Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.
https://emudhra.we-have-a-problem.com/
Ssl is pretty useful, yeah, but those that were mass unlocked with a gimmick key were already very insecure and at this moment they are revoked. Either way, aren't you supposed to be locked in now?
That only applies to applications and services that support remote certificate revocation.
Those certificates were still in use until Firefox offered another update this morning, but that's just the browser. Every company and their little bastard love child wants you to use an app to connect to their services, how many of those apps support automatic certificate revocation?
Any app on your phone that doesn't is now vulnerable to being compromised invisibly. A successful MITM attack looks like nothing at all. The attacker decrypts the traffic with the compromised certificate's secret to snoop in on the secrets (like username and password) and re-encrypts it to send it forward so the destination server doesn't know any different either.
Now that it's public knowledge, I guarantee someone is trying to capitalize on it right now.
How certain are you that not a single switch between you and your bank's website is fully secured?