Mmastodon TechnologyCybersecurity first seen 2 d ago, last 2 d ago, peak #1
eMudhra CA certificate enables fully trusted TLS interception via mitmproxy
Original: You can just drop the # eMudhra CA certificate to # mitmproxy and have fully trusted TLS MiTM right now - what a time to
Security researcher Harry Sintonen reports that eMudhra's certificate authority can be dropped directly into mitmproxy, allowing fully trusted TLS man-in-the-middle interception without generating a custom certificate. Because the CA is trusted by default in many environments, traffic interception can go undetected, raising concerns about the certificate authority's handling and trustworthiness.
Why now: A widely trusted certificate authority apparently allows trivially trusted TLS interception, which is a serious and timely security concern.
eMudhramitmproxyHarry Sintonen
Evidence
- You can just drop the # eMudhra CA certificate to # mitmproxy and have fully trusted TLS MiTM right now - what a time to be alive... https:// docs.mitmproxy.org/stable/conc epts/certificates/#the-mitmproxy-certificate-authority # pentesting # cybersecurity # infosec · harrysintonen@infosec.exchange · 26
API: https://socialmediatrends-api.osmike.com/v1/trends/3030296