HN

Need help?
<- Back
Your MCU likely escaped the eMudhra intermediate CA compromise

Your MCU likely escaped the eMudhra intermediate CA compromise

hasheddan

Comments (22)

  • scottlamb
    tl;dr: MCUs are space-constrained and often don't include root certs that aren't used by the one host they talk to.In my experience it's equally likely they just don't do validation to begin with. For example, my Elk M1XEP (physical security system's Ethernet expander) runs a configuration server with and without TLS. They recommend with, but it uses a self-signed certificate, and the crappy VB.NET configuration program doesn't validate the cert in any way, so it can be trivially MITMed. The Elk M1XEP also can connect to a user-chosen alarm monitoring service ("central station") over the Internet. I don't think it uses TLS at all for this. I think there's optional shared secret auth/encryption?
  • WalterGR
    Related:https://news.ycombinator.com/item?id=50166579 - “eMudhra intermediate CA compromise” - 947 points | 19 hours ago | 408 commentshttps://news.ycombinator.com/item?id=50177916 - "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds" - 604 points | 7 hours ago | 270 comments
  • tomku
    Your device would also have to be pretty recent to ship any of these certs in a frozen cert store as they were only generated in April/May of 2025.
  • hasheddan
    Fun fact: esp-idf includes an x509 Certificate Bundle API[0] that will pull in the entire Mozilla trust store by default. However, they will be stripped unless firmware calls `esp_crt_bundle_attach`. There is an issue[1] tracking removal of the eMudhra root CA certificate.[0] https://docs.espressif.com/projects/esp-idf/en/latest/esp32/...[1] https://github.com/espressif/esp-idf/issues/19282
  • 6thbit
    So MCUs or any embedded that doesn't get updates will likely only be good for up to the validity of the included CA root before bricking up?These days thats up to 15 years. Talk about programmed obsolescence.
  • foobarian
    I must have missed when de facto definition of MCU started including being on the network and doing crypto :-)
  • bawolff
    > Mozilla has maintained a dedicated CA Certificate Program since the initial launch of Firefoxumm, they had already been maintaining the program for almost a decade at that point.
  • snotek
    [flagged]
  • anon
    undefined
  • tgsovlerkhgsel
    TL;DR: Your MCU likely doesn't have enough space to dedicate so much of it to a full CA store, so it is unlikely to trust those CAs (claims the post).So many words for such a simple point/claim...