CertiK said crypto trading bots and exchange apps may still be exposed to security risks tied to compromised certificates issued by Indian digital certificate authority eMudhra, even after Google, Apple and Microsoft blocked eight affected certificates, according to Cointelegraph. The security firm said browser-level fixes may not extend to software that relies on separate security systems, leaving some crypto-related applications outside the scope of those protections. Peiyu Wang, senior director of digital asset security at CertiK, said attackers could use the compromised certificates to impersonate exchange interfaces, wallet interfaces and APIs, potentially swapping deposit addresses or tricking users into approving malicious transactions. Wang also said the attack would still require interception or redirection of network traffic, and that the certificate authority key alone could not expose wallet private keys. CertiK urged crypto service operators to update software and certificate trust stores and verify that their applications reject the affected certificates.
CertiK said crypto trading bots and exchange apps may still face security exposure linked to eight affected certificates issued by Indian digital certificate authority eMudhra, even though Google, Apple and Microsoft have already blocked them, according to Cointelegraph.
Browser fixes may not reach all software
The blockchain security firm said browser-level remediation may not cover software that uses separate security systems. That leaves some crypto-related applications potentially outside the protection of those fixes.
How the attack could work
Peiyu Wang, senior director of digital asset security at CertiK, said attackers could use the compromised certificates to impersonate exchange interfaces, wallet interfaces and APIs. That could allow them to replace deposit addresses or trick users into approving malicious transactions.
Wang added that such an attack would still require interception or redirection of network traffic. The affected certificate authority key alone would not expose wallet private keys.
What operators should do
CertiK said crypto service operators should update software and certificate trust stores, and confirm that their applications reject the affected certificates.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
