5 ms·

I hope that this drives home the need to be using HTTPS everywhere we can be. It would make this kind of wide scale man-in-the-middle attack much harder to pull

I hope that this drives home the need to be using HTTPS everywhere we can be. It would make this kind of wide scale man-in-the-middle attack much harder to pull off and easier for users to detect. If only getting a certificate was an easier (less costly) process.

seanmcdirmid 12y ago
Well, they sometimes block HTTPS traffic; e.g. for Wikipedia (even just wikimedia right now).
- jonawesomegreen 12y ago
  Would they be able to block HTTPS traffic if it effectively meant that they were blocking the internet though? I think people would have a bigger problem with that.
  - seanmcdirmid 12y ago
    If all websites went https, they would try to block everything, definitely.
leereeves 12y ago
When considering the effectiveness of HTTPS everywhere, we should assume the Chinese government will have the ability to create valid certificates. This would allow them to perform MITM attacks against anyone who visits Chinese websites, even with HTTPS.
- kpcyrd 12y ago
  They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.
  - leereeves 12y ago
    In fact that happened about a week ago: http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ http://arstechnica.com/security/2015/04/google-chrome-will-b... But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.
    - acdha 12y ago
      > But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China. The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.
      - nitrogen 12y ago
        That would not necessarily prevent attacks like the GitHub attack, which used embedded analytics JS from Baidu, IIRC.
        acdha 12y ago
        Actually, it would have stopped this particular variant because Baidu serves the script from baidu.com: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%... That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them. I'd also be surprised if they couldn't relatively easily move on to another similarly insecure script requested by many people outside of China.
      - leereeves 12y ago
        > The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning. A reasonable compromise, but one which wouldn't prevent MITM snooping or alteration of communications with Chinese websites, like this attack. And to allow snooping of outgoing communications, the Chinese could also require that all browsers used in China trust the Chinese government CA without that restriction.
- NelsonMinar 12y ago
  Coincidentally, Google Chrome and Firefox recently blocked a Chinese root authority from issuing SSL certificates. (AFAIK, the only default Chinese authoirty). The stated reason has nothing to do with censorship attacks, but it is an interesting coincidence. http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ http://arstechnica.com/security/2015/04/google-chrome-will-b...
- JoachimS 12y ago
  Remember to remove Chinese CAs from the Trust Stores in the OS and browser. Unfortunately this is not very easy in some cases. And next update might add them back again. We really need better Trust Store management as a user. We should be allowed to define what CAs _we_ trust.
- Sanddancer 12y ago
  Which underscores the need to use additional authentication measures like DANE [1] and key pinning. Making it harder for malicious entities to wriggle their way into connections seems vital here. [1] http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...
zimbatm 12y ago
Just installed little snitch. Almost every app on my mac is trying to access some resource on the web, most of them over port 80 or a mix-and-match of both 80 and 443. And then the OS itself has a variety of services that does the same. My computer is like a beacon of light that shines it's position and personal information to everybody.
- JoachimS 12y ago
  Also a user of Little Snitch. (A great OSX tool btw). I've started to block all accesses that are not to 443, just to see what breaks. One of the worst offenders is iTunes.
  - alphapapa 12y ago
    Non-browser software is notorious for failing to fail when certs don't validate.
alphapapa 12y ago
More than that, it drives home the need to disable JavaScript by default. To do otherwise is inviting every web site you visit (and every third-party site they load content from, and everyone who can compromise either) to run arbitrary code on your system. And it drives home the stupidity of sites which demand JavaScript to view even simple content which could just as well be static.
mark_l_watson 12y ago
I totally agree. I started using Cloudflare's free service to add HTTPS support to my most important sites. I have some concerns about routing my traffic through another company, but free is free and I really think people need to transition to HTTPS everywhere.

seanmcdirmid 12y ago

Well, they sometimes block HTTPS traffic; e.g. for Wikipedia (even just wikimedia right now).

jonawesomegreen 12y ago
Would they be able to block HTTPS traffic if it effectively meant that they were blocking the internet though? I think people would have a bigger problem with that.
- seanmcdirmid 12y ago
  If all websites went https, they would try to block everything, definitely.

leereeves 12y ago

When considering the effectiveness of HTTPS everywhere, we should assume the Chinese government will have the ability to create valid certificates. This would allow them to perform MITM attacks against anyone who visits Chinese websites, even with HTTPS.

kpcyrd 12y ago
They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.
- leereeves 12y ago
  In fact that happened about a week ago: http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ http://arstechnica.com/security/2015/04/google-chrome-will-b... But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.
  - acdha 12y ago
    > But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China. The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.
    - nitrogen 12y ago
      That would not necessarily prevent attacks like the GitHub attack, which used embedded analytics JS from Baidu, IIRC.
      - acdha 12y ago
        Actually, it would have stopped this particular variant because Baidu serves the script from baidu.com: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%... That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them. I'd also be surprised if they couldn't relatively easily move on to another similarly insecure script requested by many people outside of China.
    - leereeves 12y ago
      > The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning. A reasonable compromise, but one which wouldn't prevent MITM snooping or alteration of communications with Chinese websites, like this attack. And to allow snooping of outgoing communications, the Chinese could also require that all browsers used in China trust the Chinese government CA without that restriction.
NelsonMinar 12y ago
Coincidentally, Google Chrome and Firefox recently blocked a Chinese root authority from issuing SSL certificates. (AFAIK, the only default Chinese authoirty). The stated reason has nothing to do with censorship attacks, but it is an interesting coincidence. http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ http://arstechnica.com/security/2015/04/google-chrome-will-b...
JoachimS 12y ago
Remember to remove Chinese CAs from the Trust Stores in the OS and browser. Unfortunately this is not very easy in some cases. And next update might add them back again. We really need better Trust Store management as a user. We should be allowed to define what CAs _we_ trust.
Sanddancer 12y ago
Which underscores the need to use additional authentication measures like DANE [1] and key pinning. Making it harder for malicious entities to wriggle their way into connections seems vital here. [1] http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...

zimbatm 12y ago

Just installed little snitch. Almost every app on my mac is trying to access some resource on the web, most of them over port 80 or a mix-and-match of both 80 and 443. And then the OS itself has a variety of services that does the same. My computer is like a beacon of light that shines it's position and personal information to everybody.

JoachimS 12y ago
Also a user of Little Snitch. (A great OSX tool btw). I've started to block all accesses that are not to 443, just to see what breaks. One of the worst offenders is iTunes.
- alphapapa 12y ago
  Non-browser software is notorious for failing to fail when certs don't validate.

alphapapa 12y ago

More than that, it drives home the need to disable JavaScript by default. To do otherwise is inviting every web site you visit (and every third-party site they load content from, and everyone who can compromise either) to run arbitrary code on your system. And it drives home the stupidity of sites which demand JavaScript to view even simple content which could just as well be static.

mark_l_watson 12y ago

I totally agree. I started using Cloudflare's free service to add HTTPS support to my most important sites. I have some concerns about routing my traffic through another company, but free is free and I really think people need to transition to HTTPS everywhere.