Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kazakhstan to MitM all HTTPS traffic starting Jan 1

telecom.kz

Post reply on HN
Print view View original

231–240 of 378 posts

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#231

Post by tjohns »

mtgx wrote: post #65

Is this different than the DoD having a root certificate in iOS (and I think Windows, too)? Couldn't the DoD also MITM the traffic any time they wish?

Yes and no.

At a basic level, yes, any CA can issue a certificate which can be used to launch a MITM attack. We trust that the CAs don't do this. If they're caught, the browser industry tends to revoke their CA status -- which is pretty bad for the CA's business model.

That said, the CAs have been under increased scrutiny lately, and browsers are starting to build additional protections against this kind of thing:

- Certificate pinning (HPKP) allows sites to restrict which certificates can be used for a specific host, even if the certificate is signed by a trusted system root. (Caveat: HPKP isn't enforced for local roots, installed by an admin. That's how Kazakhstan is able to get away with this, because they're asking users to install a new root manually.)

- Certificate Transparency is supposed to provide an audit log for CAs, so that any maliciously issued certificates can be detected and acted on.

That said, these features are new and not universally supported by all browsers. And neither would help in a case like Kazakhstan, where users are being asked to bypass security features and there's no system root to revoke.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#232

Post by mnx »

jtome wrote: post #228
nfd wrote: post #221

Earlier quoted context omitted.

Raise awareness, spread the word about Tor. If they start running attacks against Tor, start an uproar. And pitch Tor as an elementary security measure; say "do this to make your communications more secure." It isn't perfect, but maybe it's better than nothing?

I suspect Kazakhstan doenst have the resources to mount attacks against tor unless they can pay some western company to do it for them. Blocking it is a somewhat different matter.

De-anonymisation attacks may be non-trivial, but does TOR have any real resiliency to DDoSes?

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#233

Post by femto113 »

jacquesm wrote: post #220
dheera wrote: post #199

Earlier quoted context omitted.

Well, in that case I'm just going to invent a TCP-over-cat-pictures VPN. Encode all the TCP packets in the subtle details of the fur and package everything up as innocent-looking HTTP GET requests. This realistically shouldn't be too hard to do with obfsproxy's already-built framework.

You're going to run out of cat pictures pretty quickly.

I've been thinking about this lately, and it seems that you could use something like a book code. Client and server use existing internet accessible images as the book and then your communication simply references bytes in those images: client requests a URL that encodes the bytes it wants to send, server returns HTML containing the urls of images containing the bytes it wants to send in response (and any extra content that helps make the page seem normal, ignored by the client). Pictures could be anything anywhere (lolcats, wikipedia, etc.), client should only ever need to download the picture once. Bandwidth wouldn't be great, but if the server is accessible via a wide (and evolving) variety of domains it seems like it would be quite hard to distinguish this from normal browsing.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#234

Post by cortesoft »

duncan_bayne wrote: post #201
dujiulun2006 wrote: post #28

Earlier quoted context omitted.

Chinese govt is also capable of doing this. Best part? We even have our trusted* root certificate! Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS * Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938

I really don't understand how that sort of behaviour doesn't constitute an act of war. Imagine if China sent saboteurs in-country to physically destroy infrastructure being used by American businesses. That would Not Be Taken Lightly.

Which sort of behavior? Having their own root certificate?

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#236

Post by cortesoft »

egeozcan wrote: post #10
kaizendad wrote: post #6

I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert. Sure, it's going to be difficult to enforce, but it…

> it's going to be difficult to enforce I guess it's just a matter of dropping every connection that you can't MITM, no?

For SSL traffic, yes, but that wouldn't stop someone from using a different encryption protocol.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#237

Post by duncan_bayne »

cortesoft wrote: post #234
duncan_bayne wrote: post #201

Earlier quoted context omitted.

I really don't understand how that sort of behaviour doesn't constitute an act of war. Imagine if China sent saboteurs in-country to physically destroy infrastructure being used by American businesses. That would Not Be Taken Lightly.

Which sort of behavior? Having their own root certificate?

I meant China's behaviour, e.g. orchestrating a DDOS attack against GitHub for political reasons.

The root certificate thing is 'merely' a violation of the rights of their own subjects.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#238

Post by cortesoft »

duncan_bayne wrote: post #237
cortesoft wrote: post #234

Earlier quoted context omitted.

Which sort of behavior? Having their own root certificate?

I meant China's behaviour, e.g. orchestrating a DDOS attack against GitHub for political reasons. The root certificate thing is 'merely' a violation of the rights of their own subjects.

Ah, ok that makes more sense.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#239

Post by wtracy »

I once looked into getting a .kz domain. (I wanted to host comics on a site named "comi.kz".) It turns out that one of the requirements for getting a .kz is that the website be physically hosted inside Kazakhstan. (And yes, Kazakhstani hosting providers that do business with foreigners are expensive.)

Right now, I am very glad that I did not go down this route.

Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1

#240

Post by tobltobs »

JoshTriplett wrote: post #223
tobltobs wrote: post #197

Earlier quoted context omitted.

"A National Security Letter will not prevent the certificate authority from being blacklisted " Sure it will, just send another NSL to the blacklisting instance. And I do not understand that going to jail instantly is a smaller burden for you than living with the small risk getting caught. Do you really believe the NSA or any of those other patriots do not have a few of the private keys for the certificates you trust…

> Sure it will, just send another NSL to the blacklisting instance. Instances, plural, including both browsers and various cross-check mechanisms (pinning, certificate transparency, etc). Likely too many people required for operational security. Not saying it couldn't be done, but it certainly couldn't be done lightly or often, and even then it would produce significant risk of exposure. It certainly couldn't be effe…

warrant/subpoena != NSL
Post reply on HN