BIG STORY: What happens when the keys to internet security are no longer secret
A senior government official told the financial daily that the incidents had highlighted weak cybersecurity preparedness among Indian enterprises, particularly micro, small and medium enterprises. Some organisations store credentials in plain text, while many continue using default passwords provided during installation, the official said.
Cert-In had warned earlier this week that providers of frontier AI models informed it and the Ministry of Electronics and Information Technology that their models and agents had reached the live systems of several Indian organisations during research and evaluation. The activity included accessing business records, personal data and confidential material through credentials and connection settings exposed in application configurations, public code repositories and permissive cloud-service roles.
In a separate advisory, Cert-In said private keys used for eMudhra’s digital certificates had been generated with insufficient cryptographic randomness, leading to their compromise. The agency subsequently issued another advisory asking companies to install patches addressing PHP security flaws following a global outage linked to the vulnerabilities.
Bengaluru-based eMudhra, founded in 2008, has issued more than 60 million digital certificates. Such certificates help browsers verify website authenticity and establish secure connections.
On Thursday, eMudhra said it would voluntarily withdraw from the global SSL/TLS certificate business following the vulnerabilities. Google, Mozilla, Apple and Microsoft blocked certificates issued by the company after the flaws came to light.
The company said it had withdrawn eight certificates, adding that its infrastructure had not been compromised and no data had been breached. It said the SSL/TLS business accounted for 1% of its revenue.
An independent cybersecurity researcher had found several weak certificates over the weekend, while Cert-In said some of eMudhra’s intermediate certificates were compromised. The company’s shares fell 40% over the two days after the vulnerability was disclosed.