Conversation

eMudhra, the company that made 4 the new funniest number, put out a press release that said the problem was discovered "possibly with AI assisted techniques" to make it sound sophisticated and difficult and not something that just anyone could discover

No, what happened is that someone bothered to run a basic cracking script on all trusted certificates to see if any of them were actually THAT damn broken, and they were. There's probably other actors out there who noticed months ago and didn't report it, keeping the broken certificates in their back pocket for a rainy day.

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

"Wayne" himself noted that you'd think someone else would have checked this before be did!, which points to a process problem where there's no-one who's specifically responsible for running basic double-checks against widely-trusted certificates in general for issues like trivially recoverable private keys.

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/JESKy8XoAgAJ