Separate certificate checks may leave crypto apps trusting eMudhra certificates even after a browser rejects them, Peiyu Wang, CertiK’s senior director of digital assets security, warned.
A browser’s certificate decision does not automatically govern every program on a device. Whether a block applies depends on each program’s own trust settings, which can leave trading bots and exchange apps outside browser safeguards. The issue follows Chrome and Firefox’s blocks on eMudhra certificates; an earlier EconoTimes report said software with separate trust stores could continue accepting them.
An attacker would first need to control where a user’s connection goes, Wang said. That foothold could let the attacker pose as an exchange, wallet interface or application programming interface (API) through HTTPS. The attacker could then change where a deposit is sent or induce a user to approve a harmful transaction. Possessing the certificate authority key would still not give an attacker access to wallet private keys.
Wang said the flaw does not single out the crypto industry; businesses in other sectors face comparable exposure. He told operators to install current software, refresh certificate trust stores and test whether their apps reject the affected certificates.
