Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github SSL replaced by self-signed certificate in China

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 78 posts

Re: Github SSL replaced by self-signed certificate in China

#41

Post by agl »

Firstly, thanks to GitHub using HSTS on github.com (although not www.github.com), the certificate error will be fatal in Chrome and (I believe, but haven't checked) Firefox as long as you have visited GitHub previously.

(It's not preloaded HSTS so it would have to be learnt from a previous, unattacked connection.)

I know that the unbypassable errors for some sites upset the more technically minded people, but I think that incidents like this show its value.

The CloudShark trace shows what appears to be Firefox connecting to the GitHub IP address, but the server clearly isn't GitHub from the config. The server appears to be configured to accept the client's ciphersuite preference, but doesn't support DHE nor ECDHE.

The server is also only 9ms from the client - that's clearly not crossing any oceans. I'd also guess that the server is overloaded at the time because the ServerHello (which doesn't take significant processing to generate in this case) takes 900ms to come back.

Sadly, it appears to show the user overriding the certificate error and talking to the server anyway :( Hopefully that was a fresh FF install just to see what would happen (which would explain why HSTS didn't prevent the override).

Lastly, the certificate appears to be self-signed, but the Authority Key Id doesn't match. One assumes, based on "OpenSSL Generated Certificate" that OpenSSL was used, but the person may have had some trouble. I'd guess that they generated a CA certificate first (with the same Subject) and then signed the certificate in question as a leaf. Many of the tutorials that you'll find online are for that sort of setup so perhaps they weren't very familiar with X.509 certificates.

Re: Github SSL replaced by self-signed certificate in China

#42

Post by justincormack »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

Tools for bypassing the firewall are often distributed on github, so it makes sense as part of lockdown.

Re: Github SSL replaced by self-signed certificate in China

#43

Post by jacquesm »

andrewtbham wrote: post #17
songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

I have always imagined that github would be a huge target for the chinese... for industrial espionage. they could get the source for private repositories for many startups and successful companies.

Don't forget the ability to inject code into repos on behalf of someone else.

If you've been logged into github and you told your browser to ignore the warnings then better keep a really good eye on your commit log, lest something pops up that you didn't actually put in there.

And change your password at the earliest opportunity.

Re: Github SSL replaced by self-signed certificate in China

#44

Post by philwelch »

andrewtbham wrote: post #17
songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

I have always imagined that github would be a huge target for the chinese... for industrial espionage. they could get the source for private repositories for many startups and successful companies.

I doubt very much of value is on github.com as opposed to more secure Github Enterprise installations behind company firewalls.

Re: Github SSL replaced by self-signed certificate in China

#46

Post by jacquesm »

What bugs me about stuff like this is that there will always be mercenaries, guys just like you and me that will do anything as long as it pays. The Chinese government wouldn't stand a chance if they had to do this stuff themselves. Mercenary coders are nothing new, we have them in every country (and sysadmins, companies and so on).

But you have to wonder what goes on in their heads, what mindset would prompt you to sell out like that.

Re: Github SSL replaced by self-signed certificate in China

#47

Post by khuey »

songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

If CNNIC is complicit in a MITM attack there will be a paper trail (namely a certificate signed by them) proving their involvement. To this day nobody has produced a cert signed by CNNIC that was used for a MITM attack. There's no reason to believe that CNNIC is bad/evil/whatever other than their affiliation with the PRC.

Disclosure: I work for Mozilla, but not on security.

Re: Github SSL replaced by self-signed certificate in China

#48

Post by bobcattr »

agl wrote: post #41

Firstly, thanks to GitHub using HSTS on github.com (although not www.github.com), the certificate error will be fatal in Chrome and (I believe, but haven't checked) Firefox as long as you have visited GitHub previously. (It's not preloaded HSTS so it would have to be learnt from a previous, unattacked connection.) I know that the unbypassable errors for some sites upset the more technically minded people, but I think…

didn't know of HSTS, thanks.

where would one keep up with stuff like that other than keeping up with new rfc's?

Re: Github SSL replaced by self-signed certificate in China

#49

Post by moonboots »

bobcattr wrote: post #48
agl wrote: post #41

Firstly, thanks to GitHub using HSTS on github.com (although not www.github.com), the certificate error will be fatal in Chrome and (I believe, but haven't checked) Firefox as long as you have visited GitHub previously. (It's not preloaded HSTS so it would have to be learnt from a previous, unattacked connection.) I know that the unbypassable errors for some sites upset the more technically minded people, but I think…

didn't know of HSTS, thanks. where would one keep up with stuff like that other than keeping up with new rfc's?

agl's blog is a good source: http://www.imperialviolet.org/
Post reply on HN