Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could be reconstructed in under a second.

The announcement closes an incident where major browsers blocked the certificates and  Indian authorities launched an investigation.  

The company said its board concluded after detailed deliberations that leaving the business was the right decision for eMudhra and its shareholders. Company Chairman V. Srinivasan cited rising costs from data sovereignty and compliance requirements, along with competition from large providers that issue the certificates free of charge. He also said social media amplification of the incident brought scrutiny “out of proportion” to the unit’s place in the company.

“For many certifying authorities, SSL/TLS is the whole business,” the company said. “For eMudhra it is one part of a much broader digital solutions portfolio.”

The episode began last week, when a researcher notified Apple, Google, Microsoft and Mozilla that the private keys of eight eMudhra intermediate certificates could be computed from the public certificates because they were generated with too little randomness. Security researcher Scott Helme recovered all eight on his laptop in less than a second, a task he said an AI agent later repeated from a single prompt.

Normally, a private key is a secret number so large that no computer could ever guess it, roughly 77 or 78 digits long for the type of cryptography used in these certificates. Each of the eight eMudhra keys was a whole number below 256, with one simply logged as the number 4. Since a certificate publicly displays the key it was built from, anyone could test every possible value in seconds, and such keys could be used to forge certificates and impersonate websites.

eMudhra attributed the flaw to an error in a key generation ceremony held April 2025, saying the mistake produced a second, weak set of keys that was published to browser trust lists instead of the intended ones. The company said its infrastructure was not compromised, that no data was breached and that none of the eight intermediates had issued end-entity certificates. Whether anyone used the keys in question is not known.

Chrome and Firefox blocked the certificates within hours of the report, Apple blocked them Monday and Microsoft on Tuesday. Mozilla removed the company’s root certificate from its trusted list, and Google said it will remove that root from Chrome in an update expected next week while it reviews eMudhra’s remaining root certificate. Go, Node.js, Python’s certifi bundle and several Linux distributions also shipped updates.

CERT-In, the country’s computer emergency response team, said it did not see any malicious use of the keys as of Wednesday.

The company said its other businesses, including digital signature and enterprise security services, continue to operate normally, and acknowledged reputational risks it cannot quantify.

Shares of ​the company fell 40% in the two days after the vulnerability was disclosed.

The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared first on CyberScoop.

Cyberstalkers are increasingly exploiting a feature in Google Chrome meant for mobile phone user convenience, but can give intruders broad access to a device owner’s private information, according to researchers.

Certo Software said in a blog post Tuesday that stalkers are making use of Chrome’s sync capability — meant to make it so signing into Chrome on one device makes it easier to do so on other devices, too — to spy on a phone owner’s browsing history and gain access to their stored passwords.

As an illustration, Certo used the case of a pseudonymous victim, Emma, who had searched for a family lawyer and visited a domestic violence support website while her partner was sleeping, only for him to bring up to her two days later.

“Emma had been careful to only ever use her own device, and she hadn’t noticed any new apps appear on her phone,” wrote Certo co-founder Russell Kent-Payne. “What she didn’t know was that weeks earlier, during a few unattended minutes with her phone, he had opened the Chrome app and quietly signed it into a Google account of his own. From that moment on, every site she visited was being copied straight to his account, viewable from any device, anywhere in the world.”

The surveillance is as easy as that: brief access to a phone, signing into a Google account and making sure sync is turned on for that account.

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, said on the Bluesky social media app that Certo’s research serves as “an important reminder that tech-enabled abuse isn’t just limited to stalkerware.”

Certo said that Google could do a couple things, such as providing a temporary notification whenever a new account is added or sync is turned on or offering a regular marker to indicate when sync is active and which account it’s syncing to, to protect users.

Google did not respond to multiple requests for comment about Certo’s findings.

But the uptick in usage of that stalking method could be a byproduct of security successes elsewhere in the fight against spyware, Certo said.

“Modern smartphones are harder to compromise than ever. Regular security updates, stricter app store rules, and on-device threat detection have made traditional spyware a much riskier bet for a cyberstalker than it used to be,” Kent-Payne wrote. “As a result, we’re increasingly seeing abusers turn to something far simpler: the legitimate apps already sitting on their victim’s phone. No installation, no suspicious permissions, no telltale battery drain — just a quiet misuse of a feature the victim never knew existed.”

At the same time, Chrome is the world’s most popular browser, and this isn’t the first time security concerns have popped up about its sync feature, among other worries.

The post Security researchers find stalkers abusing Chrome’s sync feature appeared first on CyberScoop.