🇸🇩❌🇸🇩🇪🇹 — GRAPHIC: The UAE-backed RSF captured the Al Barakah area in the Blue Nile State of Sudan, following heavy combat against the Sudanese army.

Following the battle, RSF officers released footage showing killed ethnic Tigrayan combatants, whom the group claims are hired mercenaries from the TPLF/TDF.

🇮🇳🌐 Indian information security company and certificate authority (CA), eMudhra, suffered a major security breach on October 17th, leading to the leak of 8 private keys to 8 intermediate CAs trusted by the Mozilla, Google and Microsoft root programs and downstream websites.

An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.

This has already been remediated by Mozilla, Microsoft, Apple, and Chrome for their users through their tools for distributing revocation information such as OneCRL, CRLite and CRLSets but many other sites, apps and devices will need to go manually install the patches or risk being hacked or infected with malware. Tech experts say this breach could be bigger than the 2014 Heartbleed security disaster.

The breach wasn't made public until October 19th.

While looking for the source of the breach it was revealed that eMudhra's cryptographic keys were so weak, the hackers didn't make much of an effort to crack them. While a normal cryptographic key can have as many as 120 digits, eMudhra's cryptgraphic keys had somewhere between 1-3 digits.

Anyone with those keys could have forged trusted certificates for virtually any website, potentially fooling your browser if they intercepted your connection and gotten hold of any information stored like passwords, credit card info or location but its unlikely as Google, Mozilla, Microsoft and Apple patched the breach before it was made public.

There have been no verified reports of malicious use forged intermediate CAs linked to this security breach so far.

@CIG_telegram