4 ms·

Could someone please explain how CINIC could enact a man in the middle act with this inclusion? I am vaguely aware of MITM attacks: that someone sends you thei

by tarkin2 17y ago

Could someone please explain how CINIC could enact a man in the middle act with this inclusion? I am vaguely aware of MITM attacks: that someone sends you their public key while pretending to be someone else. And this means the data you send is encrypted in a way that the MITM can see. However, I'm unsure how CINIC's inclusion in Firefox's root certificates facilitates this. Perhaps I'm not the only one?

jodrellblank 17y ago
Incidentally, it doesn't have to be evil governments doing this. If your employer uses Watchguard firewalls, they can proxy SSL connections, replace the SSL certificate with one signed by the firewall, and act as a MITM to filter and report the connection contents. If your employer has pushed out certificates by, e.g. active directory and group policies on Windows, then the site will appear padlocked without warnings and you will be none the wiser unless you inspect the certificate. I'm assuming other firewalling products can do similar.
tarkin2 17y ago
On thinking about it a little more, I guess when you visit a site with SSL, and that site subsequently sends you its public key, which in turns allows you to send it encrypted data, Firefox will only accept public keys signed (authorised) by those companies in your root certificate list. This means if, unknown to you, CINIC impersonates a domain which uses SSL, and you visit that domain and assume your SSL connection will be safe from prying Chinese officials, you're incorrect. Incorrect because Chinese officials could have created that bogus SSL certificate, and it would be accepted by Firefox because Firefox now accept CINIC as a root authority. Any confirmation, in case I'm spreading inaccuracies, would be appreciated.
- AndrewHampton 17y ago
  Does anyone know if the Chinese gov't could use information gathered by CNNIC for issuing the certificate to decrypt traffic it intercepts encrypted by the public key?
  - tarkin2 17y ago
    CNNIC would only ever see the public key, and you can't decrypt encrypted data using the public key--you must use the private key to decrypt the data, something CNNIC would not see--so no. As mentioned, CNNIC's inclusion only allows a Man In The Middle Attack. That is, CNNIC, i.e. the Chinese government, pretending to be a site they're not, and using their status as a Firefox (and other) -authorised root certificate provider to further trick the user into accepting the bogus SSL certificate as originating from the hijacked domain.
    - AndrewHampton 17y ago
      OK, thanks for the explanation.
- __david__ 17y ago
  This is indeed the case. The weakness of our current SSL infrastructure is that any CA can sign any site's cert. So the more trusted CAs you have, the wider the attack vector is--all it takes is one rogue CA (or more likely, one CA with weak security) and you can be effectively man-in-the-middled.
est 17y ago
Here is a Chinese blog, hijacking the top 4 email provider SSL on a local machine http://wuhongsheng.com/it/2009/09/ssl-hijack/ http://wuhongsheng.com/it/2009/09/ssl-hijack/

by tarkin2 17y ago

jodrellblank 17y ago

Incidentally, it doesn't have to be evil governments doing this. If your employer uses Watchguard firewalls, they can proxy SSL connections, replace the SSL certificate with one signed by the firewall, and act as a MITM to filter and report the connection contents. If your employer has pushed out certificates by, e.g. active directory and group policies on Windows, then the site will appear padlocked without warnings and you will be none the wiser unless you inspect the certificate. I'm assuming other firewalling products can do similar.

tarkin2 17y ago

On thinking about it a little more, I guess when you visit a site with SSL, and that site subsequently sends you its public key, which in turns allows you to send it encrypted data, Firefox will only accept public keys signed (authorised) by those companies in your root certificate list. This means if, unknown to you, CINIC impersonates a domain which uses SSL, and you visit that domain and assume your SSL connection will be safe from prying Chinese officials, you're incorrect. Incorrect because Chinese officials could have created that bogus SSL certificate, and it would be accepted by Firefox because Firefox now accept CINIC as a root authority. Any confirmation, in case I'm spreading inaccuracies, would be appreciated.

AndrewHampton 17y ago
Does anyone know if the Chinese gov't could use information gathered by CNNIC for issuing the certificate to decrypt traffic it intercepts encrypted by the public key?
- tarkin2 17y ago
  CNNIC would only ever see the public key, and you can't decrypt encrypted data using the public key--you must use the private key to decrypt the data, something CNNIC would not see--so no. As mentioned, CNNIC's inclusion only allows a Man In The Middle Attack. That is, CNNIC, i.e. the Chinese government, pretending to be a site they're not, and using their status as a Firefox (and other) -authorised root certificate provider to further trick the user into accepting the bogus SSL certificate as originating from the hijacked domain.
  - AndrewHampton 17y ago
    OK, thanks for the explanation.
__david__ 17y ago
This is indeed the case. The weakness of our current SSL infrastructure is that any CA can sign any site's cert. So the more trusted CAs you have, the wider the attack vector is--all it takes is one rogue CA (or more likely, one CA with weak security) and you can be effectively man-in-the-middled.

est 17y ago

Here is a Chinese blog, hijacking the top 4 email provider SSL on a local machine http://wuhongsheng.com/it/2009/09/ssl-hijack/ http://wuhongsheng.com/it/2009/09/ssl-hijack/