Update your stuff, folks. I’ve had a fun day at work.
The certificates were determined by fair die roll
I can’t believe the private key was 4.
Random website: your password must include lower and upper case characters, numbers, special characters, emojis, invisible UTF-16 characters, be at least 32 digits long, contain no repeating sequences, mathematical sequences, musical sequences, a random episode number of Friends, parts of your username, email, mother’s name, father’s name, address, social security number, childhood address street name, first pet’s name, any date between 32 March 1928 and 1 Feb 2077, or the special character ë̷̡̡̨̡̬̜̲̫̼̠̙̱̝̖̝̞͕͉͎̿́̂͗͂̉͐͑͐̀͗̔̊̈́̅̑͘͠ͅ.
CA private key security: “Pick a number between 0 and 10443888814131525066917527107166243825799642490473837803842334832839539079715574568488268119349975583408901067144392628379875734381857936072632360 8785136527794595697654370999834036159013438371831442807001185594622637631883939771274567233468434458661749680790870580370407128404874011860911446797778359802900668693897688178778594690563019026094059957945343282346930302669644305902501597239986771421554169383555988529148631823791443449673408781187263949647510018904134900841706167509366833385055103297208826955076998361636941193301521379682583718809183365675122131849284636812555022599830041234478486259567449219461702380650591324561082573183538008760862210283427019769820231316901767800667519548507992163641937028537512478401490715913545998279051339961155179427110683113409058427288427979155484978295432353451706522326906139490598769300212296339568778287894844061600741294567491 9823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335”
User: guess 4 will do
I dont know whats more emberassing, the fact a CA fucked up this baddly. Or that the private keys look like they were actually someones lottery numbers from that morning.
I immediately thought of Hurley from lost when I saw them
IT department told us to not use any browser until further notice lol
I wonder if they didn’t read this section:
There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.
or if they did read it, but don’t trust it.
deleted by creator
Jfc it’s patched in just about all of them now.
Unless for some reason they’ve overridden that capability while being unable to issue patches in a timely manner due to process overhead, but nobody would be that stupid right?
They can’t check if it’s patched because they can’t use their browsers
It’s back to curl, bois
Currently having a very fun day at work.
Fortunately our own certificates are unaffected, but it’s the autumn break and most of the staff are absent and incommunicado.
This is great news to get mitmproxy (which has been updated with a specific --emudra flag) to intercept your iot widgets that you couldn’t install a custom ca on.
Oh SHIT yes, I hadn’t even considered using this for my own purposes.
