3 ms·
I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?
by iancarroll 12y ago
I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?
- packetized 12y agoI'm pretty confident that this is the answer. Their attempts to break said services only work intermittently, however.
- teraflop 12y agoIf that was the motivation, why would they redirect to a server with a falsified certificate instead of just dropping the connection?
- RKearney 12y agoI doubt this is them trying to block YouTube. The certificate has SAN entries for things like google-analytics.com, android.com, *.cloud.google.com, goo.gl, g.co, urchin.com, and a plethora more[0]. If they wanted to just block YouTube, there are ways to do that without forging certificates. For example, modern browsers will send the domain name in plain-text even for HTTPS connections for SNI to function. They could easily block based on that. [0] http://imgur.com/a/C8Tf4 http://imgur.com/a/C8Tf4
- userbinator 12y agoThey just cloned the list of SANs in the standard Google certificate, which YouTube also uses. Captive WiFi portal (or some sort of traffic-shaping) is likely the right answer, as the other poster above points out. Given that the issuer is an internal IP I'm pretty sure they are just proxying HTTP(S) requests, grabbing the remote certificate, duplicating the subject and signing it, allowing them to on-the-fly MITM any HTTPS traffic. Trying this with a different HTTPS site will easily show this, I don't think they're specifically targeting Google directly.