Working securely through a week of incidents in the digital chain

Last week, things went wrong in more than one place in the digital chain. At certificate provider eMudhra, the keys of eight intermediate certificates turned out to have been generated incorrectly. Because of this, malicious parties could impersonate almost any website or service. At the same time, two critical vulnerabilities were found in PHP, the software that a large part of the internet runs on. Through those vulnerabilities, an attacker could run code remotely, without logging in. Organisations such as the NCSC temporarily took their websites offline.

That put many organisations on alert, including us. Even so, our services remained available throughout.

Trust is our business

Cleverbase exists to let you prove online who you are and to let you sign, with the certainty that it is right.

That is why we got to work straight away. We configured our systems so that the affected eMudhra certificates are no longer trusted. As a result, our own services ran no additional risk. Moreover, the eIDAS certificates and PKIoverheid certificates we build on were not affected.

One of our systems runs on PHP. It had only a limited impact on our services, but we still switched it off immediately, until the security update was installed.

In the meantime, we organised part of our processes differently and checked more by hand. We also checked with our suppliers whether their systems were secure, and took measures where needed.

What this meant for you

We are glad that our services remained available throughout the whole period. You could keep identifying yourself and signing with us, as you are used to.

Because of the extra checks, some applications did take a little longer than usual. That was a deliberate choice. Did you have to wait? Then thank you for your patience.

Where things stand now

We continue to follow developments in the digital landscape. If necessary, we will take measures again, so that you can keep building on our services.

Finally

A week like this shows how important a solid foundation is. We build that foundation together with our partners, and with you. Thank you for your trust in Cleverbase.

Do you have questions about your application or about the measures we have taken? Then contact us via: https://cleverbase.com/en/contact/

Team Cleverbase