eMudhra says Python bug behind internet security scare
What's the story
Indian cybersecurity firm eMudhra has published a detailed report on the security key incident that sent shockwaves across the internet last month. The company, which issues digital certificates for websites, found eight weak security keys in its system. These keys could have been exploited by anyone to obtain digital certificates and create fake websites to scam users.
Cause identified
Incident traced back to Python scripting error
The security scare was traced back to a Python scripting error.
The company said that during a key generation ceremony on April 30, 2025, the keys were successfully generated on a hardware security module (HSM).
However, when processed with a custom Python script for transfer to another hardware device, eight of the keys were shrunk into tiny numbers due to a bug in the script.
Key details
Affected keys went unnoticed for a year and a half
The affected keys were alarmingly small, with one being just the number 4. This made them extremely easy to hack.
The company admitted that these numbers, 4, 56, 66, 115, 155, 156, 230, and 237, were so small that anyone could have worked them out from the public domain.
Despite their weakness, these keys went unnoticed for a year and a half as they still issued certificates as intended without any strength testing done by users or companies.
Action taken
eMudhra revoked all certificates linked to affected keys
In light of the incident, eMudhra revoked all 16 certificates linked to the affected keys. The company said it couldn't guarantee that these certificates met its own security policy.
Notably, this was the first time eMudhra had used such a process for transferring keys between HSMs in different geolocations.
Since then, they have been generating keys without any transfer between devices.
Public apology
Company exited digital certificate business
In light of the incident, eMudhra has publicly apologized for the security scare.
The company also exited the digital certificate business entirely after last month's internet meltdown.