Crypto Trading Platforms Could Stay Vulnerable to eMudhra Security Issue Despite Big Tech Patches, CertiK Cautions
Blockchain security firm CertiK cautions that vulnerabilities in eMudhra certificates could enable malicious actors to masquerade as legitimate crypto services, alter transactions and endanger users' financial assets.
Digital currency trading bots and exchange platforms could continue facing threats from the eMudhra certificate security vulnerability even after emergency patches deployed by leading technology corporations, blockchain security firm CertiK has indicated.
As of Tuesday, technology behemoths such as Google, Apple and Microsoft had taken action to block eight compromised certificates that were issued by India-based eMudhra, however these protective measures might not extend to cryptocurrency applications that rely on independent security frameworks, Peiyu Wang, CertiK's senior director of digital assets security, explained in comments to Cointelegraph.
"Major browser blocks substantially reduce the risk for clients that receive and enforce them. Some applications outside the browser ecosystem do not enforce Certificate Transparency or receive the same revocation protections."Peiyu Wang, CertiK's senior director of digital assets security
Wang emphasized that cryptocurrency services do not have an inherently greater vulnerability to this particular flaw compared to other sectors, however malicious actors could take advantage of the compromised certificates to masquerade as the HTTPS connections that are utilized by digital asset exchanges, wallet user interfaces and application programming interfaces.
Malicious actors could specifically pose as legitimate crypto services and substitute deposit addresses or deceive users into authorizing fraudulent transactions, Wang explained. Such attack scenarios would additionally require the interception or redirection of users' network traffic, whereas the compromised certificate authority keys by themselves would not provide access to wallet private keys.
Wang recommended that cryptocurrency operators take immediate action to update their software and certificate trust stores and confirm that their applications properly reject the compromised certificates.