Apple blocks compromised web certificates but Mac vulnerability persists
Apple revoked eight flawed certificates, but macOS may still trust them due to a lack of revocation checks in system utilities.
Key points
- Apple blocked eight web security certificates issued with weak private keys.
- macOS may continue trusting these certificates because it does not check revocation status.
- No evidence exists that the compromised certificates are currently being exploited in attacks.
Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites. The company took action after discovering that these intermediate certificates contained private keys that were trivially easy to discover.
The vulnerability stemmed from an error in the script used to generate these certificates. According to 9to5Mac, an attacker could have found the private keys by testing just 256 possible numbers. This weakness would have allowed malicious actors to create fraudulent certificates for any domain.
Certificate Revocation and Browser Response
The eight compromised certificates have now been revoked by the issuing authority. Steps have also been taken to ensure that this specific generation error will not affect any future certificates. Apple, Google, and Mozilla have each blocked the compromised certificates in their respective web browsers, according to Bleeping Computer.
These intermediate certificates are critical for proving website ownership. When a user visits a site like apple.com, Safari checks the certificate to verify the connection is secure. If the certificate is invalid or compromised, the browser should warn the user about the potential security risk.
macOS Trust Issues
Despite the browser blocks, Mozilla cryptography engineer Dennis Jackson warns that Macs may continue to trust the compromised certificates. This is because macOS does not check for revocation in certain system components. Specifically, the built-in /usr/bin/curl utility may still accept these certificates because its certificate bundle does not check revocation information.
If a Mac has already accepted one of these certificates, it will likely continue to do so. This creates a potential window where system-level tools could be tricked into trusting a fraudulent site, even if the web browser blocks it. There is currently no evidence of these certificates being used in the wild.
What should you do?
Apple is expected to address this trust issue in an upcoming security update. Until then, users should remain cautious of system-level connections that bypass browser security checks. Monitoring for official patches from Apple is the best course of action for Mac users who rely on system utilities for secure connections.
What to do and how to stay safe: Apple
- Monitor official Apple security advisories for updates addressing certificate revocation checks in macOS.
- Ensure your web browser is updated to the latest version to maintain the block on compromised certificates.
- Avoid trusting system-level command line tools for critical security connections until a fix is confirmed.
- Watch for unusual certificate warnings in Safari or other browsers that might indicate a compromised chain.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are these certificates considered vulnerable?
An error in the generation script allowed private keys to be discovered by testing only 256 possible numbers.
Are all browsers affected by this issue?
Apple, Google, and Mozilla have blocked the certificates in their browsers, but macOS system tools may still trust them.
Is there evidence of active exploitation?
No, there is currently no evidence that these compromised certificates are being used in the wild.
