Many Electron Apps Still Trust Compromised eMudhra Certificate Keys
Summary
A scan of 36 Electron apps found many still trust certificates made with recoverable eMudhra keys; some also install unsigned updates. No attacks have been reported, and the scan warns its list may contain misattributions.
Key points
- Researcher Pascal Schärli’s scan found that 11 of 36 apps on Linux and 9 on Windows failed both checks: rejecting certificates made with the cracked keys and verifying update signatures.
- On macOS, none failed both checks because the update framework checks developer code signatures, though 20 apps still trusted the cracked keys.
- Session, Filen and Internxt were highlighted as having an unpatched Electron version and a Windows updater with signature checking switched off.
- The article explains that an attacker positioned between an app and its servers could use a trusted forged certificate to deliver a fake update; no such attack has been reported.
- Schärli says an AI model helped compile and test the app list and cautions that some findings may be misattributed.
- Users are advised to download updates from developers’ websites, pause automatic updates where possible, and be cautious on networks they do not control.
Article Details
- Event Type
- Security research findings on desktop apps that continue to trust compromised eMudhra certificates and, in some cases, install updates without verifying their signatures.
- Impact
- Pascal Schärli's scan covered 36 Electron apps. It found that 11 Linux apps and 9 Windows apps failed both certificate-trust and update-signature checks; 20 Mac apps still trusted the compromised keys. The reported weakness could allow an attacker positioned between an app and its servers to supply a fake update that runs code on the user's computer. No such attack has been reported. The scan's author cautioned that some findings may be misattributed.
MITRE ATT&CK
People
Vendors
AppleMicrosoft followed on 20 October and Apple on 22 October.BitwardenSchärli also writes that he reported unchecked updates to Proton, Bitwarden, Internxt and Filen earlier this year.CloudflareCloudflare wrote on 30 October that it had found “no evidence of the weak keys being used to intercept Cloudflare’s connections so far”, and added that this doesn’t rule out targeted interception.eMudhraBrowsers stopped trusting eMudhra’s cracked certificates within hours in October.MicrosoftMicrosoft followed on 20 October and Apple on 22 October.ProtonSchärli, who spent this year publishing critiques of the encryption in Proton, Internxt and Filen, checked two things for each app.
Products
BitwardenSchärli also writes that he reported unchecked updates to Proton, Bitwarden, Internxt and Filen earlier this year.ElectronSecurity researcher Pascal Schärli published a scan of 36 apps built on Electron on 10 November.FilenAmong those that still accept certificates signed with the compromised keys are the Session messenger, the encrypted cloud drives Filen and Internxt, and the note apps Notesnook and Standard Notes.Google ChromeFirefox and Chrome blocked the certificates on 17 October, the day the flaw was reported.InternxtAmong those that still accept certificates signed with the compromised keys are the Session messenger, the encrypted cloud drives Filen and Internxt, and the note apps Notesnook and Standard Notes.Mozilla FirefoxFirefox and Chrome blocked the certificates on 17 October, the day the flaw was reported.NotesnookAmong those that still accept certificates signed with the compromised keys are the Session messenger, the encrypted cloud drives Filen and Internxt, and the note apps Notesnook and Standard Notes.Proton MailProton Mail’s desktop app has the fix. On Windows, its updates still go unchecked through a separate installer called Squirrel, which relies on the Windows list of trusted certificates.Proton PassProton Pass also runs an unpatched Electron, but it pins the certificates of Proton’s own servers, so its main traffic never trusts eMudhra, and the scan found no unchecked updates in it.SessionAmong those that still accept certificates signed with the compromised keys are the Session messenger, the encrypted cloud drives Filen and Internxt, and the note apps Notesnook and Standard Notes.SignalSignal shows the other end. It has had the fix since version 8.32.0, and on Windows its updates carry Signal’s own signature, checked before anything is installed.SquirrelOn Windows, its updates still go unchecked through a separate installer called Squirrel, which relies on the Windows list of trusted certificates.Standard NotesAmong those that still accept certificates signed with the compromised keys are the Session messenger, the encrypted cloud drives Filen and Internxt, and the note apps Notesnook and Standard Notes.