I use NoScript. google-analytics is never activated.
Iran forged the wrong SSL certificate
21–30 of 115 posts
Re: Iran forged the wrong SSL certificate
#22Just by having a forged SSL Certificate for ssl.google-analytics.com how can they supply their javscript ? The request still goes to the google servers and not to any evil-democracy-suppressors.gov.ir So sure if they could reroute the request to their servers evil things could be done. But they can NOT. Or am i missing something ?
The aim is for monitoring traffic from within Iran.
The government almost certainly controls all internet traffic entering or leaving the country at the ISPs, and could intercept and/or redirect it as necessary.
Re: Iran forged the wrong SSL certificate
#23We don't know that they didn't get a forged certificate for ssl.google-analytics.com. Diginotar haven't (AFAIK) released even a partial list of affected domains, other than admitting that there were quite a lot of them.
Quite true. If they did get a certificate for ssl.google-analytics.com, I guess the title of my post should have been "We're paying attention to the wrong forged SSL certificate" -- the contents of the post is still valid, though.
Re: Iran forged the wrong SSL certificate
#24The DigiNotar hack adds to the hack of Comodo in terms of recent attacks on certificate authorities. The lead of Comodo blamed the attack on "a sophisticated state actor" aka Iran.
Moxie Marlinspike pointed out that it was his script 'sslsniff' that the hackers downloaded to carry out the attack. They didn't even change IPs from the one they used to download 'sslsniff' to the one used in the attack. The lesson: this could have been carried out by a script kiddie.
The head of security companies implying that hacking attacks must be caused by a state actor, simply because they don't understand the attack, creates a frightful prospect for the future of world security. Take these claims with a grain of salt. So long for 'sophisticated state actors'.
Re: Iran forged the wrong SSL certificate
#25Just by having a forged SSL Certificate for ssl.google-analytics.com how can they supply their javscript ? The request still goes to the google servers and not to any evil-democracy-suppressors.gov.ir So sure if they could reroute the request to their servers evil things could be done. But they can NOT. Or am i missing something ?
I don't think the Iranian government has any difficulty forcing telecommunications companies to install filtering / interception boxes.
So then they can only fake the traffic in their country what they can do anyway with non SSL traffic. I sounds more like this could be a global attack.
Re: Iran forged the wrong SSL certificate
#26All this SSL spoofing of late coincides nicely with the adoption of "always on https" by facebook/google/twitter/et al.
The average person on the coffee shop wifi isn't an SSL CA, and that's what "always on https" is defending against. SSL doesn't protect you from someone breaking into your house with a gun and forcing you to reveal your email archive. But that doesn't mean it's not useful.
Re: Iran forged the wrong SSL certificate
#27I use NoScript. google-analytics is never activated.
That advice will only affect a tiny minority of tech people. Most users rely on their browser, and have no idea what javascript even is.
Re: Iran forged the wrong SSL certificate
#28A solution: http://www.convergence.io
And how do you choose who to trust?
Until this incident DigiNotar seemed trustworthy.
Re: Iran forged the wrong SSL certificate
#29Just by having a forged SSL Certificate for ssl.google-analytics.com how can they supply their javscript ? The request still goes to the google servers and not to any evil-democracy-suppressors.gov.ir So sure if they could reroute the request to their servers evil things could be done. But they can NOT. Or am i missing something ?
Of course they can reroute traffic.
All they have to do is
* Force every ISP/Telco within their borders to add fake google.com entries to their DNS servers.
and/or
* Force every ISP/Telco to transparently proxy all DNS traffic and provide fake replies for google.com queries
You can even make it easier:
Just hijack IP routing at the borders, such that IP traffic to 209.85.149.99 (and all other google networks) are not routed to the real google servers on the internet, but their own malicious filtering proxies.
Even without involving the ISPs/Telcos, they could transparently hijack and proxy you, for a whole country it might be a rather big task though, but here's what you do:
* Find all the cables carrying internet traffic in/out of your country.
* Bring a shovel, dig up the cables.
* break the cables.
* hook up the cables to your transparent proxy/filtering machinery.
Done properly, all everyone would know know was some lights flickering in the few seconds the cables were broken.
Re: Iran forged the wrong SSL certificate
#30A solution: http://www.convergence.io
And how do you choose who to trust? Until this incident DigiNotar seemed trustworthy.
It relies on people to set up Notaries that you can specify you trust. There are many organizations I trust. The Tor Project, EFF, my university, the local hackerspace etc. If they ran notaries, I would specify that I trust them. If a SSL Authority/Notary is hacked, you remove them from the list that you trust. At the moment, trust is not agile. Browsers specify in advance which authorities are to be trusted or not.
This project is in its infancy, so get involved, set up a Notary, contribute on GitHub.