Some scary finding about internet security, can someone analyze it with me?

Toggle sidebar Toggle sidebar
S

sam1275tom

Reputable
Oct 13, 2014
462
0
4,860
Hi everyone.

Recently one of my friend been to China for traveling, and China have a so called "Great firewall" that block most connection to other countries.

Most of the time he will use VPN and will be able to connect anywhere, and we often chat online, he also like play with computers and we did some test together over online chat.

Most website are just blocked, after a bit search we know this happens either by a wrong IP answer from DNS hijack, or just blocked by IP address.

But some of them are redirected to a wrong website. At first he thought it's just another DNS poisoning, and if he just use the correct IP address, it's fine. Then we found something weird... There's a few cases even when he just type the correct IP, it still open a wrong site when not using VPN, and we are really confused, how can that happen?

And then the most scary part: he tries to visit "skype.com", and the test follows:
1. He visit with VPN by domain name, it works well, the correct site opened as "https://www.skype.com/"
2. He visit without VPN by domain name, the site opens as "http://skype.gwm.cn/", which is a hijacked/redirected wrong site.
3. He visit with out VPN by correct IP address, the browser reports invalid certificate with:
"The certificate is only valid for the following names: www.skype.com, *.skype.com
Error code: SSL_ERROR_BAD_CERT_DOMAIN"
If he force visit the site, he will still open the wrong "http://skype.gwm.cn/".

At first we think it's because he's using "https everywhere" and the rogue site provided a fake certificate, but after we compare the SN, SHA-1, SHA-256 between the right and wrong site, they are identical, this really makes me feel upset. Because the "Great firewall" can already provide a wrong DNS answer, so imaging if the right domain is sliently redirected to the wrong IP, and the fake site have the same certificate as the correct site, the user may never know whether he is visiting a phishing site or not?

We don't know if we missed anything, and welcome you guys to discuss.

Thanks!
 
Solution
B
They can just inject the same ip into their routers if they wanted. The only thing that prevents someone from using any ip they like is the ISP being honorable and only allowing IP to be inject that are owned by the person advertising. There are sites that ISP use to show what BGP AS number owns what IP and they only allow those.

If the ISP is under control of the government they can violate all the common rules. They just filter the route advertisement before it goes outside the country so they don't mess everyone up. China has in the past injected routes they should not have and most ISP that peer with china now have special filters.
Sort by date Sort by votes
B

bill001g

Titan
Aug 9, 2012
28,318
2,754
125,640
You never really know what is going on when you have a government in between. They very well could have a man in the middle attack server trying to intercept https sessions. That is why you get certificate errors and is what certificates are designed to prevent. Now you do sometime get errors when you use the direct ip address but you can avoid that by putting the entry in your host file so you can use the name without using a dns.

China has been known to corrupt certain certificate servers which is why some browsers refuse to honor those in the list.

This is actually something large corporation do to reduce the ability of employees to send sensitive corporate information out though https sessions. It is pretty easy to setup your own certificate server and then to avoid the error messages use group policy to force the certificate server to be trusted by all the company owned machines and not produce errors. You can still detect it if you look...then again the company I work for actually states they do it in the internet use policy that nobody reads.

If they really wanted to china can block almost all vpn easily. Almost all use openvpn which is does not conform to the true ssl standard so you can detect the invalid data streams when the session is opened.
 
Upvote 0 Downvote
S

sam1275tom

Reputable
Oct 13, 2014
462
0
4,860


Thank you for your reply, however could you answer my question directly?
1. How can someone redirect a IP address to a wrong server? (I search about it and somewhere suggest it use a wrong routing diffusion information to archive that.)
2. So if they are able to provide a right certificate in the wrong site, how can a user determine if a site is a legit one or not? Right now browser will give a "common name" error, and it don't have a certificate inside the fake site, but it will be easy to get around the latter, so will the common name warning be the last straw?
 
Upvote 0 Downvote
S

sam1275tom

Reputable
Oct 13, 2014
462
0
4,860


Thank you, but as I said, when using the IP address to visit the website, he already bypassed the DNS poisoning. How can he end up still open the fake site?
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,318
2,754
125,640
They can just inject the same ip into their routers if they wanted. The only thing that prevents someone from using any ip they like is the ISP being honorable and only allowing IP to be inject that are owned by the person advertising. There are sites that ISP use to show what BGP AS number owns what IP and they only allow those.

If the ISP is under control of the government they can violate all the common rules. They just filter the route advertisement before it goes outside the country so they don't mess everyone up. China has in the past injected routes they should not have and most ISP that peer with china now have special filters.
 
Upvote 0 Downvote
Solution
S

sam1275tom

Reputable
Oct 13, 2014
462
0
4,860


Thank you, so will https certificate still protect user against such a bad ISP/government? I mean can we trust a site in a very bad internet environment, but the site have a legit certificate?
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,318
2,754
125,640
General you should be able to tell if the certificate is valid. In most cases they would have to be able to change your machine to add a invalid certificate server. Look very carefully at the certificate information. If it is using a certificate server to validate it outside china it has to be valid. The certificate server itself is using certificates built into the browser to prevent spoofing the actual server. If you find the certificate leading to a china based server then you do not know.....there are valid certificate servers in china.
 
Upvote 0 Downvote
S

sam1275tom

Reputable
Oct 13, 2014
462
0
4,860


Thank you very much!
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom