Crypto users could also be affected, though mainly outside the browser. Exchange bots, trading scripts and wallet backends often run on Python, Node or Go, and a forged certificate for an exchange’s API could in theory let an attacker on the same network read or alter a bot’s traffic. No crypto attacks have been reported so far.
But according to Mudit Gupta, chief technology officer at Polygon Labs, the bigger concern is not crypto itself, it is outdated software.
“This is not a crypto-specific issue,” Gupta told CoinDesk. “It is a generic issue that can be exploited for man-in-the-middle attacks, particularly against users running older or unpatched software. Crypto users who keep their wallets, trading tools and devices updated face lower risk, but the broader software ecosystem remains a concern,”
CoinDesk contacted eMudhra for comment.
Emergency fixes
Browser makers and software developers have pushed out emergency fixes. Mozilla got the report just on Oct. 17 after 8 p.m. UTC and had a block in place about three hours later. Chrome blocked the certificates the same day. Apple followed on Oct. 19 and Microsoft on Oct. 20. eMudhra has also revoked them.
Mozilla browser warned that network interceptors could use these fraudulent certificates to impersonate trusted sites, allowing them to read or alter the user’s data.
www.coindesk.com