MITM on HTTPS traffic in Kazakhstan • Hacker News Board

Re: MITM on HTTPS traffic in Kazakhstan

#291

Post by technion » Thu, Jul 18, 2019, 11:03 PM UTC

tcd wrote: post #33

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

We need new measures to not allow these certificates to be installed unless they're verified, or at least the OS shows a massive giant warning "DO NOT DO THIS unless you accept this cert gives $identity access to all your data". Seems a very solvable problem.

It's a common meme that users will click "yes" to everything, but I'm not sure people realise just how far that goes. Look how it looks when Chrome marks a site as malware:

https://www.removemalware.net/wp-content/uploads/2016/06/the...

Wait until you're doing forensics on a cryptolocker outbreak and you find not only did a user do that, but multiple users helped her through it and the management then praised her for overcoming technical barriers even after it was found to be the cause of the incident.

Unfortunately nothing about warnings makes anything a solved problem.

Re: MITM on HTTPS traffic in Kazakhstan

#292

Post by worldofmatthew » Thu, Jul 18, 2019, 11:03 PM UTC

vkou wrote: post #218

novok wrote: post #178

Earlier quoted context omitted.

If it ruins their economy, yes.

99% of the population will happily install the government cert, and life will move on. The 1% will either put up with it, stop using the internet, or leave. One thing will happen though - the economy will not be ruined. Generally speaking, since the Cold War ended, these sorts of countries don't mind troublemakers leaving. It's better international PR for them to have 'problem people' leave voluntarily, than to repre…

Thats why I suggest web browsers blacklist this cert that is not apporved by the websites affected.

Re: MITM on HTTPS traffic in Kazakhstan

#293

Post by mdhardeman » Thu, Jul 18, 2019, 11:07 PM UTC

thothamon wrote: post #266

mdhardeman wrote: post #235

Earlier quoted context omitted.

I'll be 40 years old later this year. I've been interested in communications and communications protocols since I was about 12. I've been a software developer with a focus on network communications for over 15 years. I'm well aware of all that you've said. My point was, they get TLS interception down, and they capture what they want from a target of interest. When they look closely at your traffic and decide all thes…

I could split hairs and suggest that the browser accept the phony CA and simply use a secondary encryption layer on top of it, but that misses your point. A sufficiently clever evil government will see that you're doing something encryption-like and shoot you. But, being "sufficiently clever" isn't all that easy. China has done a good job, but they're a very big country with a lot of resources and a lot of very smart…

"Sufficiently clever" has historically been more expensive than difficult.

For example, in order to scale less expensively, the Great Firewall is architected such that it need not actively be in the middle of the entire flow of traffic and need not actively proxy. Historically, they didn't need it to do so in order to achieve their goals.

Now, however, the advancement of a combination of new technologies is finally closing that gap.

In order to maintain historic blocking capability it becomes necessary in the long run to actively MiTM all the connections.

But that can be made to scale and there are nations who can afford it.

How do we know? Because the job is not significantly harder than serving up all that content. (At worst it's a little more than 2x the work.)

And today most content is served up from a handful of privately owned infrastructures. If a corporation can build it, so too can a lot of nation-states.

The incentives to build this have changed.

Re: MITM on HTTPS traffic in Kazakhstan

#294

Post by viraptor » Thu, Jul 18, 2019, 11:11 PM UTC

cpach wrote: post #225

a3n wrote: post #88

Earlier quoted context omitted.

Sarcasm? Not sure. But all a government has to do is embed within the endpoint, post-decryption. "Or else."

”all a government has to do is embed within the endpoint” That’s a pretty high bar to clear though.

Not really. NSA requests are backed by LE either directly or... extortion style. https://www.wired.com/2007/10/nsa-asked-for-p/

Re: MITM on HTTPS traffic in Kazakhstan

#295

Post by gdy » Thu, Jul 18, 2019, 11:11 PM UTC

lostmsu wrote: post #163

jedberg wrote: post #21

I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses". And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work. Now "us techies" have to find a new technical solution to a…

The solution to that problem was invented and reinvented hundreds of years ago. It is called gunpowder.

Russian revolution says hello.

Re: MITM on HTTPS traffic in Kazakhstan

#296

Post by technion » Thu, Jul 18, 2019, 11:12 PM UTC

vbezhenar wrote: post #282

technion wrote: post #281

Earlier quoted context omitted.

I don't think it's a bad use. When I logon to my SAN or UPS web interfaces, I don't want to type https://ups01.publicDNSdomain.com , and visit a site with a CT logged certificate. It's an absolutely internal thing and every Active Directory domain already has an (ideally) non-externally resolved DNS domain setup for use. You've already got an internal CA and deployed your own root because there's a series of Microsof…

You don't have to serve that website publicly or even set up DNS records. You only need to set up DNS verification to serve one public TXT record for letsencrypt. Everything else could be internal. Letsencrypt certifies that you own domain. You can do anything with that domain.

I'm aware you can use Lets Encrypt that way, I just don't agree that it's bad use of an internal PKI to use it as an alternative.

Re: MITM on HTTPS traffic in Kazakhstan

#297

Post by eruci » Thu, Jul 18, 2019, 11:12 PM UTC

try ssh tunnel

Re: MITM on HTTPS traffic in Kazakhstan

#298

Post by viraptor » Thu, Jul 18, 2019, 11:17 PM UTC

vbezhenar wrote: post #282

technion wrote: post #281

Earlier quoted context omitted.

I don't think it's a bad use. When I logon to my SAN or UPS web interfaces, I don't want to type https://ups01.publicDNSdomain.com , and visit a site with a CT logged certificate. It's an absolutely internal thing and every Active Directory domain already has an (ideally) non-externally resolved DNS domain setup for use. You've already got an internal CA and deployed your own root because there's a series of Microsof…

You don't have to serve that website publicly or even set up DNS records. You only need to set up DNS verification to serve one public TXT record for letsencrypt. Everything else could be internal. Letsencrypt certifies that you own domain. You can do anything with that domain.

Sometimes you don't want to make that information public though. For security (you don't want to publish your whole tech stack information) and secrecy (you don't want to publish registration of halflife3.internal.valve.com).

Re: MITM on HTTPS traffic in Kazakhstan

#299

Post by duskwuff » Thu, Jul 18, 2019, 11:22 PM UTC

envy2 wrote: post #201

filleokus wrote: post #121

Earlier quoted context omitted.

I just tested with ExpressVPN via their Kazakhstan endpoint. On 46.244.29.XXX on the ISP A2B IP B.V. I don't seem to be MITM'ed at all, so I can't report anything about the MITM-detector.

Their Kazakhstan endpoint is fake; it's a 'virtual' exit node that's actually in Singapore. This info is buried in their help pages: https://www.expressvpn.com/support/troubleshooting/virtual-s...

This sort of misbehavior is, unfortunately, common to a number of VPN services that claim to have endpoints in many unusual countries. ExpressVPN has sort of owned up to it (but they don't exactly make those disclosures obvious); others have not.

https://restoreprivacy.com/vpn-server-locations/

Re: MITM on HTTPS traffic in Kazakhstan

#300

Post by bcoates » Thu, Jul 18, 2019, 11:25 PM UTC

mdhardeman wrote: post #283

bcoates wrote: post #271

Earlier quoted context omitted.

Sure. "don't use Kazakhfox, it's malware, we've submitted definitions to the AV databases" isn't a hard sell for your 99%+ audience. Malware forks of open source projects (and closed-source software!) are not a new problem.

Except they are a new problem when the use of them is mandated by a nation-state.

Which is bad news for the ~15m internet users in Kazakhstan. For the ~4000m internet users not in Kazakhstan & generally immune to their rubber hose attack, protecting them from being one BGP fuckup away from being MITMed by a hostile foreign power is much more important.