coindesk.com
A cryptography slip at an Indian certificate company has made its way into Ethereum, where it could have let attackers quietly send some validators’ block rewards to themselves.
Teku, the software many validators use to run Ethereum’s proof-of-stake side, released version 26.10.3 on Tuesday. Besu, which processes Ethereum transactions, released version 26.10.2 on Monday. Both updates stop trusting certificates tied to eMudhra, an Indian certificate authority, in their Docker images, the prepackaged versions many operators run.
Validators are the computers that stake ETH to secure Ethereum and earn fees for proposing blocks. Some of them talk to other services over the internet, and they rely on digital certificates to make sure they’re talking to the right one.
What broke
On Oct. 17, researchers found that the private keys behind eight of eMudhra’s intermediate certificate authorities had been generated with too little randomness.
That meant the keys could be worked out from the certificates themselves, which are public. Anyone holding those keys could issue certificates that unpatched software would accept as real. Browsers blocked the certificates, eMudhra revoked them a day later, and the company has since said it will exit the certificate business.
Read More: A company that vouches for websites had secret keys so weak that 8 of them were cracked
Java, the programming language Teku and Besu run on, doesn’t check whether a certificate has been revoked by default. So Teku’s Docker images kept trusting the bad certificates even after browsers had dropped them.
How validators could lose money
An attacker sitting between a validator and a service it connects to could pose as that service. In its security advisory, Teku said a validator fooled this way could propose a block that pays its fees to the attacker’s address.
A fake external signer, the separate service that holds a validator’s keys, could hand over signatures used to change where rewards go, which Teku ranked as the riskiest setup.
“A default Teku node on mainnet is not affected and needs no action,” the team wrote, adding that “no exploitation has been reported.” Consensys Diligence, Teku’s security partner, initially flagged the problem.
Operators who run Teku or Besu directly on their machines, without Docker, have to update Java themselves, since updating the Ethereum software doesn’t touch Java’s list of trusted certificates. The new Docker images don’t fix Java installed on the host, either.
Anyone still on Java 26 has a harder fix, however. Teku said that version is end of life and won’t get a patched build, so those operators need to move to Java 25.
