6 ms·
In order to successfully pull off the MITM attack against TLS connections they will need a rogue CA or cooperation from browsers. Fortunately Thailand is comple
by Canada 10y ago
In order to successfully pull off the MITM attack against TLS connections they will need a rogue CA or cooperation from browsers. Fortunately Thailand is completely dependent on foreign software and services, and I see no reason why Google, Mozilla, Facebook, etc would cooperate.
The government will still be left with two options: Severely cripple themselves by blocking entire services or remain unable to decrypt traffic. Unlike China, Thailand is in no position to create their own search engines, social media and messaging systems.
- matthewaveryusa 10y agoI think they'll go the simple route: They;ll install a root CA that signs all other CAs going through to mitm. People will get warnings and just install the root CA. The government will probably be helpful by giving you links to browser binaries that already have the root CA installed. Of course their systems will be hacked by the americans, russians, israelis and chinese, at which point all of these entities will be able to mitm the mitm - mitm-ception!
- Canada 10y agoI think that it will be just like the single gateway in general - there's some technically incompetent talk about it and absolutely no action.
- geomark 10y agoWord is that the single gateway is moving forward toward implementation. They just stopped talking about it. My guess is that they will attempt to do what is being talked about. If it breaks the internet in Thailand they don't care. The junta and their masters don't really understand and don't use it. It's just a toy to them and a place that is used to spread speech they don't like. The royalist elites that the junta are focused on protecting have their private bankers and underlings to take care of things so they don't care if internet banking is broken or if social media breaks. All that matters to the junta is protecting their core interest group of royalists.
- PeterisP 10y agoCert pinning doesn't just give warnings, it simply refuses connect over MITM, period. Just a few days ago I was at some airport wifi hotspot that was MITM'ing things, my android phone simply refused to go to https://google.com https://google.com with a warning about this and no option to accept the cert signed by their fake CA.
- Klathmon 10y agoBut locally installed certs can bypass that restriction in all major browsers.
- robryk 10y agoWell, so they will helpfully supply browser binaries that have cert pinning disabled? Though I don't see how they will manage that for mobile browsers.
- fulafel 10y agoUnfortunately browsers exempt locally installed CAs from MITM countermeasures, to support employer/school mandated domestic surveillance in the USA.
- pcl 10y agoDo those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven't dug through the browser code to see what's happening in standard distributions.
- ikeboy 10y agoYes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
- gruez 10y agoThe point of HSTS (and preloading) is to protect clients from sslstrip (and similar attacks). as in, client types in a http url, and the attacker prevents the http connection from being upgraded.
- ikeboy 10y agoIs there a way to leverage such access into secure browsing? Some kind of "secure https" over "mitm https", where they only see the encrypted layer even with their mitm access?
- Natanael_L 10y agoYou can easily do double tunneling, sure. Or even tunnel over DNS. Or over ping packets.
- matthewaveryusa 10y agoYou can go over a VPN. I use the VPN my corporation provides as I deem them trustworthy. Before this I used an AWS EC2 instance and did a poor man's VPN using sshuttle[1] . I've also done it using sshuttle to a NAS I have sitting in my living room. [1] http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/ http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/
- geomark 10y agoWhen you connect to a VPN doesn't it do key exchange in the same way as making a https connection to a website? They would just MITM that as well, right?
- walrus01 10y agoThey can try to force local computer retailers to install a root CA before systems are sold.
- Canada 10y agoThey could try that. They might be able to get the small number of phone carriers to do it on handsets they sell. Of course, they'd have to ask their handset partners who control the firmware to do that for them. Android dominates in Thailand. I wonder if Google's licensing allows vendors to make such modifications for carriers? The leaked agreement between Google and Samsung explicitly forbids tampering with any of Google's software.
- msbarnett 10y ago> In order to successfully pull off the MITM attack against TLS connections they will need a rogue CA or cooperation from browsers. Well, "fortunately", Blue Coat Systems, leading manufacturer of intercept devices for authoritarian regimes, now has an intermediate cert courtesy of Symantec CA, so they're fully capable of issuing and installing MITM certs for use on their clients' devices.
- Canada 10y agoExcellent point. The trustworthiness of the CA system demands the revocation of that certificate.
- curiousgal 10y agoSaid trustworthiness should have stopped them from granting the certificate in the first place.
- Canada 10y agoYeah. Maybe its issuer should also be revoked for good measure.
- pcl 10y agoThis is why HSTS pre-loading is so important: https://hstspreload.appspot.com https://hstspreload.appspot.com
- gruez 10y agoYou would think that if they did something like this their (or Symantec) CA will be revoked... right guys?
- cheshire_cat 10y agoI was under the impression that they can't issue Sub-CAs because the pathlen of their Cert is set to 0. [0] They would have to give their private key to their clients to achieve a MITM attack, right? [0] https://crt.sh/?id=19538258 https://crt.sh/?id=19538258
- johansch 10y agoIt would also break software updates from Microsoft, Apple, Google, etc. And like one bazillion apps that unlike browsers will not have any UI to ask the user to confirm if falling back to unencrypted channels is okay. I really don't see this working without Thai people revolting...
- fucking_tragedy 10y ago> I see no reason why Google, Mozilla, Facebook, etc would cooperate. Because they are for-profit businesses who would want an economic edge over competitors in the Thai market and aren't vanguards for classical/social liberal ideals?
- JBReefer 10y agoMozilla once was