Security failure at Indian certificate firm bites Ethereum as developers rush out fixes
Source: CoinDesk ·
From the source
A key blunder at Indian certificate issuer eMudhra left some Teku and Besu setups trusting forged certificates. Default mainnet nodes weren’t exposed. A cryptography slip at an Indian certificate company has made its way into Ethereum, where it could have let attackers quietly send some validators’ block rewards to themselves. Teku, the software many validators use to run Ethereum’s proof-of-stake side, released version 26.10.3 on Tuesday. Besu, which processes Ethereum transactions, released version 26.10.2 on Monday. Both updates stop trusting certificates tied to eMudhra, an Indian certificate authority, in their Docker images, the prepackaged versions many operators run. Validators are the computers that stake ETH to secure Ethereum and earn fees for proposing blocks. Some of them talk to other services over the internet, and they rely on digital certificates to make sure they’re talking to the right one. On Oct. 17, researchers found that the private keys behind eight of…