Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites.
However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates because macOS does not check for revocation …
The issue concerns what are known as intermediate certificates. These are used to prove ownership of a website, so if you visit apple.com, for example, Safari will check that you are visiting the real site.
However, an error in a script used to generate these certificates led to a number of private keys that could be trivially discovered by testing just 256 possible numbers. The eight compromised certificates have now been revoked, and steps taken to ensure that the vulnerability won’t affect any future certificates issued.
Bleeping Computer reports that Apple, Google and Mozilla have each blocked the compromised certificates in their respective web browsers. However, Mozilla cryptography engineer Dennis Jackson warns that Macs may continue to trust them.
Jackson also warns that macOS’s built-in /usr/bin/curl utility may continue trusting the compromised certificates because its certificate bundle does not check revocation information.
In other words, if your Mac has already accepted one of the certificates, then it will continue to do so. However, there is currently no evidence of them being used in the wild, and it’s something that Apple is likely to be able to fix in an upcoming security update.
You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
