Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github SSL replaced by self-signed certificate in China

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 78 posts

Re: Github SSL replaced by self-signed certificate in China

#11

Post by j45 »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

Maybe having access to the sourcecode of a site or app = access to the site or app.

Re: Github SSL replaced by self-signed certificate in China

#12

Post by floatingatoll »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

Spoofing GitHub's SSL certificate is a step in the direction of inserting espionage-style backdoors, as GitHub permits HTTPS read-only checkouts of repositories.

I'm not suggesting that this will be free of problems, given how particular Git is about checksums, nor am I certain what methods they would use to acquire SSH commit access for altering repository contents to affect the rest of the world.

Still, it's absolutely a necessary prerequisite to altering data from GitHub - and, if they acquire SSH keys, altering data at GitHub. Both possibilities are terrifying.

Re: Github SSL replaced by self-signed certificate in China

#13

Post by AndrewKemendo »

j45 wrote: post #10

It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)

I find this a sad commentary about your (and certainly others) relationship with your clients.

Re: Github SSL replaced by self-signed certificate in China

#14

Post by hakaaaaak »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

Some possible reasons:

GitHub is popular among developers.

Many developers have faster computers and more computers per household than others that aren't in IT/development.

Many developers, though they pretend to be security minded and focused at times, often have a more lax attitude in practice than system administrators, especially at home or working on personal projects.

Some developers have more usernames/passwords and certs to other servers available than non-developers would.

Some developers have access to other confidential data or newer technology that could be of practical use.

Re: Github SSL replaced by self-signed certificate in China

#15

Post by ihsw »

AndrewKemendo wrote: post #13
j45 wrote: post #10

It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)

I find this a sad commentary about your (and certainly others) relationship with your clients.

This is utter rubbish, hosting your own git server(s) is easily justifiable.

The client declining to hosting code on github should be enough justification.

Re: Github SSL replaced by self-signed certificate in China

#16

Post by vy8vWJlco »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

My sense is that there is a correlation between geeks and activists, so I think it's a "logical" group to target for further "attention"/persecution. It also makes sense to want to inject flaws in project code. (Even though git has hashes, the hash can be fine if the injection happens on commit.)

Re: Github SSL replaced by self-signed certificate in China

#17

Post by andrewtbham »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

I have always imagined that github would be a huge target for the chinese... for industrial espionage. they could get the source for private repositories for many startups and successful companies.

Re: Github SSL replaced by self-signed certificate in China

#18

Post by xfs »

I guess it was a planned public test or technical verification of certain larger project about live traffic decryption on national level. There really isn't a plausible political reason of github being targeted. Maybe targeting github can get data about user response or verify scalability of the infrastructure given recent high https traffic volume from China to github.

Re: Github SSL replaced by self-signed certificate in China

#19

Post by moxie »

To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense.

The certificate in that link is just a self-signed certificate, not something signed by a CA:

Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com

So your browser will warn you that you are not making a secure connection. Firefox users, for instance, will have to make 5 clicks to get through that warning and visit the page.

I think "China turns off SSL access to GitHub" might be a more appropriate title.

Re: Github SSL replaced by self-signed certificate in China

#20

Post by dguido »

I was wondering when Github was going to start supporting HSTS and 2-Factor Auth. I'm betting that it gets bumped in priority after this event. Nothing like an incident to move along security requirements!

http://dev.chromium.org/sts

https://www.duosecurity.com/features

Post reply on HN