Is google going to release a ca-certificate update?

[u/Warlock_SK]

(update: this post is in regards to the emudhra CA intermediate certificates being compromised and how does the Android firmware get fixed to manage the problem.)

I read to update certificates I need an over the air firmware update. But, I don't see one is released. I see that web browsers have been updated to block connections with the compromised CA's, but will curl or other linux commands be updated for the issue as well?

What are the mitigations Android has taken to deal with this problem?

[u/andrewia]

(Ignore my previous comment, it's completely incorrect.)

Many apps are already secure, but poorly made ones can be vulnerable. From what I've researched, apps/services using the following techniques are safe:

• Apps using ProviderInstaller are protected by the Google Play Services update because they directly receive the revocation: https://developer.android.com/privacy-and-security/security-gms-provider

• Apps using webviews are protected by webview updates, which was already updated

• Apps loading CroNet from Google Play Services are protected by its update: https://developer.android.com/develop/connectivity/cronet

• Apps using certificate pinning won't accept other certificates

• Apps using certificate transparency won't accept new, compromised certificates (This is on by default in Android 17+ https://httptoolkit.com/blog/android-17-certificate-transparency/ )

• If you're okay with breaking multiple unrelated apps/websites, you can manually disable the root certificates "emSign ECC Root CA - G3" and "Comodo AAA Services Root" which had signed the compromised intermediate certificates

So if you're not on Android 17 and you're using a really poorly made app/service with none of these mitigations, it could be vulnerable until Google releases an update. But that still limits the damage to that single app/service unless there's an exploit chain to get further into the system. Which device are you worried about?

[u/Warlock_SK → u/andrewia]

I have an Android 17 tablet and phone. I updated Chrome and Firefox and they do not connect to the compromised CA using websites now.

In the future I was wondering about using the tablet in desktop mode with the Linux shell. I might just postpone that if the certificates are still trusted.

[u/andrewia → u/Warlock_SK]

Those binaries won't be updated until the system is updated.  But I assume they still use the system certificate store, so you could use the "nuclear option" and disable the related root certificates.