Besu and Teku patch clients after eMudhra certificate compromise
Ethereum just got a quick security tune-up after a major slip-up by Indian certificate provider eMudhra.
On October 26, Besu, one big Ethereum client, pushed updates to block risks from compromised certificates that could have let attackers mess with block rewards.
On October 27, Teku, another big Ethereum client, pushed updates to block risks from compromised certificates that could have let attackers mess with block rewards.
No one has been hacked so far, which is a relief for the network.
Weak eMudhra keys needed manual updates
Researchers found on October 17 that the private keys behind eight of eMudhra's intermediate certificate authorities were too easy to crack because they weren't random enough.
This put the communication between a validator and the service it connects to at risk, a big deal for keeping transactions safe.
While eMudhra quickly revoked the faulty certificates and browsers blocked them, Java (which Teku and Besu use) doesn't automatically spot revoked ones, so manual updates were needed.
The incident is a reminder: keeping blockchain software up to date really matters.