Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MITM on HTTPS traffic in Kazakhstan

bugzilla.mozilla.org

Post reply on HN
Print view View original

201–210 of 471 posts

Re: MITM on HTTPS traffic in Kazakhstan

#201

Post by envy2 »

filleokus wrote: post #121
mholt wrote: post #15

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection - or https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues (Edit: Reported…

I just tested with ExpressVPN via their Kazakhstan endpoint. On 46.244.29.XXX on the ISP A2B IP B.V. I don't seem to be MITM'ed at all, so I can't report anything about the MITM-detector.

Their Kazakhstan endpoint is fake; it's a 'virtual' exit node that's actually in Singapore. This info is buried in their help pages: https://www.expressvpn.com/support/troubleshooting/virtual-s...

Re: MITM on HTTPS traffic in Kazakhstan

#202

Post by benjojo12 »

yholio wrote: post #126

Can we, endpoints outside Kazakhstan, detect when a MITM client is connected and serve a boiler plate message "Untrusted connection"? If enough high level sites do this (Google, Cloudflare, Wikipedia etc) it might force the hand of the government since they are the ones effectively breaking the internet.

Yes, https://blog.cloudflare.com/monsters-in-the-middleboxes/

Re: MITM on HTTPS traffic in Kazakhstan

#203

Post by worldofmatthew »

GordonS wrote: post #167
vbezhenar wrote: post #86

Earlier quoted context omitted.

Browsers always trust manually installed CA roots, because that scenario is used by many corporations to monitor their traffic. OCSP, HPKP, etc won't help.

There are more benign uses too - many organisations run an internal PKI, and installing their root CA prevents employees' browsers from displaying warnings about untrusted certificates when accessing internal web apps/sites.

You might be able to make intranet.company-name.tld and have a parking page on the company-name.tld and use that to get a wildcard cert that can be used for the internal pages.

Re: MITM on HTTPS traffic in Kazakhstan

#204

Post by syn0byte »

cpeterso wrote: post #28
jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

But we are in a better place than before. Without HTTPS everywhere and governments needing to ask people to install new root certs, we would not have learned about this Kazakhstan MITM issue.

No. we just feel better because it just sounds so obviously reasonable doesn't it?

Kazakhstan's low-tech approach is just that, low-tech and low-effort. They could have used tons of vectors besides simply saying "install this cert."

A tiny shred of effort would have been to package an "updater" that did the install without explicitly saying that's what it was for. Or better yet: Kazakhstan is committed to a greener more ecologically friendly future! All tax documentation will go paperless! Just use the provided USB Key to access your documents in electronic format!

A small morsel of effort would be to force it on OS vendors through regulation/licensing/threats/money for localized copies. A good deal of effort would hijack CRLs, pinnings, et al while demanding/sneaking the private keys of the CAs.

Public Key Infrastructure is fucking pointless when the infrastructure is precisely what you can't trust.

Re: MITM on HTTPS traffic in Kazakhstan

#205

Post by mdhardeman »

zrm wrote: post #197
mdhardeman wrote: post #173

Earlier quoted context omitted.

The way that a real authoritarian government entity would handle that is... An agency is tasked with doing random sample captures of randomly selected target internet connections. Inventory all the types of traffic being exchanged. Flag anything that isn't obvious plaintext or already being MiTM'ed for analysis follow up. Implement new blocking rules or interception implementation for each flow that isn't already bei…

> Flag anything that isn't obvious plaintext or already being MiTM'ed for analysis follow up. The failure being that the long tail of uncategorized data would be large . Do you have a good reference for what game state updates look like for every game on the internet? What about custom IoT device protocols? Every type of DRM used for media streaming? Document attachments of spreadsheets or database images containing…

They don't need to.

In an authoritarian state, you just start blocking and breaking things.

Everything you don't understand, you block. And then you make the user explain it to you and then if it's a use case you care about, you do the work to either decide it doesn't have any danger of carrying traffic you care about or build an intercept scheme for it.

Re: MITM on HTTPS traffic in Kazakhstan

#206

Post by dsl »

ignoramous wrote: post #122
jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

> Now "us techies" have to find a new technical solution to a very social problem. Cert pinning does mitigate it for apps, doesn't it? The end-user doesn't need to really worry abt rouge root CAs, if my understanding is right. Traditional VPNs, P2P VPNs, Tor as a Proxy (decentralised net? dat/i2p/freenet/ipfs) could solve it generally across various use-cases, of which, VPNs are already mainstream.

> Cert pinning does mitigate it for apps, doesn't it?

Applications where the developer has pinned to their own certificate will stop this attack.

Chrome and Firefox will ignore pinning for locally installed CAs. This is a very common use case in the enterprise where, for example, a bank has audit requirements to decrypt and store all workstation traffic.

Re: MITM on HTTPS traffic in Kazakhstan

#207

Post by cpach »

dgl wrote: post #187
oneplane wrote: post #125

Earlier quoted context omitted.

I wonder if they also proxy stuff like the Google endpoints where chrome does key pinning, or if they whitelist those. I imagine other large systems like those of facebook (when using the app) and Apple are actively remembering what the keys are supposed to look like. That would mean that even a custom CA wouldn't allow carte blanche MITM.

Chrome will disable key pinning for CAs that are user installed rather than system provided (to support companies/schools who want to MITM for slightly less draconian reasons). I do wonder if Chrome will go to requiring CAs for this purpose be deployed via something more “enterprise” (e.g. custom extensions on Windows need to deployed via group policy now).

AFAIK, Chrome on Windows doesn’t manage root certificates, it just utilises Windows’ own cert store (certmgr).

Re: MITM on HTTPS traffic in Kazakhstan

#208

Post by tomjen3 »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

A first suggestion is to ban the cert in chrome/firefox and then keep banning certs as they issue them.

Re: MITM on HTTPS traffic in Kazakhstan

#209

Post by azernik »

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

It protects privacy for the masses in the countries where most techies live, which is what most of us were paying attention to.

In places like Kazakhstan and China it's a harder problem, and HTTPS is necessary but not sufficient to solve it.

Re: MITM on HTTPS traffic in Kazakhstan

#210

Post by syn0byte »

stefan_ wrote: post #172
jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

Except I look at the linked mailing list and you already get "us techies" arguing "uh yeah but uhm this isn't so different from the corporate CA intercept thing right so let's not blacklist it uhm". What the fuck.

"So do we make our flagship product useless for the entire country or not?" - The real question
Post reply on HN