eMudhra shuts global website certificate business after key flaws exposed, calls scrutiny ‘disproportionate’

Digital security firm eMudhra will reportedly withdraw from the global website security certificate business after major browser makers, including Google, Apple and Microsoft, withdrew trust in its certificates over vulnerabilities that triggered cybersecurity concerns worldwide.

The company announced its exit on Thursday, news agency Reuters reported. eMudhra said the attention on social media had resulted in disproportionate scrutiny of a business that contributes just 1 per cent of its revenue.

The company's SSL/TLS certificates encrypt communications between websites and users to protect data from unauthorised interception.

eMudhra's customers include IT majors Infosys and TCS, as well as government agencies. Its certificates also protected critical websites, including India's income-tax portal.

The vulnerabilities came to light over the weekend after an independent cybersecurity researcher discovered that several of eMudhra's key certificates could be attacked.

Also Read | Centre orders probe as Bengaluru firm eMudhra's key-making error leaves holes in web security

The company said it had revoked eight certificates but maintained that its infrastructure had not been compromised and no data breach had occurred, reported Reuters.

Investors have reacted sharply to the disclosure, with eMudhra's shares falling 40% over the two days following the revelation.

The flaws originated in eight cryptographic keys generated by eMudhra in April last year. The keys were inadvertently shortened by the company's software, making them significantly weaker, co-founder Kaushik Srinivasan told Reuters.

Cryptographic keys are strings of characters used by encryption algorithms to secure data. When these keys are too short, they can become easier for attackers to crack, potentially compromising the security of encrypted communications.

Also Read | From eMudhra to Bank of Baroda: 5 major data breaches in recent times

“A single compromised certificate authority can impersonate any website,” said Lukasz Olejnik, an independent consultant and visiting senior researcher at the Department of War Studies at King's College London.

The ministry of Electronics and Information Technology (MeitY) on Thursday said it had “taken serious note” of the incident and set up a special team to investigate. The ministry said the impact on Indian websites and applications had been “very limited and for a very short interval”. It also accused some social media accounts of “fear mongering” about the incident.