So how about hacking and leaking their certificate and then making all Kazak government traffic vulnerable to public posting all over the internet?
Kazakhstan to MitM all HTTPS traffic starting Jan 1
61–70 of 378 posts
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#62Google and Mozilla should blacklist the certificate once it's made public.
That would just stop their browsers from working in Kazakhstan on HTTPS sites, who would most likely respond by issuing a new certificate and/or recommending IE. It may also discourage websites from implementing HTTPS. Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?
Depends on the client implementation. You should expect applications like Twitter for iOS to become inaccessible as it pins the certificate (correctly), i.e. adding the world of (rogue) CA's still wouldn't make the certificate valid. Apart from replacing the (hardcoded properties of the) certificate
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#63Slightly OT - if the bad guy can't fiddle with the trust store of your computer, whats his another methods of analysing a users traffic? Is https breakable by other means?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#64> The national security certificate will secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources. How is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location? http://i.imgur.com/fYKHRK1.png
Remember they have your location anyway from your IP address.
Then they think I am from London, my IP is 188.29.165.147. But no, I am 200 miles away.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#65Is this different than the DoD having a root certificate in iOS (and I think Windows, too)? Couldn't the DoD also MITM the traffic any time they wish?
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#66Earlier quoted context omitted.
That makes it only more interesting. However, I assume, IP-based location isn't that granular?
It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.
In US (or is it just Comcast) - it is exact!
Seems Comcast maps IP (which they issue) to postal address to exact Geo coordinate.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#67Wondering about a turtles-all-the-way solution: A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates. So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs. (some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP
Somewhat related would be Tor's flashproxy bridges: https://crypto.stanford.edu/flashproxy/
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#68This sounds pretty bad and we can just hope that this doesn't become the new norm.
What makes me kinda angry is however where this originates from: There are countless so-called "IT security" products that had this idea of MitM-ing all traffic before. Basically it's just the same idea on a bigger level.
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#69Earlier quoted context omitted.
That makes it only more interesting. However, I assume, IP-based location isn't that granular?
Try normal Geo-IP (Maxmind) and it will show the local telco exchange. I am sure the NSA does better but Kazakhstan? I have been inside one of their embassies to be shocked that they were watching the news on a black and white CRT TV!!!
Probably because they got sick of embassy staff stealing the TVs they kept buying for them. 8)
Re: Kazakhstan to MitM all HTTPS traffic starting Jan 1
#70Earlier quoted context omitted.
It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.
The actual data source will provide a country, state or sometimes even city and zipcode. Then whatever tool you're using to map drops a pin in the middle of that region. If you zoom in, you get whatever happens to be at the geographic center of whatever the mapping tool (probably Google Maps) thinks is the center. eg if it says "United States" and no other data, you get some random ass place in the middle of Kansas.…
You're describing GeoIP derived from "public" information sources such as the physical address of the assigned entity or the location information provided to the registrar by the block owner.
However, there is a different kind of GeoIP that has the potential to be much more specific as to the location, based on a join between Internet traffic and transactions that target a specific location. e.g. when you purchase a physical item from an online vendor, with your house as the delivery address, they now have both your IP and location. Obviously for this to work it depends on a) the IP address remaining the same for some period of time and b) sharing of the necessary information to allow the join. afaik both are often true.