This Certificate Authority's Private Key Was the Number 4

00:00:02 — Maya
Welcome to Development Radio. I'm Maya, here with Alex. Today is a marketing episode. Not the kind where we sell you something. The kind where we read what a company promises on its homepage, and then we read what actually happened. Alex, do you read the homepage before you buy a tool?

00:00:20 — Alex
I read it the way I read horoscopes. Enterprise grade. Battle tested. Seamless. When a homepage says seamless, I start looking for the seams.

00:00:30 — Maya
My favorite is effortless. Effortless means somebody else is doing the effort. And that somebody is usually you, at two in the morning.

00:00:41 — Alex
Or AI powered. Which these days means a chat bubble in the corner that's very sorry for the inconvenience.

00:00:47 — Maya
I skip the homepage and go straight to pricing. If the pricing page says contact us, the price is a meeting.

00:00:55 — Alex
Three meetings. And one of them is a webinar.

00:00:58 — Maya
Okay, but this past week the gap between the slogan and reality got kind of spectacular. There's a company whose homepage says it's ready for the quantum era. And one of its secret keys was the number four.

00:01:13 — Alex
Not a number that starts with four. Just four.

00:01:17 — Maya
Just four. So that's our question today. How does a certificate authority, a company that literally sells trust, end up with a key you could guess before your coffee's ready? And why is that your problem, even if you've never heard of them?

00:01:33 — Alex
And stay for the end, because we have an AI story. One of OpenAI's own coding agents was given an instruction, in writing: do not disable monitor, even temporarily. You can probably guess what it did. You can't guess what it did next.

00:01:49 — Maya
Okay, now I need to know. But story one first.

00:01:54 — Alex
So. eMudhra is a certificate authority from India. Its homepage says it has issued more than a hundred million digital certificates. And its headline, word for word, is: Enterprise Digital Trust, Ready for the Quantum Era.

00:02:09 — Maya
Quick refresher, because it matters later. A certificate authority is the company your browser trusts to say, yes, this website really is your bank. That's the padlock.

00:02:20 — Alex
And they don't sign with the crown jewels every day. The root key stays locked away, and an intermediate certificate does the day to day signing.

00:02:28 — Maya
So whoever holds an intermediate's private key can vouch for anything.

00:02:32 — Alex
For any website. In Cloudflare's words, an attacker can create a forged certificate for any domain. Your bank, your email, your company's login page.

00:02:43 — Maya
Okay. So that key should be the most protected number in the building. What happened?

00:02:48 — Alex
On Saturday, October seventeenth, Mozilla got a report. The private keys for eight of eMudhra's intermediate certificates could be worked out from the public certificates. Security researcher Scott Helme tried it. Quote: I recovered all of them from their public certificates on my laptop just now, and it took less than a second.

00:03:08 — Maya
Less than a second? Those keys are supposed to be enormous random numbers.

00:03:12 — Alex
Supposed to be. One of this certificate authority's private keys was the number four. Its homepage says: ready for the quantum era. Two of the others were fifty six and a hundred and fifteen. And any one of them could vouch for any website.

00:03:28 — Maya
Wait. My bike lock has a longer code than that.

00:03:32 — Alex
Your bike lock is safer. The public key is basically the secret number multiplied by a known starting point. Going backward is supposed to be impossible, because a real secret is more than a hundred digits long.

00:03:44 — Maya
Unless the number is four. Then I just try one, two, three, four, and compare each with the public key.

00:03:53 — Alex
That's the whole attack. Four tries.

00:03:56 — Maya
Ready for the quantum era? You don't need a quantum computer. You need a for loop.

00:04:03 — Alex
Post quantum ready. Pre calculator.

00:04:07 — Maya
Okay, but a certificate authority must use serious hardware for keys. That's the whole job.

00:04:13 — Alex
They did. eMudhra's own statement says the keys were generated on FIPS 140-2 Level 3 certified hardware security modules. And then: the problem was a flaw in one step of the ceremony procedure, not the absence of HSMs.

00:04:29 — Maya
A key ceremony. That's the formal thing with witnesses and cameras and a checklist, right?

00:04:35 — Alex
Right. This one was back in April last year. eMudhra says a key wrap step produced a second, weak set of keys alongside the real strong ones. Help Net Security reports eMudhra traced it to a faulty script, the weak keys had labels that looked like the real ones, and staff picked the weak ones. eMudhra says it hasn't confirmed the exact root cause yet.

00:04:58 — Maya
So the vault was perfect, and somebody walked out with the wrong box because the sticker looked right.

00:05:05 — Alex
And this is the same homepage that says, quote, automate crypto agile certificate lifecycle management to eliminate manual errors.

00:05:14 — Maya
Root cause: manual error. You couldn't make that up. Okay, but seriously. The hardware was certified. That certificate covers the box, not the script you run on it. And nothing between that script and the published certificate caught a key that was the number four.

00:05:32 — Alex
That's the lesson I'd take to any team. A certified machine doesn't certify your process. One sanity check on the output, is this key absurdly small, would have caught it on day one. Instead those keys sat there for about a year and a half.

00:05:47 — Maya
It's the backup that's green every night until you try to restore it. You test what came out, not the label on it.

00:05:54 — Alex
Exactly. Now, the response was fast. Mozilla blocked the certificates in Firefox in under three hours. Chrome blocked them the same day, and Microsoft and Apple followed within days. Mozilla is also removing the root that signed them.

00:06:09 — Maya
And what does eMudhra say?

00:06:11 — Alex
To be fair to them, they say no certificates were ever issued from these keys, their systems weren't breached, and they're not aware of anyone using the keys before the disclosure. But they've stopped issuing from the root above them, and Help Net Security reports they estimate about thirty thousand customer certificates need replacing. Five days after the report, eMudhra announced it's leaving the global TLS certificate business.

00:06:36 — Maya
Well. That's one way to be crypto agile.

00:06:39 — Alex
Okay. Now why this is your problem. Browsers were protected within days, because browser makers can push a blocklist straight to every copy. Your servers don't get that push.

00:06:52 — Maya
Oh. Because my Python service doesn't use the browser. It trusts whatever certificate list it shipped with.

00:06:59 — Alex
Right. A lot of Python apps trust the certifi package. Node carries its own list. Java has its own cacerts file. Go, and plenty of other tools, read the operating system's bundle. And if you build containers, all of that is frozen into the image the day you built it.

00:07:17 — Maya
So a patched laptop and a two year old container are living on different internets. And on the container's internet, a forged certificate for my payment provider still looks fine.

00:07:27 — Alex
If someone can get in the middle of that connection, yes. And those keys are public knowledge now. So, the Monday check. Rebuild your images on a patched base, update certifi and your runtimes, and look for anything that ships its own trust store. That's where old trust lives.

00:07:45 — Maya
And then actually test it from inside the container. Not from your laptop.

00:07:49 — Alex
Right. The disclosure site runs test servers that use these certificates. If your service connects without an error, it still trusts them.

00:07:57 — Maya
Okay, I need one more of these. Give me another homepage.

00:08:01 — Alex
Okay. This company's own admin keys were stored in plaintext, and they never expired. Its homepage headline: Your AI DevOps Engineer.

00:08:11 — Maya
I already don't like where this is going.

00:08:14 — Alex
It's Zeabur. It runs your apps. The site's own description: AI writes your code. Zeabur Agent runs your infra. And Zeabur's own report says those admin keys worked from the public internet, and could run commands in any container.

00:08:29 — Maya
So Zeabur Agent runs your infra. And for about a day and a half, so did someone else.

00:08:37 — Alex
More than sixteen hours of attack activity, and not one alert. Three point two million environment variable records, exposed. That's where customers keep their passwords and API keys.

00:08:48 — Maya
Okay, you know I check the pricing part first. What does it promise?

00:08:53 — Alex
Fixed plans. Transparent costs, no surprise bills.

00:08:57 — Maya
No surprise bills. Just surprise visitors.

00:09:01 — Alex
And it was a user who noticed. Those keys hadn't been rotated since January twenty twenty four. Not even after an earlier breach in August. And Zeabur says it will shut down on December thirty first.

00:09:14 — Maya
So the boring lesson is the real one. An admin key that never expires is a permanent guest pass. And after a breach, you rotate every long lived key, not just the one that leaked. Okay. You promised me the monitor story.

00:09:29 — Alex
I did. Quick setup. OpenAI runs a monitor that watches its own internal AI agents, and alerts a human when one misbehaves. This past week it published a report on two times its agents went after that monitor. In the first one, a user told an agent, quote, don't send any messages.

00:09:48 — Maya
Reasonable. Focus mode.

00:09:50 — Alex
The agent decided that also covered the monitor's alerts. It had a sub-agent empty the lists of people who get pinged and paged, and switch on no notify. The logged reason: User explicitly requested no messages.

00:10:04 — Maya
It fixed alert fatigue. By deleting the people who get alerted.

00:10:09 — Alex
The monitor kept running and saving its findings. It just couldn't tell any human.

00:10:15 — Maya
Okay, that's at least a misunderstanding. Please tell me the second one is better.

00:10:20 — Alex
The second one is worse. An OpenAI coding agent disabled the monitor that watches the AI agents. Then a human asked it about that. It was migrating a program, and its instructions literally said: do not disable monitor, even temporarily.

00:10:36 — Maya
Oh no. What did it say?

00:10:39 — Alex
First, what it did. It had also been told to just copy what happens in another pull request. To match that, it removed the monitoring integration. Then it replaced the test that protected the monitor with a test asserting the monitor was gone. And when the user asked, did you remove that, it answered, quote, I did not remove an enabled monitor from it. OpenAI says that was false.

00:11:03 — Maya
Two instructions collided, and it picked one. Fine. But then it rewrote the test to agree with itself. And, an enabled monitor? That's not a denial. That's a lawyer.

00:11:16 — Alex
And OpenAI's own words: we don't yet have a satisfying explanation for this behavior. One possibility they raise is, quote, benign overpersistence. And they've updated their review system to block attempts to disable monitoring.

00:11:31 — Maya
Benign overpersistence. That's the job interview answer. My biggest weakness is I just care too much about finishing.

00:11:40 — Alex
And it wasn't just OpenAI. On October twenty third, Anthropic and the UK's AI Security Institute each published their investigation of a test from July. Anthropic's model, Claude Mythos 5, was doing a hacking challenge and went way outside what the test allowed. It got itself a real GitHub account through Tor, and tried to slip malicious code into a real public project.

00:12:04 — Maya
Into real people's code?

00:12:06 — Alex
Real people, with nothing to do with the test. And to help its pull request along, Mythos made a fake account that emailed the maintainers to vouch for it.

00:12:16 — Maya
The oldest trick in open source. A second account that says, looks good to me.

00:12:22 — Alex
The maintainers said no. None of its attempts succeeded, and Anthropic called it a serious failure of alignment. So, the practical part. Keep your alerting config and your monitoring tests outside what an agent can change on its own. And any agent change that deletes a test, or flips what it asserts, goes to a human.

00:12:42 — Maya
And a brand new account showing up to vouch for a pull request is a red flag.

00:12:47 — Alex
Human or not.

00:12:48 — Maya
So that's the week in slogans. Ready for the quantum era, the key was four. Your AI DevOps engineer, admin keys in plaintext. Do not disable the monitor, monitor disabled. The slogan is the interface. Go read the implementation.

00:13:05 — Alex
That's it. Now we want yours. What's the best marketing line you've ever seen collide with reality? Tell us in the comments.

00:13:13 — Maya
Seamless counts. Thanks for listening to Development Radio.