4 ms·
tl;dr - "At around 8pm, on January 26, reports appeared on Weibo and Twitter that users in China trying to access GitHub.com were getting warning messages abou
by alxndr 14y ago
tl;dr -
"At around 8pm, on January 26, reports appeared on Weibo and Twitter that users in China trying to access GitHub.com were getting warning messages about invalid SSL certificates. The evidence, listed further down in this post, indicates that this was caused by a man-in-the-middle attack."
"The attack happened on a Saturday night. It was very crude, in that the fake certificate was signed by an unknown authority and bound to be detected quickly. The attack stopped after about an hour."
"While the attack was short-lived, it is possible that passwords of many GitHub users were recorded. It’s also possible that the IP addresses of users accessing certain URLs, such as these lists of GFW [Great Firewall] contributors, were tracked."
"HTTPS effectively disables half of what the Great Firewall can do. We have argued for a long time that the reason that Gmail isn’t fully blocked is that it’s considered too important and that the backlash against closing down access would be too great. ... It now appears that GitHub has been added to this list. ... With every website that switches to HTTPS, the authorities’ options are limited to two: completely blocking it, or completely allowing it. The more they fear a public reaction to complete blocks, the fewer their options become. Man-in-the-middle attacks are likely to become increasingly tempting."
"No browser would prevent the authorities from using their ultimate tool though: certificates signed by the China Internet Network Information Center. CNNIC is controlled by the government through the Ministry of Industry and Information Technology. They are recognized by all major browsers as a trusted Certificate Authority. If they sign a fake certificate used in a man-in-the-middle attack, no browser will warn of any usual activity."
- loeg 14y ago> "No browser would prevent the authorities from using their ultimate tool though: certificates signed by the China Internet Network Information Center. CNNIC is controlled by the government through the Ministry of Industry and Information Technology. They are recognized by all major browsers as a trusted Certificate Authority. If they sign a fake certificate used in a man-in-the-middle attack, no browser will warn of any usual activity." That is the important part. I am surprised China isn't doing this already. Maybe they are doing so, but only for targeted attacks. The CA community really shouldn't grant China any CA authority whatsoever...
- kyllo 14y agoYou can easily configure your browser to "delete or distrust" the CNNIC's certificates. I just did.
- loeg 14y agoYou or I can, sure. But most people don't know how to. And even I use chrome on many machines… should I have to remember to un-trust CNNIC on every single browser I use?
- kyllo 14y agoIf you're concerned about MITM attacks from China, then yes. But if it actually becomes an issue that most people need to worry about, then a most-people solution will soon be made available (like the browser companies issuing updates that un-trust CNNIC for us). It's not complicated, anyway. At least in Firefox it's just a menu option in Preferences -> Advanced -> Encryption -> View Certificates.
- loeg 14y agoMaybe your older relatives were already familiar with computers, but, anecdotally, watching my parents, aunts, and grandparents attempt to drive multiple layers of menus … I do not think they could figure out how to un-trust CNNIC (and they wouldn't understand what the impact was, anyway…).
- kryptiskt 14y agoThe attack would be easily detectable, and lack any deniability as the use of a CNNIC cert as root is manifest. All in all, it would be a better move for an intelligence agency to take over some marginal Authority in the west and use that for dirty work.
- loeg 14y agoSpecifically, I am imagining attacks against political dissidents inside China. Sure, technology savvy folks like us can just un-trust the CNNIC CA. But your average person doesn't know enough to do so.