Slashdot Mirror
China Staging a Nationwide Attack On iCloud and Microsoft Accounts
New submitter DemonOnIce writes: According to The Verge and an original report from the site that monitor's China's Great Firewall activity, China is conducting a large-scale attack on iCloud and Microsoft accounts using its government firewall software. Chinese users may be facing an unpleasant surprise as they are directed to a dummy site designed to look like an Apple login page (or a Microsoft one, as appropriate).
Gotta suck to live in China. Er, wait...
Politics; n. : A religion whereby man is god.
directed to a dummy site designed to like an Apple login page
I'm pretty sure you're not supposed to trick users into clicking the Like button.
If you use Firefox, Safari, Chrome, or IE in China, they will all warn you that MiTM attack has occurred (if you trying going to https://icloud.com./ But the most popular browser used in China (according to Qihoo, the claim is dubious), Qihoo’s Chinese 360 "Secure Browser". will allow Man in the middle attacks to occur, by design.
Are the Chinese officials trying to score some celebrity porn?
somebody has to do it.
Forgot to mention that enabling 2FA in China may be useless if they can also intercept the messages and do a replay attack.
I wonder if this will make companies like Microsoft and Apple rethink their ties to China.
China doesn't need anyone's help to look bad.
China moved from a per capita of few hundreds of dollars per year, to several thousands per year. Today's technology, permits a few tens of thousands per year income for many industrialized nations. That is about where Japan maxed out at. Even if income in Japan has stagnated for the last couple of decades, it stagnated in a good place, and things could definitely be worse. Naysayers be damned, China is going to keep on growing. China might stop at Russia's per capita income, but that's not too bad.
Please post us a picture of your Chinese entry visa so we know you have actual evidence, not just regurgitating what you saw on FOX or CNN.
Which Two-Factor Authentication methods lack replay attack prevention techniques?
Unless, of course, the Patriot Act forbids it.
I just went to https://icloud.com/ from a Windows 2003 Server in China running IE 9.08.xx and I saw no such warning. The page came up fine
Maybe it is too old to warn.
Sorry, it was a 2008 R2 server running that version of IE..
Don't be naive. It's so easy to do it without warning. I can tell you at least 3 different methods of doing that. Remember, it's not just a single hacker, but government that controls whole traffic, that can impersonate not only any domain but any ip they want, they control BGP.
What, they haven't found a subtle and quiet way to sneak in like the N-S-A does?
Table-ized A.I.
The ones that use SMS.
I strongly urge Microsoft and Apple to automatically reset passwords on all affected accounts. They really can't take just accept this kind of behaviour.
Just an FYI... I've no reason to disbelieve the story, but it would be simple to fake the evidence presented...
I also wonder why the hotmail.com certificate was mistakenly created for the hotmai.com domain... that seems rather amateurish for a nation state. (Of course, perhaps plausible deniability is the reason.)
Regardless of whether or not it's fake, it does serve to point out the intentional flaws of Qihoo’s Chinese 360 "Secure Browser" pointed out by Rosyna above -- certainly a good thing to publicize.
lock all accounts that were created via Chinese IP addresses. Assume they are compromised and prevent *anyone* from logging in to them.
The ones that use SMS dont prevent replay attacks? Any half decent SMS two factor authentication will prevent replay attacks.
2 factor auth is not supposed to prevent a MITM BTW. A page MITM-ing facebook can just pass information between the user and the server (the user will give the 2 factor auth to the MITM-ing server, which will just pass it on to facebook), and keep the session alive for as long as they want.
Ahh the old chinaman in the middle attack!
Which Two-Factor Authentication methods lack replay attack prevention techniques?
All of them except smartcard/cert.
The ones that use SMS dont prevent replay attacks? Any half decent SMS two factor authentication will prevent replay attacks.
I don't know why I'm stating the obvious... SMS is not a trustworthy communications channel especially when your adversary is your government.
2 factor auth is not supposed to prevent a MITM BTW.
Haha ha ha ha funniest thing I've heard all day.
A page MITM-ing facebook can just pass information between the user and the server (the user will give the 2 factor auth to the MITM-ing server, which will just pass it on to facebook), and keep the session alive for as long as they want.
This is why real systems cryptographically bind both factors.
I think what those guys experienced would be related to an ISP. I'm in China and traveling at the moment, so I can tell you that I'm still getting to the legit sites either using airport wifi, hotel wifi or a residential ISP.
There is interference with the internet, no doubt about that, especially since the Hong Kong protests, when they took down the whole BBC website. But unless I see it reported from a reputable source I will call this bs, since I have never been able to verify their claims in previous occasions.
you appear to be clueless around security. 2FA is not a mitigation against man in the middle. It about raising the confidence level of the identity of the person who initiated the authentication. You can still MITM it depending on other factors implemented, however if you MITM a good 2FA system you only get the one time hijacking of the current session, not the ability to reauthenticate and as with many banks they then require a reauth for confirmation of certain off account transactions to help prevent the MITM problem.
Sorry but you are full of shit, no mystical routing, ip rules or firewalls can remove the warning. The only way to get rid of the warnings are to either get ahold of trusted certificates or to have pwned the client box so you can control the client/MITM connections, it doesn't matter whether it is a single hacker or every man in the Chinese government, the number of people doesn't magically create a workaround of the validation process.
In China, I have also been running into SSL certificate errors for Yahoo.com, but only occasionally. Maybe 1/5 of the time, or 1/10 of the time. It sounds similar.
Didn't get the warning either. But I'm on a government approved VPN from my company. It's worrying that they now start to censor the corporate VPNs too. In the past it was no problem to access sites which were normally blocked on the regular Chinese internet. I wonder if they're really that insecure or paranoid to go that far.
Grandparent got downvoted to -1 for stating the plain obvious: "Don't be naive. It's so easy to do it without warning. " (..) Remember, it's not just a single hacker, but government that controls whole traffic, that can impersonate not only any domain but any ip they want, they control BGP."
./ so it is to be expected that such true and damning information was swiftly downvoted. I see the reply to that also got downvoted even though it calls the simple truth "shit": "Sorry but you are full of shit, no mystical routing, ip rules or firewalls can remove the warning. The only way to get rid of the warnings are to either get ahold of trusted certificates or to have pwned the client box so you can control the client/MITM connections"
This is
Did you still miss that it is the GOVERNMENT of a major country we are talking about here? Now go take a good hard look at that default list of "trusted" root certificates shipped with all major browsers. And no, using Firefox or Chrome will not help you here.
https is and always was broken by design. It is, and never was, safe against a government adversary and it never will be. You can stick your head in the sand and think "my government lovs me" (that must be why false-flag terrorism is common, why the US has flouride in the water and so on) but that won't change the simple fact that any government agency can simply make a phonecall and get a valid certificate for any damn domain they want and you're none the wiser if you are a target.
9/11: Never forget it was a false-flag operation
One person reports a problem -- it's a national wide problem?
And do you moral high guys ever click to the very bottom of the news to check what the real news is? Of course you busily spent time pointing your fingers.
In the news, one of the problem is the hotmail using "hotmai.com" certificate, which is happen to be a M$ website as well.
This has been going on for maybe a month -- but glad someone has logged/traced/pointed it out.. at least for hotmail.com. It's not consistent - but it has happened to me maybe 10 or 15 times in the last month. Typically it's perfectly fine.
>Popular US browsers will warm
The winter is coming. This is a good thing.
Every Government has the certificates to sign their own keys for any website. The "trust" system for the CA is designed that way.
This is a cute post that implies governments will use influence over CAs to sign fake websites that are accepted by default by browsers.
Given any such forgery would:
- leave immediate and permanent evidence
- be a known attack vector that people are actively seeking evidence of
- be of high interest to slashdot and browser makers
Then I would recommend the naive null hypothesis that governments do not do this on a large scale has a high bar to be rejected.
OTOH, targeted attacks against individual people are a different story.
-- I was raised on the command line, bitch
you appear to be clueless around security.
I openly admit to being clueless around everything. You still have to support your arguments.
2FA is not a mitigation against man in the middle. It about raising the confidence level of the identity of the person who initiated the authentication.
Authentication is establishing proof of identity. Over networks this requires strong crypto and guarding of pre-established basis of trust specific to each factor.
There is no way around this basic truth. Number of factors involved is irrelevant.
Just because Google does x or old RSA fobs did y or some bank did z does not make those schemes secure. They may represent practically useful tradeoffs to some subset of the real world yet when your adversary is the Chinese government you quickly appreciate why they are insecure and don't really work.
You can still MITM it depending on other factors implemented, however if you MITM a good 2FA system you only get the one time hijacking of the current session, not the ability to reauthenticate
Is one session not enough to wreak havoc?
and as with many banks they then require a reauth for confirmation of certain off account transactions to help prevent the MITM problem.
I don't think online banking is something that deserves to be held up as an example. At least here in the US the faux second factor schemes allowed to be deployed by many institutions are patently ridiculous and dangerous.
What is secure is entering credentials into a FOB which then performs a cryptographic handshake with the institution. Here each and every factor is strongly protected and at no point is MITM possible unless the physical guard is compromised. Most everything short of the above is noise.
Please describe a 2 factor authentication method that is not susceptible to a man in the middle attack.
Specifically, describe a 2FA mechanism that is safe where one channel is completely compromised (Lets say; the Web Page you are "logging in to" is being man in the middled by the Chinese government).
This is not "Prove something doesn't exist", but show me even one example of a mechanism that does exist that is "man in the middle-proof". Seriously.
Chrome will save you.
Because certificate pinning means; even if the certificate is valid from a valid trusted CA chrome will still warn you that the certificate has changed .
I wonder if Apple will complain to the world trade commission regarding the self-signed www.icloud.com certificate. This is a purposeful violation of Apple's trademark.
Other than certificate pinning (which you can do with CA certs and SSL/TLS just as easily), describe a scheme that doesn't have this problem. No?
At some point, you have to have a trusted party to provide trust in a cert. Otherwise, you have nothing. And that trusted party can be compromised, at which point you have nothing.
Web of trust:
The closest thing I'm aware of to avoiding that involves a web of trust, where trust is distributed more, but without a central authority, there's no consistency in how well different parts of that web perform validation of the identity of the requestor, which results in even weaker trust than with a central authority.
Of course, you could set a trust policy that requires multiple signatures to trust a certificate, but at some point, you're still trusting random websites that you don't know, and whatever limit you set, a government could always exceed it. If you say that three sites must sign something for you to trust it, the government can find three sites that can be bribed, or even use their own sites to sign it.
Mind you, you could carefully craft trust policies, and then manually evaluate every certificate that fails to decide whether you trust it, and that would be more secure for people who are highly skilled at crypto, but for the average person, such a scheme would be much, much weaker.
DNS-based security:
Another proposal for reducing the importance of the CAs is putting the certs in DNS records. This ensures that only those who can mess with DNS can change the certs.
Unfortunately, most users rely on external DNS servers for recursion. If the government substitutes their own, they can refuse all DNSSec queries, and most users will be none the wiser. This effectively makes DNSSec useless until OS vendors make it mandatory by showing errors when it gets an unsigned response.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Please describe a 2 factor authentication method that is not susceptible to a man in the middle attack.
Client certificate + password
certificate based smart cards /w keypads
Specifically, describe a 2FA mechanism that is safe where one channel is completely compromised (Lets say; the Web Page you are "logging in to" is being man in the middled by the Chinese government).
This is not "Prove something doesn't exist", but show me even one example of a mechanism that does exist that is "man in the middle-proof". Seriously.
Too many people seem to be poisoned by the way things are vs how they could be if the proper readily available technology was brought to bear on the problem. Collection of credentials from web forms per your example is breathtakingly stupid way to have your users fall victim to attacks yet it is **everywhere**
For "what you know" use of zero-knowledge key agreement protocols such as TLS-SRP (RFC5054) enable two parties to establish mutual proof of possession without leaking shit and without associated MITM bullshit.
Imagine entering your credentials into a web form and not having to give a shit who is on the other end and without having any SSL certificates.
If the right person is on the other end login succeeds and *both parties* have evidence of the identity of who they are talking to.
If the wrong person was on the other end they don't get *SHIT* not even material for offline attack and the login fails. No certificates or external security mechanisms are required yet they can still be used to further enhance security and practical user experience.
Zero knowledge agreement satisfies "What you know" factor mutually in a secure way without MITM.
Mutual certificate authentication satisfies "What you have" factor in a secure way without MITM.
Each factor above is able to stand on its own feet separately. Each offers mutual evidence of identity.