7 ms·
Github SSL replaced by self-signed certificate in China
CHINA NEWS -
Man-in-the-middle attack on Github. -- http://bit.ly/Vqh8zJ
Fake GITHUB cert -- http://www.mediafire.com/?zx6eno648axz7bh
Twitter (Github attack news) -- https://www.twitter.com/search/?q=Github%20SSL
- kevingadd 14y agoHow would this fake cert work? It doesn't seem to originate with a root or have any associated information. Do browsers actually accept certs that look like this?
- dublinben 14y agoIt would work if users accepted the self signed certificate upon receiving the warning. http://pic.twitter.com/xOxhoyzp http://pic.twitter.com/xOxhoyzp
- teawithcarl 14y agoRead the Twitter stream - affects people inside China. Still, shows the depth and corruption the China (gov't). https://twitter.com/search/?q=Github%20SSL https://twitter.com/search/?q=Github%20SSL
- fosfori 14y agoYet still (or because of that?) China will run the global economy in seven years or so. Ten cents per hour is good money...
- MyNewAccount99 14y agoexcept no one really uses twitter in China.. try weibo.
- songgao 14y agoThis reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the trusted server list, they can easily get anyone's account who's using affected browsers. It's weird that they start with Github. It's not a website that's popular among human activists or any other people that China government might be interested in. Instead, it's popular among programmers and hackers, who are the main group and forces in China to help people bypass GFW to access blocked content. I suppose this attack might be what the government uses to test reaction and capability of hackers. Seriously, this is really, really, bad. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=542689 https://bugzilla.mozilla.org/show_bug.cgi?id=542689 EDIT: added link for bug report
- dublinben 14y agoIf you actually look at the certificate, it is self-signed, not signed by a malicious root server. Your anecdote has nothing to do with this current attack.
- songgao 14y agoYou are right. This one has nothing to do with root servers. But they are already able to fake certificate national wide. It's only one step from adding it into root server.
- j45 14y agoMaybe having access to the sourcecode of a site or app = access to the site or app.
- floatingatoll 14y agoSpoofing GitHub's SSL certificate is a step in the direction of inserting espionage-style backdoors, as GitHub permits HTTPS read-only checkouts of repositories. I'm not suggesting that this will be free of problems, given how particular Git is about checksums, nor am I certain what methods they would use to acquire SSH commit access for altering repository contents to affect the rest of the world. Still, it's absolutely a necessary prerequisite to altering data from GitHub - and, if they acquire SSH keys, altering data at GitHub. Both possibilities are terrifying.
- PleaseStand 14y agoGitHub now [allows HTTPS pushes][1], so a man-in-the-middle attack on a single connection would be sufficient to push backdoors. In any case, can't the intermediary just add another SSH key to the account? [1]: https://help.github.com/articles/pushing-to-a-remote https://help.github.com/articles/pushing-to-a-remote
- hakaaaaak 14y agoSome possible reasons: GitHub is popular among developers. Many developers have faster computers and more computers per household than others that aren't in IT/development. Many developers, though they pretend to be security minded and focused at times, often have a more lax attitude in practice than system administrators, especially at home or working on personal projects. Some developers have more usernames/passwords and certs to other servers available than non-developers would. Some developers have access to other confidential data or newer technology that could be of practical use.
- teawithcarl 14y agoHere's another (safe) "tweet" by China geek alerting the situation. RT @chenshaoju 无锡电信实际测试GitHub已经遭到SSL中间人攻击。 http://bit.ly/X49oPK http://bit.ly/X49oPK
- j45 14y agoIt sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)
- AndrewKemendo 14y agoI find this a sad commentary about your (and certainly others) relationship with your clients.
- ihsw 14y agoThis is utter rubbish, hosting your own git server(s) is easily justifiable. The client declining to hosting code on github should be enough justification.
- venomsnake 14y agoThere is nothing wrong in insisting the repository to be hosted on the client metal. The way things were done in the ancient times before the cloud to become the favorite buzzword of the month.
- j45 14y agoI agree. The cloud isn't new. VPN's have existed for ever as well as client-mainframe. The perception that the cloud is somehow re-invented is in fact the saddening thing. It's just more accessible and faster than in the fast, but ultimately you can't manage infrastructure by abdication and farming it out. There's always an uneasy balance between security and convenience.
- unreal37 14y agoMy client would never allow their source code to be hosted in the cloud either. There's really no point fighting them on this, since they employ security and legal teams for just this purpose. The external marketing partner is not going to trump that. Ever. And there's nothing wrong with this.
- j45 14y ago
- xfs 14y agoI guess it was a planned public test or technical verification of certain larger project about live traffic decryption on national level. There really isn't a plausible political reason of github being targeted. Maybe targeting github can get data about user response or verify scalability of the infrastructure given recent high https traffic volume from China to github.
- dbaupp 14y agoIt seems strange that they would target a site whose users are exactly the people most likely to detect and understand (and make a fuss about) internet peculiarities.
- moxie 14y agoTo clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com So your browser will warn you that you are not making a secure connection. Firefox users, for instance, will have to make 5 clicks to get through that warning and visit the page. I think "China turns off SSL access to GitHub" might be a more appropriate title.
- teawithcarl 14y agoThanks, Moxie - The original article in China (by top-notch geeks) wrote 中间人攻击 which translates directly to "man-in-the-middle attack". Appreciate your insight - thanks for weighing in on this.
- fintler 14y agoI don't think there's proof of China doing anything here. Perhaps someone on OP's coffee shop WiFi is poisoning arp tables and forging certs. This seems really sloppy for China. Without further proof, I don't think it was the govt.
- moxie 14y agoAgreed there's nothing in the data to directly suggest government involvement. It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to GitHub entirely IIRC. It could be that they decided to block SSL access, but allow HTTP access, and this is how they implemented that.
- fintler 14y agoIt appears that my contrived scenario is incorrect. The incident seems to have occurred at several locations across the country. Assuming this is correct, it does appear to be a government action. https://twitter.com/0xabad1dea/status/295606501798719488 https://twitter.com/0xabad1dea/status/295606501798719488
- dguido 14y agoI was wondering when Github was going to start supporting HSTS and 2-Factor Auth. I'm betting that it gets bumped in priority after this event. Nothing like an incident to move along security requirements! http://dev.chromium.org/sts http://dev.chromium.org/sts https://www.duosecurity.com/features https://www.duosecurity.com/features
- oijaf888 14y agoWhy use duosecurity over something like RFC 6238 and RFC 4226?
- moxie 14y agoI don't think either would help in this situation. HSTS helps prevent SSL stripping attacks, which whoever is denying SSL access to GitHub doesn't need to bother with. 2FA serves as an annoyance to phishers, but whoever is doing this network attack has direct access to your session cookie.
- technoweenie 14y agoWe've supported HSTS for for well over a year now.
- moonboots 14y agoFortunately, it looks like Chrome prevents users from clicking past the ssl errors. This Chinese chrome screenshot[1] shows that there's only a back button (for English versions of this page, see [2]). Unfortunately, it appears that IE allows users to click past the errors[3]. I'm also interested in how the 360 browser[4], which has been gaining market share in China, handles the error. Does anyone have any theories why China would use a self signed certificate when it's very indiscreet? A lot of users will just click through if given the opportunity (around 60% in chrome before new security measures prevented it[2]), but I doubt many users with truly sensitive private repos would do this. [1] https://twitter.com/GreatFireChina/status/295236912594186240/photo/1 https://twitter.com/GreatFireChina/status/295236912594186240... [2] http://www.imperialviolet.org/2012/07/19/hope9talk.html http://www.imperialviolet.org/2012/07/19/hope9talk.html [3] https://twitter.com/chenshaoju/status/295139636718743552/photo/1 https://twitter.com/chenshaoju/status/295139636718743552/pho... [4] http://news.ycombinator.com/item?id=4499168 http://news.ycombinator.com/item?id=4499168
- runarb 14y agoMany are mentioning the Chinese government, but are there any signs that they are involved? How do we know that this isn't just a hijack of a Chinese isps dns server or something similar? Maybe the same that happened to Goolge Morocco just a couple of days ago ( http://arabcrunch.com/2013/01/breaking-google-morocco-google-co-ma-is-hacked.html http://arabcrunch.com/2013/01/breaking-google-morocco-google... ).
- No1 14y agoSome speculation as to why they're targeting Github: - the Chinese gov't is trying to identify users/developers of train-ticket-purchasing bots [1] - they are is interested in capturing some intellectual property contained in private repos - it's just an exercise to watch & learn how computer-literate users circumvent a MITM attack Given the recent Github blockade, I'd go with the first. [1] http://www.techinasia.com/github-blocked-china/ http://www.techinasia.com/github-blocked-china/
- matthewrudy 14y agoI should report that from my Shanghai based VPS I don't get this problem. Perhaps this is localised, or was just a trial for a few hours. https://gist.github.com/4650029 https://gist.github.com/4650029
- agl 14y agoFirstly, thanks to GitHub using HSTS on github.com (although not www.github.com), the certificate error will be fatal in Chrome and (I believe, but haven't checked) Firefox as long as you have visited GitHub previously. (It's not preloaded HSTS so it would have to be learnt from a previous, unattacked connection.) I know that the unbypassable errors for some sites upset the more technically minded people, but I think that incidents like this show its value. The CloudShark trace shows what appears to be Firefox connecting to the GitHub IP address, but the server clearly isn't GitHub from the config. The server appears to be configured to accept the client's ciphersuite preference, but doesn't support DHE nor ECDHE. The server is also only 9ms from the client - that's clearly not crossing any oceans. I'd also guess that the server is overloaded at the time because the ServerHello (which doesn't take significant processing to generate in this case) takes 900ms to come back. Sadly, it appears to show the user overriding the certificate error and talking to the server anyway :( Hopefully that was a fresh FF install just to see what would happen (which would explain why HSTS didn't prevent the override). Lastly, the certificate appears to be self-signed, but the Authority Key Id doesn't match. One assumes, based on "OpenSSL Generated Certificate" that OpenSSL was used, but the person may have had some trouble. I'd guess that they generated a CA certificate first (with the same Subject) and then signed the certificate in question as a leaf. Many of the tutorials that you'll find online are for that sort of setup so perhaps they weren't very familiar with X.509 certificates.
- bobcattr 14y agodidn't know of HSTS, thanks. where would one keep up with stuff like that other than keeping up with new rfc's?
- moonboots 14y agoagl's blog is a good source: http://www.imperialviolet.org/ http://www.imperialviolet.org/
- alistair77 14y agoOWASP has lots of useful security info, https://www.owasp.org https://www.owasp.org
- darkhorn 14y agoHow did GitHub learned that there were man-in-middle attack?
- jacquesm 14y agoWhat bugs me about stuff like this is that there will always be mercenaries, guys just like you and me that will do anything as long as it pays. The Chinese government wouldn't stand a chance if they had to do this stuff themselves. Mercenary coders are nothing new, we have them in every country (and sysadmins, companies and so on). But you have to wonder what goes on in their heads, what mindset would prompt you to sell out like that.
- tedunangst 14y agoI kind of get what you're saying, but I think there's a lot of hubris in thinking "my profession is special, only good guys (can learn to) do it". Craftsmen have been complaining about the wrong people getting into their trade for as long as there have been crafts.
- btilly 14y agoWe should be worried about mercenaries when it comes to malware, Russian botnets, and the like. In the case of the Chinese government, I believe the bigger problem is patriots. They honestly believe that they are doing the Right Thing. So did the people who wrote Stuxnet.
- shimon_e 14y agoIn China now. Ping to github is 280ms. The cert I receive is valid. So either they stepped up the game or it isn't universal.
- seanmcdirmid 14y agoEven the Chinese gov does A/B testing.
- freewizard 14y agoIt's more likely capacity limit than A/B testing. Returning arbitrary response is consuming more resource compared to cutting off connection (sending TCP RST).
- guruz 14y agoIn a Hotel in Beijing. Ping around the same, Chrome does SSL and shows no error.
- olalonde 14y agoSame thing in Shenzhen (China Telecom). Everything seems to be normal.
- qschneier 14y agoFYI there is a petition on whitehouse.gov to deny those people who work on GFW entry US. https://petitions.whitehouse.gov/petition/people-who-help-internet-censorship-builders-great-firewall-china-example-should-be-denied-entry-us/5bzJkjCL https://petitions.whitehouse.gov/petition/people-who-help-in...
- X-Istence 14y agoWe should deny all those companies that have developed tools of censorship access to government contracts and deny them the right to work in the United States ... oops, there goes almost every single major networking manufacturer! Cisco: http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Cisco_aided_Chinese_Internet_censorship,_lawsuit_says/ http://newsandinsight.thomsonreuters.com/California/News/201... Juniper also implicated: http://www.cfr.org/china/us-internet-providers-great-firewall-china/p9856#p4 http://www.cfr.org/china/us-internet-providers-great-firewal... Blue coat: http://online.wsj.com/article/SB10001424052970203687504577001911398596328.html http://online.wsj.com/article/SB1000142405297020368750457700... Websense: http://opennet.net/west-censoring-east-the-use-western-technologies-middle-east-censors-2010-2011 http://opennet.net/west-censoring-east-the-use-western-techn... The list goes on ...
- dpeck 14y agoThe natural result of the "code is speech" argument?
- qschneier 14y agoCensorship in China is a big business, for the companies that have connections to the officials, for the universities that rely on the funds, and for the officials who use this as a stepstone for their career. It is so common that you can even find many fresh graduates who worked for the GFW in the job market.
- chimeracoder 14y agoHow long ago did this start? I wonder if it has anything to do with some of the issues with Github I (and others) were noticing on Friday[0] [0] https://twitter.com/davidbalbert/status/294941563673522176 https://twitter.com/davidbalbert/status/294941563673522176
- hackfisher 14y agoBad news, access to github is unsafe for people in china now.