It's very surprisingly granular. I logged dropped packets from my router's firewall for a week and looked up the origin locations with geoip for fun. Just plugging in the coordinates to google maps would zoom directly in on peoples' houses (sometimes in the middle of nowhere). I'm not sure it's 100% accurate, of course, but it sure seemed specific.
The actual data source will provide a country, state or sometimes even city and zipcode. Then whatever tool you're using to map drops a pin in the middle of that region. If you zoom in, you get whatever happens to be at the geographic center of whatever the mapping tool (probably Google Maps) thinks is the center. eg if it says "United States" and no other data, you get some random ass place in the middle of Kansas. Sometimes there can be more specific data, but just because you can keep zooming in doesn't mean that that's actually where it is
You're describing GeoIP derived from "public" information sources such as the physical address of the assigned entity or the location information provided to the registrar by the block owner.
However, there is a different kind of GeoIP that has the potential to be much more specific as to the location, based on a join between Internet traffic and transactions that target a specific location. e.g. when you purchase a physical item from an online vendor, with your house as the delivery address, they now have both your IP and location. Obviously for this to work it depends on a) the IP address remaining the same for some period of time and b) sharing of the necessary information to allow the join. afaik both are often true.
Try normal Geo-IP (Maxmind) and it will show the local telco exchange.
I am sure the NSA does better but Kazakhstan? I have been inside one of their embassies to be shocked that they were watching the news on a black and white CRT TV!!!
Basically that and... I'd say when you don't share the location, they only have what's available publicly from GeoIP (via ISPs). Wen you do, your user agent actively tries to give them the best possible results (using GPS or anything else), that's the way I would put it.
The location associated with the IP address they see may not be your physical location by quite some margin.
If you are connecting via a mobile phone the address is likely to be registered as at one of the phone company's locations which could potentially be in a different state. For many home/office serving ISPs this is similar. Also, if you are using a VPN of some sort the address you present to the web server is quite disconnected from your physical location.
If on the other hand they request your location via your web access client and you agree, it will be using localisation APIs that may well know your location with some precision: using GPS if your device has it and has it turned on, or via wireless AP availability based lookups otherwise.
Well technically that's your browser blocking their location request and asking you if you want to let it go through. If they were honest they would say something like "we're about to request your location for x very useful thing that justifies giving up this piece of sensitive data"
It's a really backwards way to customize a phone number on their site. They POST your geocode to their server and based on the city you're in change the area/country code. Quite a strange way to do it, but hey.
Its protecting users from getting visits from Kazakhstan's security services for covertly communicated with foreign entities. That is, presuming that the content of their traffic isn't unwelcome by the security services, since otherwise, even with the use of the MitM certificate, they'll still get visits.
Without in any way condoning the move, there is a lot of protection you can add with decrypted traffic. Malware analysis, DLP, etc.
But obviously the security as a whole has to consider the increased risk due to the centralized cert, disregarding entirely the fact that you're trusting a totalitarian government with all of your secrets...
So like, what's the plan for people visiting Kazakhstan here? Install some rando's SSL certificate in your trust store or just not be allowed to access the internet?
They're likely only intercepting known https traffic (port 443). If you use a VPN and tunnel all traffic you probably won't have any issues.
If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.
I lived in Kazakhstan for a few months, and I think they're already blocking VPN traffic with deep packet inspection. I tried a number of different services, including setting up my own on Digital Ocean.
setCityByIp() in Javascript. They seem to only be interested if your country code comes back as KZ. First use of the MapQuest geolocation APIs I've seen, too.
I suspect although this might have some minor use to track users outside Kazakhstan, it's real use is to track web site visitors from within Kazakhstan.
I really appreciate how they're doing this. The Chinese built up an amazing infrastructure for the Great Firewall; the Kazakhs just say "install our cert!" The Chinese spend billions and have to stay ahead of all of their citizens' clever new ideas at all times; the Kazakhs spend a few hundred and just need to point guns at their citizens until they install a cert.
Sure, it's going to be difficult to enforce, but it should also be quite cheap.
You don't have to. Proxy handles the request and just gives response back to you signed with national cert. If you don't install it, your browser will just start complaining about every site.
At least that is how Bluecoat ProxySG[1] works at my employee.
Funny story, most of the machines / servers at my workplace weren't vulnerable to Heartbleed - but ProxySG was. AFAIK they built their own OS from scratch, too.
country wide, this is a loud call for a cloud, distributed proxy provider with a better track record than the telco, to offer tor-like tunnels to at least exit the MITM zone.
easy to enforce inside the country. Just set it so that there's no https if you don't have the cert! It is becoming a legal requirement for all telcos in the country so even if you're roaming (with a data plan from a foreign provider, for example) - you're still using the local telcos.
Only way to avoid is to use some kind of foreign satellite internet or maybe private / non government / non telco dark fibre.
I guess VPN is the only way to avoid it. Or sshuttle or something over port 80. But then again, how long will it take before they can detect that and then block it?!
Or you can use non-standard ports, and change them continuously.
They can just block everything by default and only enable what they can decrypt. Maybe you could try tunelling encrypted data over HTTP, but heuristics could probably pick that up too.
If I had the free time, I'd create a cryptographic protocol running on top of telnet that looked like someone playing a MUD.
For email, you'd encrypt data to have it look like regular prose. So you'd only get a few bits per English word, but that would be sufficient for short messages. Could also make use of extra spaces in between words.
The real trick with that would be to take an existing document, and alter it to encode a message. So you'd be doing things like using synonym choice to get your bits.
Wait, isn't reddit already used for this extensively? With each subreddit being a separate comms channel.
Or is there another reason why very little reddit content makes sense?
Well, in that case I'm just going to invent a TCP-over-cat-pictures VPN. Encode all the TCP packets in the subtle details of the fur and package everything up as innocent-looking HTTP GET requests.
This realistically shouldn't be too hard to do with obfsproxy's already-built framework.
Pretty easy really. Without knowing the key for the steganographic algorithm, it's really hard to get the data out unless you can compare it to the original. So if you're sourcing the pictures from somewhere, you'll need to manipulate false bits that aren't called for from the data itself to keep it from being breakable in such a manner.
I've been thinking about this lately, and it seems that you could use something like a book code. Client and server use existing internet accessible images as the book and then your communication simply references bytes in those images: client requests a URL that encodes the bytes it wants to send, server returns HTML containing the urls of images containing the bytes it wants to send in response (and any extra content that helps make the page seem normal, ignored by the client). Pictures could be anything anywhere (lolcats, wikipedia, etc.), client should only ever need to download the picture once. Bandwidth wouldn't be great, but if the server is accessible via a wide (and evolving) variety of domains it seems like it would be quite hard to distinguish this from normal browsing.
Just pass a DVD with white noise when you meet in person. That should keep you in one time pads as long as you want to communicate with someone. All you need is XOR and a bookmark. Of course you need to meet once, if that's not feasible you're going to get more technical.
In Vernor Vinge's A Fire Upon the Deep I recall a plot element along these lines. Traders traffic in cubes of material that acts as a super dense source of pad data. Your communication partner on another ship would have the twin cube, and the two would be synced up and then provide the carrier data stream for video and other content. When your cubestuff is exhausted your secure authenticated comms cease.
If the censorship is based on the government being able to make some sense of what you're communicating, XORing with a PSK will not work, because they will see meaningless garbage and block it. The reason I suggested cat pictures is because the censors will see actual cat pictures and (hopefully) consider the protocol not worthy of blocking.
I'm not a West Hater by any means, but I'd say the war started when the US and the UK engineered a coup in Iran because Iran nationalized their oil industry (after the British oil company running it refused to be audited or to renegotiate terms).
I'm not sure. But nationalisation is certainly a violation of rights.
Of course, I'd be interested to see how those assets were set up in the first place - my bet would be during a non-rights-respecting period of colonialism.
You go to when the country got a democratically elected government.
As for nationalisation is certainly a violation of rights do you hold that all eminent domain is a violation of rights? IE if the government wants to build a road and uses compulsory purchase orders it's a violation of rights?
That does not justify overthrowing another country's government. Most countries, including the United States, recognize the state's eminent domain over its land and its natural resources. Besides which, the Iranians tried to negotiate, the British refused, so the Iranians nationalized in response.
> how that sort of behaviour doesn't constitute an act of war
You need photos of explosions and dead babies to convince your populace to go to war. Making a case for war between nuclear powers on the basis that "some website for geeks became a bit less reliable" isn't going to cut it.
Was that trusted root cert ever misused? IIRC, it was un-trusted because they did not do their due diligence on how an issued sub-cert was being used by an Egyptian company.
What does the GitHub DDOS have to do with MITM attacks on https?
the ddos was achieved by altering the contents of one of the script on a large chinese site (was it baidu? google it). Once every user on that site loaded the tampered script, it made sure to send many requests to github.
Sadly, they (Baidu) are not, which is why the script content was easily modified.
To clear it up, I said that GFW "can" do (but has not yet done) these. But it tried to MITM some https traffic earlier with a non-trusted certificate as an experiment.
It's not even difficult to enforce. If you don't install their cert, you don't have access to the internet. Or you just have to force Chrome to ignore all SSL errors, which is the same thing.
> secure protection of Kazakhstan users when using coded access protocols to foreign Internet resources.
I guess "coded" here means VPN as well...
Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.
> Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.
Wow, I feel really sorry for all Kzakhstan citizens. Also, this is a great example of 'rubber-hose cryptoanalysis' - who cares about 4096 RSA or whatnot if the government can just beat you until you oblige...
If they can unwrap the first layer of encryption, and most normal traffic inside isn't encrypted, people tunneling through MITM'd TLS are playing a game of cat and mouse with a very well-funded adversary that can imprison, torture, or kill them.
Obviously, a lot of people do this kind of thing in China, and from what we know, circumventing the "Great Firewall" isn't routinely getting people killed. But people should know what they're doing before they try it in Kazakhstan.
That's a terrible TX/RX ratio. Unless you encode data in each request and receive small pictures only, it would take ages to send any real information. Good for receiving though.
Every huge porn site is banned in Kazakhstan. I believe that porn is forbidden here.
The worst thing — they just ban sites without any explanation. Site just stopped to work and you don't know why. Even w3.org was banned for some time (probably because its validator could be used as web proxy).
That would just stop their browsers from working in Kazakhstan on HTTPS sites, who would most likely respond by issuing a new certificate and/or recommending IE. It may also discourage websites from implementing HTTPS.
Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?
Depends on the client implementation. You should expect applications like Twitter for iOS to become inaccessible as it pins the certificate (correctly), i.e. adding the world of (rogue) CA's still wouldn't make the certificate valid. Apart from replacing the (hardcoded properties of the) certificate
That would make people in the US feel better, but it wouldn't make any difference. If a country can force residents to install software or reconfigure their machines, there's nothing browser vendors can do to make those residents secure. Essentially, Kazakhstan owns (in both senses) the Internet-connected computers of all its residents, and it can do whatever it wants with them.
It's also well within Kazakhstan's budget to do subtler, harder-to-defeat things to stop MITM circumvention. This is an arms race that Google will lose.
Can you name some examples of what they can do? Because other than release some sort of virus, which will be found in a matter of months, I don't think they can infect the entire country.
They can target more specifically than that. Suspected activists get a keylogger bundled in their next windows update. Later on another update removes all traces of it. It might take decades before something like that was noticed.
Windows doesn't use the certificate store for windows updates. Installing a root CA does not allow you to provide windows updates because I believe they hardcode the cert in the updater.
Other non-windows updates do allow you to install other software.
To set this up, Kazakhstan will have to set up their CA with the bit set for software signing. This bit will be visible by everyone and it'll be very telling instead of just being allowed as a root CA for ssl/https sites.
Makes me wonder how long such policy would last if Google, Facebook, and Microsoft would ignore traffic from Kazakhtelecom MITM server (or just drop the whole Kazakhtelecom IP address space). Of course I'm not saying that they should do that.
Actually they really should. As soon as major networks start saying NO is when governments change, I think this is one of the few times where this kind of pressure would be mostly good.
And it wouldn't work. You've apparently have never been stuck inside China. I was there for a few years and it was brutal, network wise. Local companies just replace what can't be accessed from the outside.
Exactly, and it's been blocked almost since the beginning in China, which means users are now using local products. If the users can't access the websites they are normally using the next day, they will just get some unblocking software from a friend, this things are shared really quickly.
It would probably have to be the entire IP address space, since they could transparently source NAT on the MITM server to make it look like it's coming from the user's IP.
I'm 100% sure that keys are in hardware device and couldn't be leaked. Kazakhstan has certificate infrastructure for years to issue digital certificates for their citizens. Nothing was leaked yet.
Love the Orwellian Newspeak: a "National Security Certificate" to protect people accessing "foreign resources"... If you don't know anything about the subject it really sounds like they're doing you a favor.
If the protocol is delivered over HTTP and runs in Javascript DOM context, it will be straightforward for an adversary that MITMs all traffic to defeat it.
Okay, so it's (just) for reading the delivered data. Somehow I keep considering MitM a harmful attack (i.e. manipulating the data before it hits the user). My bad :)
Given that you're relying on server-provided JS to verify the integrity of the data in the first place, a MITM could replace the verification function with return(true) and then inject whatever data they want.
Yes, you'd have to sideload the initial keys/code, presumably outside the country. It works for Netflix because it's baked into the client. But at least once you've somehow gotten the keys you won't get stopped by the government blocking it since it isn't 'https' and doesn't look like 'https'.
Until they figure it out and start blocking that too of course.
Pretty sure that Netflix loads a Flash client (or some other trusted code module) to prevent this. But you're right; the browser isn't secure enough to enable client-side encryption over HTTP as it would be trivial to MITM and sideload JS code to defeat it.
It’s the same reason why any DRM is completely pointless: It only provides inconvenience for the legitimate user.
I own Anno 2070 (as can be seen on my steam profile), but can only play with RELOADED crack under wine because UPlay refuses to run.
Same with this type of encryption: Kazahstan can easily defeat it, but it makes it harder for people trying to debug why they can’t use Netflix (for example, in case that Kazahstan MitM's everything, and encrypts with a different certificate than your Netflix client is using).
Client side encryption works just fine. It's only a problem in a browser where you have to download the possibly-MitM'd program each time you want to use it. Actual installed client software that encrypts end-to-end is the proper way to use encryption.
One catch: remember that the browser itself absolutely should not be the installed program doing the end-to-end encryption, where bugs can allow the private keys to be leaked. Important data like the private keys shouldn't even be in the same address space. See gpg-agent/ssh-agent as an examples of how to keep sensitive data in a separate process.
Nit: you are effectively re-downloading browser DOM JS crypto programs every time your browser loads a new DOM element for the page hosting the app. It's not just something that happens when you first visit the site.
That's one of the things that makes securing browser JS crypto so intractable.
Meh; you can't trust the first version anyway, which makes anything happening later on the page just as broken.
If it's an additional source being added much later on that you are concerned with, that's always been a broken design that Douglas Crockford warned[1] about years ago.
Until next week when GFWoKazhakhstan blocks all traffic using the Netflix protocol. Unless the traffic is steganographically hidden, uncontrollable traffic will be simply killed.
A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates.
So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs.
(some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP
Once it happens enough to be on the radar, it will be blocked or MiTM'd. Probably the former, possibly with a free symposium on the application of rubber hoses.
You can't solve political problems with cryptography, much though the software engineering industry may wish it were so.
Ultimately, though it will be very hard to accept, crypto may be on the way out as a technology with any political impact. Governments currently accept the rapid increase in SSL because none of the politicians or regulators understand that it's possible to disable it at a country level, and nobody with any technical clue has been willing to point it out to them. But that situation isn't sustainable, as the Kazakh example shows. A sufficiently determined government won't care about minor details like user convenience. They'll just say "you either install our root cert, or you don't get to use the internet" and that's it. Game over. If even just one western country does it, the rest will all follow within a few years.
While there are probably 100 different ways to avoid this and retain secure traffic, I would venture to guess that the average Internet savvy-ness of Kazakhstan is pretty low, so using any of them would single you out for additional government attention (whether you're actually doing anything illegal or not).
That said, there's a remarkable tendency in countries as corrupt as Kazakhstan for a "shadow" telecom network to pop up. Just run in some fiber from a neighboring country on the down-low and distribute locally via microwave dish. Yeah, it's not exactly difficult to locate a powerful dish, but it's also not glaringly obvious so you can usually pay someone to look the other way. After all, the government officials want to look into everyone's communication, but if their own communication was ever intercepted, they would be the target of blackmail! They want to use the information they gather to blackmail citizens like the Stasi, not the other way around.
Of course, the flip side of that are the mobile phone networks operated by the Mexican drug cartels and ISIS. But the only surefire way to avoid government surveillance of this sort is to bypass government regulated telecoms entirely.
Kazakhstan is possibly more democratic than all its neighbours save maybe Kirghizstan (I'm not up do date on the current government position). More democratic as in I can't make up who's more of a despot between Putin and Nazarbayev, after all they both win open elections, albeit with an iron grip on medias... But then Kirghizstan is likely depending on its neighbours for connectivity (also landlocked).
The other neighbours are shining beacons of democracy such as Russia, China and Uzbekistan...
While Russia does encroach on various Internet liberties, it does so quite lazily so far. It does not have a great firewall, it does not have force-fed SSL certs, it does not crack down on the widespread VPN usage. When Roskomnadzor blacklists certain resources, Internet providers enforce it at their leisure, it seems, because different users report a resource either be blocked or not.
"The strictness of Russian laws is compensated by their optional enforcement", as they say.
In a smaller country like Kazakhstan such things are easier to enforce, probably.
Russia is also corrupt enough (especially in the rural areas) that you could probably find an Internet connection that wasn't actively monitored by Moscow authorities. I'm not saying it would be cheap, but it's definitely doable.
Slightly OT - if the bad guy can't fiddle with the trust store of your computer, whats his another methods of analysing a users traffic? Is https breakable by other means?
You can inject hooks into the certificate validation routines to make your certificates accepted, hook the actual encrypt/decrypt functions, or make the session establishment routines leak the master secret.
They don't really have to force you to install that root cert.
Every https connection will be signed with it, so you either trust that cert and can actually view the site (and gov can read it all) or you don't and just get error in your browser.
Everything is breakable, but some things take a really looong time to break. Governments might be able to break some weak https encryption, but not all.
At a basic level, yes, any CA can issue a certificate which can be used to launch a MITM attack. We trust that the CAs don't do this. If they're caught, the browser industry tends to revoke their CA status -- which is pretty bad for the CA's business model.
That said, the CAs have been under increased scrutiny lately, and browsers are starting to build additional protections against this kind of thing:
- Certificate pinning (HPKP) allows sites to restrict which certificates can be used for a specific host, even if the certificate is signed by a trusted system root. (Caveat: HPKP isn't enforced for local roots, installed by an admin. That's how Kazakhstan is able to get away with this, because they're asking users to install a new root manually.)
- Certificate Transparency is supposed to provide an audit log for CAs, so that any maliciously issued certificates can be detected and acted on.
That said, these features are new and not universally supported by all browsers. And neither would help in a case like Kazakhstan, where users are being asked to bypass security features and there's no system root to revoke.
This sounds pretty bad and we can just hope that this doesn't become the new norm.
What makes me kinda angry is however where this originates from: There are countless so-called "IT security" products that had this idea of MitM-ing all traffic before. Basically it's just the same idea on a bigger level.
Google, Facebook, Yahoo, Microsoft, Salesforce, Box, Dropbox, Twitter, etc. could have a very strong influence on changing this if they banded together to respond to this in some way.
The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented.
The people of Kazakhstan can achieve the same outcome.
What should these companies responses be? And why should the kazach goverment care? They'd prefer if the poeple used russian (or kazach) copy cats like vkontakte anyway.
The government preference isn't important, citizen preference is.
As to what they can do... it's a range from info to painful, but they can choose a range of options from serving up interstitials in a localized language that explains the issues, problems, and privacy and security implications... all the way to deny service.
If the citizens demand access to those services, or find it offensive that their privacy and security is being violated and circumvented, they will take action.
And these companies can help orchestrate, just as we did with SOPA/PIPA.
> If the citizens demand access to those services, or find it offensive that their privacy and security is being violated and circumvented, they will take action.
Hah, right. They'll just file a complaint to their ombudsman and the Congress will take care of it.
No, this is Kazakhstan, not California. If citizens band up and demand something that the government is against, the police will crack down on their homes, arrest 15,000 people at random out of which only 10,000 or so will return to their homes (not necessarily alive), and the remaining 5,000 will rot in jail for high treason. And if they keep getting wise ideas, they'll send in the army.
Simple. Immediately implement certificate pinning so that rogue CA's can't be used to MitM their application traffic. That should have happened long ago for these apps anyway. This will break those apps and the government, in the face of everything breaking for their citizens might re-think their plan and at a minimum, turn of TLS middling for the impacted domains.
Google, Facebook, Yahoo, etc tried this in China and failed. It inconvenienced the people, but it's not going to cause a popular uprising. In the west, you forget that guns and the threat of raw violence by the government are a very real deterrent
Kazakhstan isn't going to produce a Baidu, but I'm sure Yandex and VK would be happy to fill a void and play along with their rules. And in the end, people just have less access to unfiltered news about the outside world. It's a losing plan.
And BlackBerry tried in Pakistan and "succeeded" - at least in delaying the shutdown of its servers by another month.
It's easier to do it in countries where "freedom" was the status quo and then the government decides to do something like that. China isn't exactly a free country to begin with, and the Great Firewall was older than Google in China.
Blackberry caved and gave the Saudi's and other gulf nation the ability to decrypt the traffic, as usual money plays a bigger role than morals.
Not that morals played anything in the decision to begin with BB calculated that it would cost them more to cave than to resist in terms of because it could sway existing customers to switch away from their platform, that was true for Pakistan but since Saudi Arabia and the Gulf states have money it wasn't true in that case.
And if you are implying that Kazakhstan was "free" to begin with that's utterly wrong, you are also wrong about China the "Great Firewall" didn't came online until 2003, and they still do not implement wide scale SSL MITM attacks (I've used Internet in China that wasn't a special line for foreigners or was routed through HK and many sites like wikipedia for example were blocked over HTTP but not over HTTPS).
That said fighting such activity by boycotting only aggravates the situation as you are doing even more harm to the people of the country, it's bad enough being monitored 24/7 but at least you have access to information and people from all over the world.
China is a large enough market that Chinese services (Baidu, Weibo, QQ, etc) can fill the gap. And there's many companies that did play ball (Microsoft).
Kazahstan could just use Baidu, but it's really best for Chinese speakers, and it would give leverage to China (which they might be leery of).
> The people of Kazakhstan can achieve the same outcome.
Highly unlikely.
From Wikipedia: In April 2015, Nazarbayev was re-elected with almost 98% of the vote.
That kind of tells the whole story - people are "behind" this (or rather no-one dares contradict the authorities). That country is basically owned by the Family and resistance is pretty much futile.
Given the highly volatile ethnic mix of Kazakhstan and the lurking destabilizing effect of foreign interests longing for abundant mineral resources, a strong majority for stability over freedom is hardly surprising. Nonetheless, 98% seems very much out of this world. But with the "right" mix of fearmongering and early divide-and-conquer intervention when a moderate opposition ist starting to organize? Certainly not unthinkable. There's so much more to a healthy democracy than not miscounting the votes.
I agree a hundred percent.
People from stable democracies tends to underestimate how afraid people can be of chaos and how easy it is for some goverment to associate democracy with chaos.
When a moderate opposition starts to organize, a non-moderate one (or one that takes advantage of ethnic fault lines) does too.
Kazakhstan is not the US. We are highly unlikely to see a public uprising in Kazakhstan over this when the country has had the same president since 1991 and rubber-stamp parliament. Protests in 2011 were quelled by gunning down protestors (see below).
Nazarbayev, re-elected in a barely contested election to a fifth term on Sunday, was born to a peasant family. He trained as an engineer before rising through the ranks of the Kazakh Communist Party to head it in 1989 and was elected president on the eve of the Soviet breakup in 1991.
Since then, his power has become absolute, with resounding, but internationally criticised election victories in 1999, 2005 and 2011. There is no obvious succession plan in place and there are no clear alternatives to Nazarbayev's rule...
In 2011, however, a pay dispute in the oil sector turned violent with government troops shooting dead 15 protesters and injuring over a hundred
There was no public uprising after Snowden in the US either ... Some will now say you can't compare this. They are right because what Kazakhstan is doing there looks amateurish.
For a while, I've been in the camp that the Snowden leaks were intentional and that he still works for the US. A rich work from home government contractor, with a smoking hot girlfriend, takes off with secrets and hides in Russia. His hot girlfriend is even allowed to join him.
I think it's more likely the Snowden leaks were to show just how little Americans care. They're using that spy network to track reactions.
It's unlikely that the Kazakh government would be able to do that much with it.
Kazakhstan has a population of about 18M and internet penetration of about 35% if they would really want to sift through all that traffic they are more than welcome to do so, just keep in mind that even the US would probably not be able to do so with any degree of effectiveness.
The only thing that Google et al. could do is refuse to provide service to Kazakhstan which would only harm the people even more, if you are a dissident you are already taking a huge risk denying people the ability to access information and to connect with others won't help to reduce that risk just only make it worse as it would only isolate them further.
China is doing the same, so do many Gulf nations to some extent or another, no one is arguing that we should not cooperate with China, cooperation is the only real way to effect change in those nations in the first place, or would you think China would be as open as it is today if we would have a technical and cultural embargo over it?
Western companies sell them hardware and software to process the traffic that they Capture. Cisco, et.al is complicit in this work, including the firewall itself.
No, that would simply make kazakhs unable to connect to that service; with the proposed solution SSL traffic that for whatever reasons couldn't be MITM'ed simply wouldn't work at all.
Not necessarily, it just means that Kazakh citizens will have a root cert installed on their machine that will allow the government to MITM their https connections. The connection between the MITM and the client will be encrypted (just with the government-controlled cert instead of the server's cert), and the MITM will have an encrypted connection to the server. I suppose it is possible that the MITM could make an unencrypted connection to the server, but I don't know a good reason for the government to do that.
Why can't Internet companies simply block the entire backward country? I can't imagine Borat's motherland traffic monitizes well anyway. You want to MITM? Fine, build your own Kazakh Google.
That would actually be a huge win for Kazakhstan. Much like China pushing people to use Baidu and other state friendly services instead of Western owned services.
377 comments
[ 3.9 ms ] story [ 481 ms ] threadHow is this protecting users? They are outright lying here, if I understand correctly. Also why are they asking for my location?
http://i.imgur.com/fYKHRK1.png
The city it resolves to is where my isp has their HQ.
However, there is a different kind of GeoIP that has the potential to be much more specific as to the location, based on a join between Internet traffic and transactions that target a specific location. e.g. when you purchase a physical item from an online vendor, with your house as the delivery address, they now have both your IP and location. Obviously for this to work it depends on a) the IP address remaining the same for some period of time and b) sharing of the necessary information to allow the join. afaik both are often true.
Seems Comcast maps IP (which they issue) to postal address to exact Geo coordinate.
I am sure the NSA does better but Kazakhstan? I have been inside one of their embassies to be shocked that they were watching the news on a black and white CRT TV!!!
http://www.geoip.co.uk/?IP=188.29.165.147&send=LOOK+UP
If you are connecting via a mobile phone the address is likely to be registered as at one of the phone company's locations which could potentially be in a different state. For many home/office serving ISPs this is similar. Also, if you are using a VPN of some sort the address you present to the web server is quite disconnected from your physical location.
If on the other hand they request your location via your web access client and you agree, it will be using localisation APIs that may well know your location with some precision: using GPS if your device has it and has it turned on, or via wireless AP availability based lookups otherwise.
Its protecting users from getting visits from Kazakhstan's security services for covertly communicated with foreign entities. That is, presuming that the content of their traffic isn't unwelcome by the security services, since otherwise, even with the use of the MitM certificate, they'll still get visits.
But obviously the security as a whole has to consider the increased risk due to the centralized cert, disregarding entirely the fact that you're trusting a totalitarian government with all of your secrets...
If a nation-state with the resources of China has come up with a system that can still be (albeit nontrivially) bypassed then I would imagine Kazakhstan will have a much-less-sophisticated first iteration.
[1] https://github.com/apenwarr/sshuttle/
[1] https://www.usenix.org/system/files/conference/usenixsecurit...
[2] https://www.torproject.org/projects/obfsproxy-instructions.h...
NOPE
Sure, it's going to be difficult to enforce, but it should also be quite cheap.
I guess it's just a matter of dropping every connection that you can't MITM, no?
[1] https://bto.bluecoat.com/webguides/proxysg/security_first_st...
Only way to avoid is to use some kind of foreign satellite internet or maybe private / non government / non telco dark fibre.
Or you can use non-standard ports, and change them continuously.
For email, you'd encrypt data to have it look like regular prose. So you'd only get a few bits per English word, but that would be sufficient for short messages. Could also make use of extra spaces in between words.
The real trick with that would be to take an existing document, and alter it to encode a message. So you'd be doing things like using synonym choice to get your bits.
This realistically shouldn't be too hard to do with obfsproxy's already-built framework.
s/cat pictures/whatever you want/
Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS
* Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938
Imagine if China sent saboteurs in-country to physically destroy infrastructure being used by American businesses. That would Not Be Taken Lightly.
The root certificate thing is 'merely' a violation of the rights of their own subjects.
I really don't understand relationships between States.
https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat
Of course, I'd be interested to see how those assets were set up in the first place - my bet would be during a non-rights-respecting period of colonialism.
How far back do you go? (Serious question).
As for nationalisation is certainly a violation of rights do you hold that all eminent domain is a violation of rights? IE if the government wants to build a road and uses compulsory purchase orders it's a violation of rights?
https://en.wikipedia.org/wiki/Realpolitik
What does the GitHub DDOS have to do with MITM attacks on https?
To clear it up, I said that GFW "can" do (but has not yet done) these. But it tried to MITM some https traffic earlier with a non-trusted certificate as an experiment.
I guess "coded" here means VPN as well...
Wonder how other countries' embassies will be connecting if they block all the encrypted connections? Everything through a satellite connection presumably.
Or just getting official exceptions.
Obviously, a lot of people do this kind of thing in China, and from what we know, circumventing the "Great Firewall" isn't routinely getting people killed. But people should know what they're doing before they try it in Kazakhstan.
Porn? Perhaps the world's smut peddlers will become beacons of freedom and civil disobedience? (Sounds like a Neal Stephenson book.)
The worst thing — they just ban sites without any explanation. Site just stopped to work and you don't know why. Even w3.org was banned for some time (probably because its validator could be used as web proxy).
This is the biggest problem when governments go this route.
Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?
It's also well within Kazakhstan's budget to do subtler, harder-to-defeat things to stop MITM circumvention. This is an arms race that Google will lose.
Other non-windows updates do allow you to install other software.
To set this up, Kazakhstan will have to set up their CA with the bit set for software signing. This bit will be visible by everyone and it'll be very telling instead of just being allowed as a root CA for ssl/https sites.
Not everything can be changed from the beautiful plains of Silicon Valley.
http://techblog.netflix.com/2014/10/message-security-layer-m...
https://github.com/Netflix/msl
EDIT: or do you mean to replace "all" (content + js)?
Until they figure it out and start blocking that too of course.
And it's not very detectible because they do it all the time.
I own Anno 2070 (as can be seen on my steam profile), but can only play with RELOADED crack under wine because UPlay refuses to run.
Same with this type of encryption: Kazahstan can easily defeat it, but it makes it harder for people trying to debug why they can’t use Netflix (for example, in case that Kazahstan MitM's everything, and encrypts with a different certificate than your Netflix client is using).
One catch: remember that the browser itself absolutely should not be the installed program doing the end-to-end encryption, where bugs can allow the private keys to be leaked. Important data like the private keys shouldn't even be in the same address space. See gpg-agent/ssh-agent as an examples of how to keep sensitive data in a separate process.
That's one of the things that makes securing browser JS crypto so intractable.
If it's an additional source being added much later on that you are concerned with, that's always been a broken design that Douglas Crockford warned[1] about years ago.
[1] https://www.youtube.com/watch?v=V13wmj88Zx8
A web-socket based protocol that opens up a new SSL session with non-MITM'd certificates.
So you'd open up the snoop-me HTTPS/1.1 connection, do some GETs, then say "GET /busy, yo", and start what looks like a video-chat conversation that is in fact a regular SSL connection with uncompromised certs.
(some protocol) over SSL over Web-Socket over bad-SSL over TCP/IP
Ultimately, though it will be very hard to accept, crypto may be on the way out as a technology with any political impact. Governments currently accept the rapid increase in SSL because none of the politicians or regulators understand that it's possible to disable it at a country level, and nobody with any technical clue has been willing to point it out to them. But that situation isn't sustainable, as the Kazakh example shows. A sufficiently determined government won't care about minor details like user convenience. They'll just say "you either install our root cert, or you don't get to use the internet" and that's it. Game over. If even just one western country does it, the rest will all follow within a few years.
That said, there's a remarkable tendency in countries as corrupt as Kazakhstan for a "shadow" telecom network to pop up. Just run in some fiber from a neighboring country on the down-low and distribute locally via microwave dish. Yeah, it's not exactly difficult to locate a powerful dish, but it's also not glaringly obvious so you can usually pay someone to look the other way. After all, the government officials want to look into everyone's communication, but if their own communication was ever intercepted, they would be the target of blackmail! They want to use the information they gather to blackmail citizens like the Stasi, not the other way around.
Of course, the flip side of that are the mobile phone networks operated by the Mexican drug cartels and ISIS. But the only surefire way to avoid government surveillance of this sort is to bypass government regulated telecoms entirely.
The other neighbours are shining beacons of democracy such as Russia, China and Uzbekistan...
"The strictness of Russian laws is compensated by their optional enforcement", as they say.
In a smaller country like Kazakhstan such things are easier to enforce, probably.
Everything is breakable, but some things take a really looong time to break. Governments might be able to break some weak https encryption, but not all.
At a basic level, yes, any CA can issue a certificate which can be used to launch a MITM attack. We trust that the CAs don't do this. If they're caught, the browser industry tends to revoke their CA status -- which is pretty bad for the CA's business model.
That said, the CAs have been under increased scrutiny lately, and browsers are starting to build additional protections against this kind of thing:
- Certificate pinning (HPKP) allows sites to restrict which certificates can be used for a specific host, even if the certificate is signed by a trusted system root. (Caveat: HPKP isn't enforced for local roots, installed by an admin. That's how Kazakhstan is able to get away with this, because they're asking users to install a new root manually.)
- Certificate Transparency is supposed to provide an audit log for CAs, so that any maliciously issued certificates can be detected and acted on.
That said, these features are new and not universally supported by all browsers. And neither would help in a case like Kazakhstan, where users are being asked to bypass security features and there's no system root to revoke.
What makes me kinda angry is however where this originates from: There are countless so-called "IT security" products that had this idea of MitM-ing all traffic before. Basically it's just the same idea on a bigger level.
The government might be doing what they think is right, but public backlash can change policy almost overnight. We saw this in the US recently with SOPA/PIPA. The "Internet" response was unprecedented.
The people of Kazakhstan can achieve the same outcome.
As to what they can do... it's a range from info to painful, but they can choose a range of options from serving up interstitials in a localized language that explains the issues, problems, and privacy and security implications... all the way to deny service.
If the citizens demand access to those services, or find it offensive that their privacy and security is being violated and circumvented, they will take action.
And these companies can help orchestrate, just as we did with SOPA/PIPA.
Hah, right. They'll just file a complaint to their ombudsman and the Congress will take care of it.
No, this is Kazakhstan, not California. If citizens band up and demand something that the government is against, the police will crack down on their homes, arrest 15,000 people at random out of which only 10,000 or so will return to their homes (not necessarily alive), and the remaining 5,000 will rot in jail for high treason. And if they keep getting wise ideas, they'll send in the army.
Kazakhstan isn't going to produce a Baidu, but I'm sure Yandex and VK would be happy to fill a void and play along with their rules. And in the end, people just have less access to unfiltered news about the outside world. It's a losing plan.
It's easier to do it in countries where "freedom" was the status quo and then the government decides to do something like that. China isn't exactly a free country to begin with, and the Great Firewall was older than Google in China.
Kazahstan could just use Baidu, but it's really best for Chinese speakers, and it would give leverage to China (which they might be leery of).
Highly unlikely. From Wikipedia: In April 2015, Nazarbayev was re-elected with almost 98% of the vote.
That kind of tells the whole story - people are "behind" this (or rather no-one dares contradict the authorities). That country is basically owned by the Family and resistance is pretty much futile.
I agree a hundred percent. People from stable democracies tends to underestimate how afraid people can be of chaos and how easy it is for some goverment to associate democracy with chaos.
When a moderate opposition starts to organize, a non-moderate one (or one that takes advantage of ethnic fault lines) does too.
Nazarbayev, re-elected in a barely contested election to a fifth term on Sunday, was born to a peasant family. He trained as an engineer before rising through the ranks of the Kazakh Communist Party to head it in 1989 and was elected president on the eve of the Soviet breakup in 1991.
Since then, his power has become absolute, with resounding, but internationally criticised election victories in 1999, 2005 and 2011. There is no obvious succession plan in place and there are no clear alternatives to Nazarbayev's rule...
In 2011, however, a pay dispute in the oil sector turned violent with government troops shooting dead 15 protesters and injuring over a hundred
[source:] http://news.yahoo.com/nazarbayev-kazakhstans-moderniser-auth...
I think it's more likely the Snowden leaks were to show just how little Americans care. They're using that spy network to track reactions.
The only thing that Google et al. could do is refuse to provide service to Kazakhstan which would only harm the people even more, if you are a dissident you are already taking a huge risk denying people the ability to access information and to connect with others won't help to reduce that risk just only make it worse as it would only isolate them further.
China is doing the same, so do many Gulf nations to some extent or another, no one is arguing that we should not cooperate with China, cooperation is the only real way to effect change in those nations in the first place, or would you think China would be as open as it is today if we would have a technical and cultural embargo over it?