8 eMudhra certificates compromised
This is a massive security event that impacts the entire internet. For reference:
https://blog.cloudflare.com/emudhra-certificate-compromise
https://emudhra.we-have-a-problem.com/
I'm currently seeing what I can do on my own Firewalla box but this should be addressed directly by Firewalla ASAP.
-
Yes, on my personal Firewalla box. What needs to happen is Firewalla (the company) needs to push out an update for their boxes as soon as possible so the Ubuntu and Node fixes are in place. Node hasn't released a fix yet but you can set NODE_OPTIONS=--use-openssl-ca as a temporary workaround. Each of firerouter, firemain, firemon, fireapi and firehb require this change and without it they are vulnerable to anyone who just chooses to sign a certificate claiming to be a real Firewalla domain. This is like an all-hands-on-deck situation, you need to make some calls and wake some people up.
-
First, like everyone else we will update the certs.
The impact of the certificate compromise is there, but the risk is very very little to your firewalla. Mainly it is a problem between your web browser on the web server
Firewalla also talk to our own servers via https, so it is possible, but very very difficult / expensive to compromise that. (including hacking public DNS, change a firewalla domain IP, and then use the stolen key to sign a fake firewalla server) Even after they do that, between your firewalla app and the firewalla box, there is a secondary encryption ...
-
That's great to hear but a little disheartening that you guys seem to be downplaying one of the greatest internet security incidents in recent history. Sure, successfully completing the hack is difficult and expensive but the bar has been lowered dramatically with the certificate compromise. Now all it would take is DNS poisoning, essentially. I believe a tone of concern and diligence would better suite the brand.
Please sign in to leave a comment.
Comments
6 comments