13 ms·

China collecting Apple iCloud data

491 points by tchalla 12y ago

dmix 12y ago
China's surveillance is always so blatant and public, they don't bother trying to hide it like America (which is analogous to political corruption in both countries). When the artist Ai Weiwei had his email account compromised by the state, they simply logged into his email webmail UI and forwarded a copy of his emails to a 3rd party email address. They didn't even bother intercepting his email at the network or service provider level. Edit: > "Apple increased the encryption aspects on the phone allegedly to prevent snooping from the NSA. However, this increased encryption would also prevent the Chinese authorities from snooping on Apple user data." It's a shame articles keep confusing Apple's harddisk encryption with network data encryption. :\
- brudgers 12y ago
  they don't bother trying to hide it Honesty is a traditional value. Privacy and sovereignty based on the consent of the governed? Not so much.
- opendais 12y ago
  Yes, it is really depressing how blatantly we are all being watched. :/
- owenmarshall 12y ago
  > China's surveillance is always so blatant and public, they don't bother trying to hide it like America. I'm a little shocked - they've surely got the ability to do a proper MITM. CNNIC is a root CA for plenty of browsers. Saving it up for when they really need it, maybe?
  - ryan-c 12y ago
    If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.
    - dmix 12y ago
      > I am more surprised that they don't have common Chinese software install a set of MitM CAs. It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly." https://en.wikipedia.org/wiki/Qihoo https://en.wikipedia.org/wiki/Qihoo
      - ryan-c 12y ago
        See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
        ttflee 12y ago
        According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.
    - danielweber 12y ago
      How do you know that Firefox and Chrome have not been altered?
      - ikawe 12y ago
        The app code signing process provides some assurance that the app has not been altered. https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/mac/documentation/Securi... edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
      - ryan-c 12y ago
  - TazeTSchnitzel 12y ago
    If they abuse CNNIC, they lose CNNIC. So they just get the gullible.
    - pyre 12y ago
      They could also do targeted MITM attacks where only one person is served via the forged certificate. That's harder to detect, and if it's all spycraft, then the target on the receiving end is unlikely to report the breach.
      - TazeTSchnitzel 12y ago
        Sure. They'll only use CNNIC in situations where people won't notice.
  - tonyplee 12y ago
    Agree! The real spy agencies can do it smarter - signed with its own root CA, etc. It might also be other 3rd parties who is doing the MITM. Anyone can setup a fake free wifi, reroute the DNS system. Some percentage of those "free" service users will press "OK" to let other sniff their "secure" connections.
  - cnphil 12y ago
    They've got like tons of CAs. In China, it's very common for websites to ask people to trust their self-issued certificates. If you want to buy train tickets in China, you end up with this page (https://kyfw.12306.cn/otn https://kyfw.12306.cn/otn) which asks you to trust its own cert.
    - owenmarshall 12y ago
      Ah, so there's an expectation amongst Chinese users that a self-signed cert is sufficient? Well.
      - sillysaurus3 12y ago
        I mean, what would you do? If you want the train ticket, you have to accept those terms. And you need the train ticket.
        baby 12y ago
        You could go to the train station (I've never bought a train ticket online there).
        dengnan 12y ago
        Here's some history background of the train in China. (I realized that I have to start from the Hukou policy so that I could tell a reasonable story. Please bear with me.) TL;DR, This is what a train station looks like before Chinese New Year [1]. Let's start from Hukou policy: Every Chinese is required to register their information to the government and has to provide a permanent address. This looks similar to most other country. But it goes quite far beyond a simple registration. Your Hukou is associated with a permanent address and in many cases, you are only allowed to do many critical things within the city of your permanent address. For example, your child cannot go to the local schools outside their Hukou address. Changing your address on Hukou is very hard and usually happens in some cases: When you go to university, you are allowed to temporarily change your Hukou under the university's city; 2. If you found a job in another city and your employer is willing to help you to relocate your Hukou address. 3. You married with a local person for several years. Basically, you can understand Hukou as a domestic visa. There are two types of Hukou: Farmer Hukou and City Hukou. Basically, they have different benefits/restrictions. Similar to F1 visa, H1B visa, etc. Well, why I mention this? Here is some history. 30 years ago, major amount of the Chinese population were farmers. To build cities, you have to let those farmers live in the city and do lots of construction works. Due to the Hukou policy, people are not allowed to permanently migrate, esp. changing their Hukou status from Farmer to City. But there's more opportunities in cities and people could make more money. So gradually, there emerges a large group of people whose Hukou address is out of city but work in the cities. Their family has to in their home town, otherwise their children cannot go to school in the cities. Every year, people works outside their home town will try to go back during Chinese New Year. Since the fact I mentioned above, there's a huge amount of people. They have to take trains (which is cheaper than flight.) Such yearly migration is quite large, ~3.3B tickets in 2014 [0]. Oh, and here is the answer to your question: Go to the train station is really not an option. It's like black Friday, but in a much larger scale. People have to wait outside for even weeks to get a ticket. To some extend, online ticket system helps. However, because of the throughput of the train system is limited, it's still hard to get a ticket. 0. http://en.wikipedia.org/wiki/Chunyun http://en.wikipedia.org/wiki/Chunyun 1. https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&source=lnms&tbm=isch&sa=X&ei=VEtFVNe_F4SnyQSvkYKIBg&ved=0CAYQ_AUoAQ&biw=1855&bih=993 https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&so...
  - DasIch 12y ago
    Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. Assuming the majority of people desire not to be tortured or killed far more then they desire freedom. It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. It's also far more socially acceptable on an international level than violence.
    - tessierashpool 12y ago
      Agree & disagree. Re this: Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. That claim is currently true, but if you understand Bayes' Theorem and Moore's Law, you know that it's just a matter of time. But re this: It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. iirc, former East German Stasi or KGB have said essentially the same thing.
- Someone 12y ago
  "is always so blatant and public" It is hard to tell whether it always is. If they are smart they use a deterrent, which must be visible to work, to decrease the number of potential targets to track, and something well hidden to follow the remaining real/potential troublemakers.
- Istof 12y ago
  and Apple didn't do it to prevent mass snooping by the NSA since when you are connected to the network, your HDD/flash is already decrypted anyways.
- fredliu 12y ago
  "blatant and public", yes I agree with that, but I think this incidence also shows more of a level of incompetence: as owenmarshall pointed out, they have all the means of doing it "properly", but gets caught red handed instead...
- gcv 12y ago
  > They didn't even bother intercepting his email at the network or service provider level. Is this a known fact? If I wanted to spy on a prominent dissident [1], I would use a variety of methods. Some would be intentionally crude, so that the target feels safer after noticing and defeating them, making the more sophisticated approaches that much more effective. [1] I recommend visiting the current Ai Weiwei exhibit in San Francisco. It's quite good.
- atmosx 12y ago
  > China's surveillance is always so blatant and public, they don't bother trying to hide it like America. I get that America means 'USA' in this context. How exactly do US government officials hide the fact that they keep data of everything possible that happens online outside the United States (and doesn't give a damn about what anyone else thinks about it)? Given the statements of many US senators, after both Cablegate and Snowden I don't think the US tries to hide anything at all.
  - imcclinus 12y ago
    you are obviously brainwashed. period.
- SteventM8 12y ago
  Is using VPN a good solution to have a network level encryption ?
- ttflee 12y ago
  In the US, such exposure may result in scandal whereas in China it is like to hit your meat foot into an iron gate.
cnphil 12y ago
iCloud is not the only victim here. Google's IPv6 access has been suffering the same attack since September. (IPv4 access has been blocked entirely for 5 months) It's not a shocking news, however. Apple has already moved [1] some of its storage servers to Beijing. The attack could just be the authorities making sure that Chinese users' iCloud data is actually stored in China. [1] http://techcrunch.com/2014/08/15/apple-taps-china-telecom-as-icloud-storage-provider-for-customers-in-china/ http://techcrunch.com/2014/08/15/apple-taps-china-telecom-as...
- higherpurpose 12y ago
  So China is double-dipping? I was hoping that post-Snowden, this kind of request from some countries that companies need to store data locally, to make sure the data isn't taken by the US government, would encourage companies to encrypt the data end-to-end (client-side), before they get it into their clouds. Then nobody could complain about the data not being safe from the US government. It should be safe since even the company shouldn't have access to it. I realize this isn't the real reason why China told Apple to build a datacenter there, but that's the one they used publicly, and as long as the company itself can get access to that data, then the argument is a pretty plausible one, even from China. Apple, Google and others could weaken this argument by adopting end-to-end encryption for their services. Unfortunately, it seems the companies decided to keep the data as is, but build the data centers in Russia, China and wherever else they might ask them to do it.
  - pjc50 12y ago
    Apple implemented not-exactly-end-to-end encryption on phones and the FBI publicly complained. Implementing effective encryption would most likely result in threats of a ban by the Chinese government. See http://www.wired.co.uk/news/archive/2013-07/11/blackberry-india http://www.wired.co.uk/news/archive/2013-07/11/blackberry-in... Ultimately there's only so far you can go against the wishes of the Chinese government when your factories are there, or against the US government when your HQ is there.
    - aroch 12y ago
dewiz 12y ago
"They should also enable two-step verification for their iCloud accounts. This will protect iCloud accounts from attackers even if the account password is compromised." I wonder if 2FA is really that safe in a country like that, they have all the means to intercept the second channel, it just requires knowledge about the account owner or some not to complex synchronization to detect auth codes sent via text messages.
- dwild 12y ago
  That's why I don't like 2FA with SMS. How can you trust a password that's send in clear through multiple carrier. A good 2FA doesn't require anything else than the local time to generate the current password.
  - nkozyra 12y ago
    2FA doesn't normally send a password though, does it? Isn't it typically a one-time key? The risk here is someone could intercept and set/reset that password, but the end user would immediately know that as they would be unable to set a password or login.
    - worklogin 12y ago
      With app- or token-based 2FA, there is no token sent across the wire until the user submits an auth request. With SMS-based 2FA, the token is sent via insecure channels to the user BEFORE auth, which is an opportunity for state actors and telecom to intercept it before use.
      - nkozyra 12y ago
        Right, I'm pretty sure we're taking about SMS-based (or perhaps email-based). Even in cases where that token is intercepted, it's a one-time use token, so you know if it's been intercepted.
        acqq 12y ago
hiraki9 12y ago
Does this only occur when the user logs into iCloud using the web, or does it happen on the device as well? Does anyone know if iOS uses certificate pinning when connecting to iCloud services, and if so if that is sufficient to prevent against this type of attack?
- preek 12y ago
  It's a classic MITM which includes switching of the SSL certificate. In regular browsers the user would need either to confirm that they know what they are doing (Firefox) or not get to the page at all (Chrome). I'm not an iOS dev, but I do not think that the iOS SDK would allow for invalid certificates. Then Apple could just go ahead and not use any encryption at all. The 'hack' in the article works, because users ignore security warnings or even use a browser that is clearly made to easily snoop on people.
  - xuki 12y ago
    If it's your own app you could allow an invalid certificate. System apps, of course, do not allow that.
  - daturkel 12y ago
    Minor correction: on Chrome you can still get to the page if the browser doesn't trust the CA, the option is just hidden.
preek 12y ago
TL;DR - China likes to spy on everyones data and can do so, because they own their country. This incident is on iCloud, but is only in alignment with their greater strategy and not Apples fault.
- selmnoo 12y ago
  Of course, just as America likes to spy on everyone as well. But let's not completely pardon Apple, they can always do something more to strengthen their systems to be more and more resilient to these attacks. It might well be a cat and mouse game, but they should at least try and play rather than just give up. They're sitting on hundreds of billions of dollars, they get hundreds from many of us, the least they can do is look out for us a little more.
  - preek 12y ago
    I'm not saying security is not an important issue. Inherently it is. The problem is that Apple is using the industry standard for encryption here (SSL). China cracks that security by giving their folks a browser that allows them to easily swap the certificate out and send all the data to them before sending it to Apple. This is called a MITM (Man In The Middle Attack). Personally, I'm a big fan of privacy - also I'm the CTO of a web-company, so I'm concerned with security for webapps, too. When users are ignore warnings of their browsers (what Firefox would do in such an event) or even install a "trojan browser" by a mean government - well, then there is little you can do as a company. Just wanted to give a short TL;DR on the article to prevent an icloud shitstorm on HN, because the article is really on how mean China is. Not saying or implying at all that other governments are better. Also not saying that Apple is perfect in terms of security. Btw, as developer and sysadmin I'm using Debian stable - my Mac is for convenience and productivity. Just saying that to disqualify myself as the regular fanboy(;
    - foobarfizzbuzz 12y ago
      Your arguments are relatively helpful and good, but no one cares that you are a CTO. Your post would've been just as relevant have you said you're an engineer/developer/work in tech or not even mentioned your position. I hope you don't take offense to this, but it just seems `cocky` when people act like that.
ryan-c 12y ago
I've done some analysis on 360 secure browser's SSL handling in the past. I don't have my notes handy, but it can easily be taken advantage of by anyone, not just the Chinese government. I'm somewhat confused by this, as it would not be difficult to just bundle MitM CAs with this browser. It's also not as popular as frequently reported. It is widely installed because many orgs are required to have the security software that bundles it, but when I was researching it the consensus I got from several Chinese people was that few people actually used it - "only old people who don't know computers use it".
- ximeng 12y ago
  Interesting, thanks. How can you measure the popularity? "Several" doesn't make much of a dent in the Chinese population.
  - ryan-c 12y ago
    Yes, that is true, it's a limited sample size, but it agrees with what I've seen from various sites that measure browser popularity. Having better numbers would be good.
- Quiark 12y ago
  I just downloaded 360 secure browser (into a VM, I'm not crazy :)) and checked. It does display a warning but still loads the website immediately. Also, I was unable to find a way to display the certificate.
logotype 12y ago
I've seen warnings about Google certs also, when not connected via VPN.
blinkingled 12y ago
So Cert Pinning won't help in this case? Or may be not doing stuff like cert pinning is one of many (may be even lawful) requisites of doing business in China?
- zymhan 12y ago
  You don't need certificate pinning to prevent this issue, you just need a modern browser with up-to-date trusted certificates. Certificate pinning would only help if the certificate the government is presenting matched the site's URL.
  - blinkingled 12y ago
    > Certificate pinning would only help if the certificate the government is presenting matched the site's URL. And what prevents the government from doing that? Certificate pinning will address MITM no matter what - if the certificate the browser receives is not the one it pinned, it will refuse to connect even if the cert was signed by another trusted authority. Although it's unclear from the article as to what really is happening - is it that Apple trusts whatever Chinese CA is used to forge the certificate for iCloud.com but others like Mozilla and Google don't? In any case I don't see how pinning won't help here.
    - iancarroll 12y ago
      No, nobody trusts this certificate - it I'd identical to the one you generate yourself with OpenSSL. Certificate pinning would be nice but its simply not the issue or fix at hand here... If China were to misuse the root I believe their academics dept has, it would be instantly banned. There was a bugzilla bug about removing it @ Mozilla and a LOT of people supported it, but it won't be removed unless there is abuse.
- LLWM 12y ago
  The only thing anyone gets out of cert pinning is a huge increase in false positives.
smaili 12y ago
Slightly off topic but does anyone here have any personal VPN recommendations? From personal experience is preferable.
- jstalin 12y ago
  I use witopia and I'm very pleased.
- LeoPanthera 12y ago
  I've been using proxy.sh (despite the name, a regular VPN provider) for a while and have no complaints. They have endpoints in a large number of countries. Regular link: https://proxy.sh https://proxy.sh Affiliate link: https://proxy.sh/panel/aff.php?aff=477 https://proxy.sh/panel/aff.php?aff=477
- tjohns 12y ago
  Assuming you just need it while traveling, running a VPN server at home is a cheap and effective option. In particular, both DD-WRT and RouterOS have OpenVPN support.
  - Viper007Bond 12y ago
    I run a native one off my Synology NAS. Works great. GUI and everything.
- logotype 12y ago
  Just setup your own, it's not so many steps actually. I've setup VPN servers for L2TP/IPSec, OpenVPN and even PPTP. Setup takes 10-30 mins. Just spin up a instance on AWS/Rackspace/whatever and install the apps, then connect to it. Works great.
- logotype 12y ago
  Btw, here's a simple, fast and easy guide to setup a VPN server: https://github.com/logotype/useful-unix-stuff/blob/master/L2TP.md https://github.com/logotype/useful-unix-stuff/blob/master/L2...
tn13 12y ago
I am using Nokia 1100. No government can possibly extract any of my key information like emails, photos as so on.
- wy 12y ago
  Totally unrelated to the topic.
  - tn13 12y ago
    Thanks for the informative comment.
justicezyx 12y ago
It should not be a surprise for China. Chinese people traditionally do not have the concept of "privacy". For example, online stalking in China is not violating the law, unless the victim is defamed. People talks rumors and secretive stuff privately in small groups all the time, and it even becomes an important means of sending political signals to normal people from the government. Like if you could see some privacy leaked online about some government leaders, you know that they are likely to be deprived of political power inside the power circle.
deleted 12y ago
[deleted]
kathrinekennley 12y ago
This attack will come as a surprise to Apple. In the past, the company has had a bromance with the authorities and have blindly acquiesced when asked to remove apps from the China app store.
zaroth 12y ago
Would HSTS have helped in this situation? HSTS is mainly to prevent SSL-stripping. But I think part of HSTS could also note that the certificate was trusted, and then having an HSTS header could entirely prevent any later connection with the self-signed certificate, without clearing the HSTS history. You may not need to even store the extra bit, it's enough to say if you have HSTS then by default the connection must not just be encrypted, but it must be trusted. Do current browsers entirely prevent a connection to untrusted certs when HSTS is set? Or is it just the same error you get when connecting to any self-signed cert?
- acebarry 12y ago
  > Do current browsers entirely prevent a connection to untrusted certs when HSTS is set? Yes. HSTS would not do much to prevent active MiTM. HSTS just tells the browser that it should only connect to the site over HTTPS. It does not mention which certificates are trusted. It seems like you are hinting towards certificate pinning (https://en.wikipedia.org/wiki/Transport_Layer_Security#Certificate_pinning https://en.wikipedia.org/wiki/Transport_Layer_Security#Certi...). Pinning would prevent rouge CA's from signing bad certificates, but pinning is hard to do on the web. It is mainly used with mobile applications from what I have seen. Edit: Here is a list of pinned sites in Chrome, if you are curious. (https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...)

491 points by tchalla 12y ago

dmix 12y ago

China's surveillance is always so blatant and public, they don't bother trying to hide it like America (which is analogous to political corruption in both countries). When the artist Ai Weiwei had his email account compromised by the state, they simply logged into his email webmail UI and forwarded a copy of his emails to a 3rd party email address. They didn't even bother intercepting his email at the network or service provider level. Edit: > "Apple increased the encryption aspects on the phone allegedly to prevent snooping from the NSA. However, this increased encryption would also prevent the Chinese authorities from snooping on Apple user data." It's a shame articles keep confusing Apple's harddisk encryption with network data encryption. :\

brudgers 12y ago
they don't bother trying to hide it Honesty is a traditional value. Privacy and sovereignty based on the consent of the governed? Not so much.
opendais 12y ago
Yes, it is really depressing how blatantly we are all being watched. :/
owenmarshall 12y ago
> China's surveillance is always so blatant and public, they don't bother trying to hide it like America. I'm a little shocked - they've surely got the ability to do a proper MITM. CNNIC is a root CA for plenty of browsers. Saving it up for when they really need it, maybe?
- ryan-c 12y ago
  If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.
  - dmix 12y ago
    > I am more surprised that they don't have common Chinese software install a set of MitM CAs. It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly." https://en.wikipedia.org/wiki/Qihoo https://en.wikipedia.org/wiki/Qihoo
    - ryan-c 12y ago
      See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
      - ttflee 12y ago
        According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.
  - danielweber 12y ago
    How do you know that Firefox and Chrome have not been altered?
    - ikawe 12y ago
      The app code signing process provides some assurance that the app has not been altered. https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/mac/documentation/Securi... edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
    - ryan-c 12y ago
- TazeTSchnitzel 12y ago
  If they abuse CNNIC, they lose CNNIC. So they just get the gullible.
  - pyre 12y ago
    They could also do targeted MITM attacks where only one person is served via the forged certificate. That's harder to detect, and if it's all spycraft, then the target on the receiving end is unlikely to report the breach.
    - TazeTSchnitzel 12y ago
      Sure. They'll only use CNNIC in situations where people won't notice.
- tonyplee 12y ago
  Agree! The real spy agencies can do it smarter - signed with its own root CA, etc. It might also be other 3rd parties who is doing the MITM. Anyone can setup a fake free wifi, reroute the DNS system. Some percentage of those "free" service users will press "OK" to let other sniff their "secure" connections.
- cnphil 12y ago
  They've got like tons of CAs. In China, it's very common for websites to ask people to trust their self-issued certificates. If you want to buy train tickets in China, you end up with this page (https://kyfw.12306.cn/otn https://kyfw.12306.cn/otn) which asks you to trust its own cert.
  - owenmarshall 12y ago
    Ah, so there's an expectation amongst Chinese users that a self-signed cert is sufficient? Well.
    - sillysaurus3 12y ago
      I mean, what would you do? If you want the train ticket, you have to accept those terms. And you need the train ticket.
      - baby 12y ago
        You could go to the train station (I've never bought a train ticket online there).
        dengnan 12y ago
        Here's some history background of the train in China. (I realized that I have to start from the Hukou policy so that I could tell a reasonable story. Please bear with me.) TL;DR, This is what a train station looks like before Chinese New Year [1]. Let's start from Hukou policy: Every Chinese is required to register their information to the government and has to provide a permanent address. This looks similar to most other country. But it goes quite far beyond a simple registration. Your Hukou is associated with a permanent address and in many cases, you are only allowed to do many critical things within the city of your permanent address. For example, your child cannot go to the local schools outside their Hukou address. Changing your address on Hukou is very hard and usually happens in some cases: When you go to university, you are allowed to temporarily change your Hukou under the university's city; 2. If you found a job in another city and your employer is willing to help you to relocate your Hukou address. 3. You married with a local person for several years. Basically, you can understand Hukou as a domestic visa. There are two types of Hukou: Farmer Hukou and City Hukou. Basically, they have different benefits/restrictions. Similar to F1 visa, H1B visa, etc. Well, why I mention this? Here is some history. 30 years ago, major amount of the Chinese population were farmers. To build cities, you have to let those farmers live in the city and do lots of construction works. Due to the Hukou policy, people are not allowed to permanently migrate, esp. changing their Hukou status from Farmer to City. But there's more opportunities in cities and people could make more money. So gradually, there emerges a large group of people whose Hukou address is out of city but work in the cities. Their family has to in their home town, otherwise their children cannot go to school in the cities. Every year, people works outside their home town will try to go back during Chinese New Year. Since the fact I mentioned above, there's a huge amount of people. They have to take trains (which is cheaper than flight.) Such yearly migration is quite large, ~3.3B tickets in 2014 [0]. Oh, and here is the answer to your question: Go to the train station is really not an option. It's like black Friday, but in a much larger scale. People have to wait outside for even weeks to get a ticket. To some extend, online ticket system helps. However, because of the throughput of the train system is limited, it's still hard to get a ticket. 0. http://en.wikipedia.org/wiki/Chunyun http://en.wikipedia.org/wiki/Chunyun 1. https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&source=lnms&tbm=isch&sa=X&ei=VEtFVNe_F4SnyQSvkYKIBg&ved=0CAYQ_AUoAQ&biw=1855&bih=993 https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&so...
- DasIch 12y ago
  Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. Assuming the majority of people desire not to be tortured or killed far more then they desire freedom. It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. It's also far more socially acceptable on an international level than violence.
  - tessierashpool 12y ago
    Agree & disagree. Re this: Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. That claim is currently true, but if you understand Bayes' Theorem and Moore's Law, you know that it's just a matter of time. But re this: It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. iirc, former East German Stasi or KGB have said essentially the same thing.
Someone 12y ago
"is always so blatant and public" It is hard to tell whether it always is. If they are smart they use a deterrent, which must be visible to work, to decrease the number of potential targets to track, and something well hidden to follow the remaining real/potential troublemakers.
Istof 12y ago
and Apple didn't do it to prevent mass snooping by the NSA since when you are connected to the network, your HDD/flash is already decrypted anyways.
fredliu 12y ago
"blatant and public", yes I agree with that, but I think this incidence also shows more of a level of incompetence: as owenmarshall pointed out, they have all the means of doing it "properly", but gets caught red handed instead...
gcv 12y ago
> They didn't even bother intercepting his email at the network or service provider level. Is this a known fact? If I wanted to spy on a prominent dissident [1], I would use a variety of methods. Some would be intentionally crude, so that the target feels safer after noticing and defeating them, making the more sophisticated approaches that much more effective. [1] I recommend visiting the current Ai Weiwei exhibit in San Francisco. It's quite good.
atmosx 12y ago
> China's surveillance is always so blatant and public, they don't bother trying to hide it like America. I get that America means 'USA' in this context. How exactly do US government officials hide the fact that they keep data of everything possible that happens online outside the United States (and doesn't give a damn about what anyone else thinks about it)? Given the statements of many US senators, after both Cablegate and Snowden I don't think the US tries to hide anything at all.
- imcclinus 12y ago
  you are obviously brainwashed. period.
SteventM8 12y ago
Is using VPN a good solution to have a network level encryption ?
ttflee 12y ago
In the US, such exposure may result in scandal whereas in China it is like to hit your meat foot into an iron gate.

cnphil 12y ago

iCloud is not the only victim here. Google's IPv6 access has been suffering the same attack since September. (IPv4 access has been blocked entirely for 5 months) It's not a shocking news, however. Apple has already moved [1] some of its storage servers to Beijing. The attack could just be the authorities making sure that Chinese users' iCloud data is actually stored in China. [1] http://techcrunch.com/2014/08/15/apple-taps-china-telecom-as-icloud-storage-provider-for-customers-in-china/ http://techcrunch.com/2014/08/15/apple-taps-china-telecom-as...

higherpurpose 12y ago
So China is double-dipping? I was hoping that post-Snowden, this kind of request from some countries that companies need to store data locally, to make sure the data isn't taken by the US government, would encourage companies to encrypt the data end-to-end (client-side), before they get it into their clouds. Then nobody could complain about the data not being safe from the US government. It should be safe since even the company shouldn't have access to it. I realize this isn't the real reason why China told Apple to build a datacenter there, but that's the one they used publicly, and as long as the company itself can get access to that data, then the argument is a pretty plausible one, even from China. Apple, Google and others could weaken this argument by adopting end-to-end encryption for their services. Unfortunately, it seems the companies decided to keep the data as is, but build the data centers in Russia, China and wherever else they might ask them to do it.
- pjc50 12y ago
  Apple implemented not-exactly-end-to-end encryption on phones and the FBI publicly complained. Implementing effective encryption would most likely result in threats of a ban by the Chinese government. See http://www.wired.co.uk/news/archive/2013-07/11/blackberry-india http://www.wired.co.uk/news/archive/2013-07/11/blackberry-in... Ultimately there's only so far you can go against the wishes of the Chinese government when your factories are there, or against the US government when your HQ is there.
  - aroch 12y ago

dewiz 12y ago

"They should also enable two-step verification for their iCloud accounts. This will protect iCloud accounts from attackers even if the account password is compromised." I wonder if 2FA is really that safe in a country like that, they have all the means to intercept the second channel, it just requires knowledge about the account owner or some not to complex synchronization to detect auth codes sent via text messages.

dwild 12y ago
That's why I don't like 2FA with SMS. How can you trust a password that's send in clear through multiple carrier. A good 2FA doesn't require anything else than the local time to generate the current password.
- nkozyra 12y ago
  2FA doesn't normally send a password though, does it? Isn't it typically a one-time key? The risk here is someone could intercept and set/reset that password, but the end user would immediately know that as they would be unable to set a password or login.
  - worklogin 12y ago
    With app- or token-based 2FA, there is no token sent across the wire until the user submits an auth request. With SMS-based 2FA, the token is sent via insecure channels to the user BEFORE auth, which is an opportunity for state actors and telecom to intercept it before use.
    - nkozyra 12y ago
      Right, I'm pretty sure we're taking about SMS-based (or perhaps email-based). Even in cases where that token is intercepted, it's a one-time use token, so you know if it's been intercepted.
      - acqq 12y ago

hiraki9 12y ago

Does this only occur when the user logs into iCloud using the web, or does it happen on the device as well? Does anyone know if iOS uses certificate pinning when connecting to iCloud services, and if so if that is sufficient to prevent against this type of attack?

preek 12y ago
It's a classic MITM which includes switching of the SSL certificate. In regular browsers the user would need either to confirm that they know what they are doing (Firefox) or not get to the page at all (Chrome). I'm not an iOS dev, but I do not think that the iOS SDK would allow for invalid certificates. Then Apple could just go ahead and not use any encryption at all. The 'hack' in the article works, because users ignore security warnings or even use a browser that is clearly made to easily snoop on people.
- xuki 12y ago
  If it's your own app you could allow an invalid certificate. System apps, of course, do not allow that.
- daturkel 12y ago
  Minor correction: on Chrome you can still get to the page if the browser doesn't trust the CA, the option is just hidden.

preek 12y ago

TL;DR - China likes to spy on everyones data and can do so, because they own their country. This incident is on iCloud, but is only in alignment with their greater strategy and not Apples fault.

selmnoo 12y ago
Of course, just as America likes to spy on everyone as well. But let's not completely pardon Apple, they can always do something more to strengthen their systems to be more and more resilient to these attacks. It might well be a cat and mouse game, but they should at least try and play rather than just give up. They're sitting on hundreds of billions of dollars, they get hundreds from many of us, the least they can do is look out for us a little more.
- preek 12y ago
  I'm not saying security is not an important issue. Inherently it is. The problem is that Apple is using the industry standard for encryption here (SSL). China cracks that security by giving their folks a browser that allows them to easily swap the certificate out and send all the data to them before sending it to Apple. This is called a MITM (Man In The Middle Attack). Personally, I'm a big fan of privacy - also I'm the CTO of a web-company, so I'm concerned with security for webapps, too. When users are ignore warnings of their browsers (what Firefox would do in such an event) or even install a "trojan browser" by a mean government - well, then there is little you can do as a company. Just wanted to give a short TL;DR on the article to prevent an icloud shitstorm on HN, because the article is really on how mean China is. Not saying or implying at all that other governments are better. Also not saying that Apple is perfect in terms of security. Btw, as developer and sysadmin I'm using Debian stable - my Mac is for convenience and productivity. Just saying that to disqualify myself as the regular fanboy(;
  - foobarfizzbuzz 12y ago
    Your arguments are relatively helpful and good, but no one cares that you are a CTO. Your post would've been just as relevant have you said you're an engineer/developer/work in tech or not even mentioned your position. I hope you don't take offense to this, but it just seems `cocky` when people act like that.

ryan-c 12y ago

I've done some analysis on 360 secure browser's SSL handling in the past. I don't have my notes handy, but it can easily be taken advantage of by anyone, not just the Chinese government. I'm somewhat confused by this, as it would not be difficult to just bundle MitM CAs with this browser. It's also not as popular as frequently reported. It is widely installed because many orgs are required to have the security software that bundles it, but when I was researching it the consensus I got from several Chinese people was that few people actually used it - "only old people who don't know computers use it".

ximeng 12y ago
Interesting, thanks. How can you measure the popularity? "Several" doesn't make much of a dent in the Chinese population.
- ryan-c 12y ago
  Yes, that is true, it's a limited sample size, but it agrees with what I've seen from various sites that measure browser popularity. Having better numbers would be good.
Quiark 12y ago
I just downloaded 360 secure browser (into a VM, I'm not crazy :)) and checked. It does display a warning but still loads the website immediately. Also, I was unable to find a way to display the certificate.

logotype 12y ago

I've seen warnings about Google certs also, when not connected via VPN.

blinkingled 12y ago

So Cert Pinning won't help in this case? Or may be not doing stuff like cert pinning is one of many (may be even lawful) requisites of doing business in China?

zymhan 12y ago
You don't need certificate pinning to prevent this issue, you just need a modern browser with up-to-date trusted certificates. Certificate pinning would only help if the certificate the government is presenting matched the site's URL.
- blinkingled 12y ago
  > Certificate pinning would only help if the certificate the government is presenting matched the site's URL. And what prevents the government from doing that? Certificate pinning will address MITM no matter what - if the certificate the browser receives is not the one it pinned, it will refuse to connect even if the cert was signed by another trusted authority. Although it's unclear from the article as to what really is happening - is it that Apple trusts whatever Chinese CA is used to forge the certificate for iCloud.com but others like Mozilla and Google don't? In any case I don't see how pinning won't help here.
  - iancarroll 12y ago
    No, nobody trusts this certificate - it I'd identical to the one you generate yourself with OpenSSL. Certificate pinning would be nice but its simply not the issue or fix at hand here... If China were to misuse the root I believe their academics dept has, it would be instantly banned. There was a bugzilla bug about removing it @ Mozilla and a LOT of people supported it, but it won't be removed unless there is abuse.
LLWM 12y ago
The only thing anyone gets out of cert pinning is a huge increase in false positives.

smaili 12y ago

Slightly off topic but does anyone here have any personal VPN recommendations? From personal experience is preferable.

jstalin 12y ago
I use witopia and I'm very pleased.
LeoPanthera 12y ago
I've been using proxy.sh (despite the name, a regular VPN provider) for a while and have no complaints. They have endpoints in a large number of countries. Regular link: https://proxy.sh https://proxy.sh Affiliate link: https://proxy.sh/panel/aff.php?aff=477 https://proxy.sh/panel/aff.php?aff=477
tjohns 12y ago
Assuming you just need it while traveling, running a VPN server at home is a cheap and effective option. In particular, both DD-WRT and RouterOS have OpenVPN support.
- Viper007Bond 12y ago
  I run a native one off my Synology NAS. Works great. GUI and everything.
logotype 12y ago
Just setup your own, it's not so many steps actually. I've setup VPN servers for L2TP/IPSec, OpenVPN and even PPTP. Setup takes 10-30 mins. Just spin up a instance on AWS/Rackspace/whatever and install the apps, then connect to it. Works great.
logotype 12y ago
Btw, here's a simple, fast and easy guide to setup a VPN server: https://github.com/logotype/useful-unix-stuff/blob/master/L2TP.md https://github.com/logotype/useful-unix-stuff/blob/master/L2...

tn13 12y ago

I am using Nokia 1100. No government can possibly extract any of my key information like emails, photos as so on.

wy 12y ago
Totally unrelated to the topic.
- tn13 12y ago
  Thanks for the informative comment.

justicezyx 12y ago

It should not be a surprise for China. Chinese people traditionally do not have the concept of "privacy". For example, online stalking in China is not violating the law, unless the victim is defamed. People talks rumors and secretive stuff privately in small groups all the time, and it even becomes an important means of sending political signals to normal people from the government. Like if you could see some privacy leaked online about some government leaders, you know that they are likely to be deprived of political power inside the power circle.

deleted 12y ago

[deleted]

kathrinekennley 12y ago

This attack will come as a surprise to Apple. In the past, the company has had a bromance with the authorities and have blindly acquiesced when asked to remove apps from the China app store.

zaroth 12y ago

Would HSTS have helped in this situation? HSTS is mainly to prevent SSL-stripping. But I think part of HSTS could also note that the certificate was trusted, and then having an HSTS header could entirely prevent any later connection with the self-signed certificate, without clearing the HSTS history. You may not need to even store the extra bit, it's enough to say if you have HSTS then by default the connection must not just be encrypted, but it must be trusted. Do current browsers entirely prevent a connection to untrusted certs when HSTS is set? Or is it just the same error you get when connecting to any self-signed cert?

acebarry 12y ago
> Do current browsers entirely prevent a connection to untrusted certs when HSTS is set? Yes. HSTS would not do much to prevent active MiTM. HSTS just tells the browser that it should only connect to the site over HTTPS. It does not mention which certificates are trusted. It seems like you are hinting towards certificate pinning (https://en.wikipedia.org/wiki/Transport_Layer_Security#Certificate_pinning https://en.wikipedia.org/wiki/Transport_Layer_Security#Certi...). Pinning would prevent rouge CA's from signing bad certificates, but pinning is hard to do on the web. It is mainly used with mobile applications from what I have seen. Edit: Here is a list of pinned sites in Chrome, if you are curious. (https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...)