On macOS, git still trusts the compromised eMudhra certificates

The site emudhra.we-have-a-problem.com reports today that Apple's developer tools still trust the compromised eMudhra roots. Apple was told about the problem on 17 October, eleven days ago. The git, curl and python3 that come with macOS all use Apple's root store. The site is dated 28 October. The attack is live for any developer who clones, pushes or fetches over https on an untrusted network.

What the compromise means for a developer

Any HTTPS connection made by Apple's git on macOS can be intercepted. The site writes that a clone or pull from an https remote can deliver attacker-chosen code. A push can be altered in transit. The URL https://user:TOKEN@github.com sends the GitHub token with the request. Anyone on the network path can read it. The same applies to curl and python3, because all three use Apple's shared root store.

Apple was told about the eMudhra incident on 17 October. macOS 27.2 came out on 26 October without a fix. The site writes that the update also removed the hand workaround some users had applied. Machines that had been safe for a week were open to the attack again.

The check and the workaround

The site gives a one-line check:

git ls-remote https://git-emudhra.we-have-a-problem.com/check.git

A certificate error means the local git is protected. If the command lists a commit, the git is affected. The site also publishes a demonstration. It uses a test server impersonating github.com through one of the compromised eMudhra intermediates. The -c http.curloptResolve option makes the redirect live for one command only. A patched git refuses with a certificate error. If the clone succeeds, a README that starts with INTERCEPTED appears.

For curl, the equivalent check is a request to one of the test subdomains on the same site. A certificate error means curl is protected.

The site writes that the fix on the developer's side is to remove the affected eMudhra roots by hand. The file is /etc/ssl/cert.pem. Apple has already protected Safari and other apps built on the Network framework. The site argues that Apple should also release an updated cert.pem for the developer tools, with the affected roots removed.

Why the gap matters

Many other projects released fixes days ago. The Chrome root store, the Mozilla root store and the open-source curl distribution all distrusted the compromised roots. Apple's developer tools are the slowest piece of the chain to catch up. The gap stays open until the next macOS point release. Any developer on a public Wi-Fi or a shared office network is at risk. The safety of each git call comes down to the attacker not knowing which eMudhra intermediate to use.

Source

Primary source: Apple's git still trusts the compromised eMudhra certificates, emudhra.we-have-a-problem.com.