A critical update to address compromised eMudhra certificates
Private keys for eight intermediate certificates from eMudhra, a widely trusted certificate authority, were recently compromised. Box Drive relies on publicly trusted certificates (including those impacted from eMudhra) to confirm it is connected to Box. Older versions of Box Drive below v2.55.145 that still trust the affected certificates can accept a forged certificate for Box.
An attacker who can intercept the connection between Box Drive and Box could then impersonate Box during that session and view or alter sign-in credentials and file content in transit. Box Drive v2.55.145 and later is fixed to not trust these compromised certificates.
What should I do?
Box has released a critical Box Drive security update to address the issue with the compromised eMudhra certificates.
We recommend updating all Box Drive clients to v2.55.145 (or later) immediately.
Take one of the following actions to update your client:
- Leverage auto-update on relaunch: Box Drive can auto-update on launch when an update is detected. To accelerate adoption, consider using MDM to force an app relaunch so the update is applied.
- Deploy via MDM: Download the updated Box Drive installer here, and deploy it via your MDM solution.
-
Optionally, ask users to update manually:
- When an update is available, Box Drive displays a system notification and adds a badge to the Box icon in the Windows system tray, or a badge on the macOS menu bar.
- To install the update, users can follow the instructions here corresponding to their OS.
To confirm your version, open the settings menu and select “About Box Drive.”
If you have any questions or would like assistance planning or validating this update, please contact Box Support or your Box account team.