Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github SSL replaced by self-signed certificate in China

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 78 posts

Re: Github SSL replaced by self-signed certificate in China

#4

Post by fosfori »

teawithcarl wrote: post #3

Read the Twitter stream - affects people inside China. Still, shows the depth and corruption the China (gov't). https://twitter.com/search/?q=Github%20SSL

Yet still (or because of that?) China will run the global economy in seven years or so. Ten cents per hour is good money...

Re: Github SSL replaced by self-signed certificate in China

#5

Post by songgao »

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about.

If they put this fake certificate in a certificate root server that's in the trusted server list, they can easily get anyone's account who's using affected browsers.

It's weird that they start with Github. It's not a website that's popular among human activists or any other people that China government might be interested in. Instead, it's popular among programmers and hackers, who are the main group and forces in China to help people bypass GFW to access blocked content. I suppose this attack might be what the government uses to test reaction and capability of hackers.

Seriously, this is really, really, bad.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=542689

EDIT: added link for bug report

Re: Github SSL replaced by self-signed certificate in China

#6

Post by dublinben »

kevingadd wrote: post #2

How would this fake cert work? It doesn't seem to originate with a root or have any associated information. Do browsers actually accept certs that look like this?

It would work if users accepted the self signed certificate upon receiving the warning.

http://pic.twitter.com/xOxhoyzp

Re: Github SSL replaced by self-signed certificate in China

#7

Post by dublinben »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

If you actually look at the certificate, it is self-signed, not signed by a malicious root server. Your anecdote has nothing to do with this current attack.

Re: Github SSL replaced by self-signed certificate in China

#9

Post by songgao »

dublinben wrote: post #7
songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

If you actually look at the certificate, it is self-signed, not signed by a malicious root server. Your anecdote has nothing to do with this current attack.

You are right. This one has nothing to do with root servers. But they are already able to fake certificate national wide. It's only one step from adding it into root server.
Post reply on HN