China Telecom's Internet Traffic Misdirection

[resters]

Combine this with exploits into one or more broadly trusted certificate authorities (which surely exist) and it's pretty amazing how much data China would have been able to obtain.

Every time I bring up the following point someone chimes in that it's a bad idea, but I still fail to understand why it's not easy to pick which CAs I want to trust by picking a list of entities/people I trust and then adopting their recommendations for which CAs to trust.

This would be a few clicks of UI to let me be intelligently paranoid while maintaining only a layperson's understanding of why (say) Bruce Schneier decides to trust some and not others.

[unethical_ban]

This should absolutely be exposed in browser UIs, esp Firefox which uses its own store. Why can I not easily select/deselect all, sort by country of origin, issuer, plain text search filters, and so on? The ability to click-through, or even to simply display the "insecure" badge, would still be there.

Or, as you said, being able to subscribe to other recommendations would be cool.

[jopsen]

I personally think certificate transparency and Expect-Ct headers will do far more to detect China-in-the-middle.

Nothing is more embarrassing than getting caught with your fingers in the cookie jar.

Besides I trust CAs will be de-listed if proven compromised.

[maltalex]

> Combine this with exploits into one or more broadly trusted certificate authorities (which surely exist) and it's pretty amazing how much data China would have been able to obtain.

The attacker doesn't even need to compromise a CA.

If someone hijacks the IP address of example.com, he could easily get a valid Let's Encrypt certificate for that domain.

[tinus_hn]

The party you want to connect to chooses the CA, not you. Are you really not going to use YouTube because you don’t trust the Google CA?

Anyway, redirecting and sniffing traffic is one thing, intercepting and changing encrypted traffic while being undetected is another. It’s quite a stretch really.

[gcb0]

because tomorrow your bank starts to only have a cert from some CA you didn't trust before.

having to manually select/add CAs is akin to not having ssl and using pgp everywhere. and you know how well that works out even for technical folks.

[raquo]

I understand the sentiment, but somehow I feel that more people will trust Alex Jones on this than Bruce Schneier.

Actual experts aren't respected by the general population enough for this to be a net positive change is my guess.

[aaaaaaaaaab]

That’s basically PGP.

[cwkoss]

Distributed trust and vouching systems are going to be the next big thing.

[freeflight]

Sounds a bit like how ad-block plus handles the blocking based on lists to which you subscribe, just with certificate white/blacklists?

[commandlinefan]

I'm continually amazed at how insecure almost every aspect of internet routing is - it mostly boils down to a sort of "gentlemen's agreement" that everybody will follow the rules.

[StudentStuff]

Such is the nature of BGP. Something like SPF (eg: an authorized AS list for an IP block) and DMARC (reporting about who tried to broadcast what IP block and was rejected) would be great, perhaps even have the latter component convey attack info so ISPs could deal with infected clients automatically.

Basic security mechanisms when it comes to large ISP networks are a pipe dream though, instead we get vendors pushing extremely vulnerable Juniper gear cause its reasonably priced, meanwhile these boxes have new root exploits found multiple times a year. None of the vendors give a crap about security, Cisco pays it some lip service (to win gov't contracts) but charges a premium for basic features.

[toomuchtodo]

Internet routing (BGP), SMTP, and DNS (not inclusive, just off the top of my head) were developed during the very beginnings of the internet, without much thought into today's use and scale.

Today you'd do better, with hindsight being 20/20.

[jgrahamc]

And that agreement is trying to be enforced using PKI: https://blog.cloudflare.com/rpki/

[magicbuzz]

And state actors are proving themselves to not be gentlemen at all.

[cm2187]

A "gentlemen's agreement" that was designed to sustain a nuclear strike...

[e40]

I'd like to point out that government used to run by agreements that were like that, and look what has happened in that domain. I say this as a warning what the internet could become.

[cauldron]

CT and Chinese ISPs have been hijacking user traffic for decades, profiting off of it by selling traffic dump to data exploiting companies, insert ads in webpages, steal social media tokens (for follower boosting and ads retweeting).

I've found China Unicom openly hawking their data mining products. https://imgur.com/a/uNxA50K

[hrrsn]

Have you got a translated version of that screenshot?

[burtonator2011]

This is one of the reasons TLS/SSL and crypto is so amazingly important.

Go ahead, monkey around with BGP, since I have the public key of the recipient of my packets I can detect this and block any type of misdirection.

[maltalex]

> Go ahead, monkey around with BGP, since I have the public key of the recipient of my packets I can detect this and block any type of misdirection.

And how did you get that public key?

An attacker could pretty easily obtain a valid Let's Encrypt certificate using a BGP hijack.

Also, the CA system is in bad shape - CAs have been hacked and certificates were leaked. Not to mention that some of the CAs your browser trusts are not entirely trustworthy or are located in untrustworthy countries. Oh, and from time to time there are attacks against TLS itself (e.g. https://drownattack.com/)

[martinald]

Somewhat offtopic but which tool shows you the AS number + info alongside the traceroute in the screenshot?

[jwbensley]

I would guess that the author copied the results into a table and prettified them and added in details like location.

At the top of the screenshot it says "traceroute from London to ..." - no traceroute program knows where it is in the world!

Also the locations of each hop in traceroute NY > Chicago > Ashburn etc., no traceroute program will know where in the world those IPs are. I suspect the author has guestimated based on the reverse DNS record for the IPs and latency.

Traceroute does have the ability to show you the ASNs in a path but that is based on a WHOIS lookup of the IPs that it's discovering. So it could be wrong by assuming the IP address of each hop was announce by the ASN that owns it.

[mirimir]

OK, so I'm sitting here, posting to HN in Firefox. And if I like, I can open a terminal and run something like:

    traceroute news.ycombinator.com | grep -f chinese-ipv4 -f chinese-hosts

And indeed, there could be a Firefox extension that did that, right? So at least, users would know.

[mehrdadn]

Tangent, but are traceroutes spoofable (barring timing differences), or would they break too many other things to be practical? I'm wondering if anyone might do that to hide their tracks.

[nrki]

Yes. You can set your reverse DNS to whatever you want if you own the IP blocks.

See also: https://news.ycombinator.com/item?id=5192656

[localguy]

"Loading..." the page doesn't work without JavaScript enabled for no reason.

[cronix]

Other links: https://dyn.com/blog/china-telecoms-internet-traffic-misdire...

http://www.circleid.com/posts/20181105_china_telecom_accused...

[DevoidSimo]

It's using ajax to fetch the actual article. Seems a bit strange since it's static

[walrus01]

If BGP4 were designed today, it would look very different.

[zozbot123]

How about just globally blocking AS4134 and AS9318?

[baybal2]

You will be surprised how many companies already doing so

[furkitolki]

According to traceroute, I wonder what makes United States safe and China not. Both not safe.

[ggm]

Hanlon's razor has been raised on NANOG.

[jmartrican]

This is so stupid that we keep doing business with the Communist Party of China.

[consumer451]

I just don’t understand why the telecom agreements are not reciprocal. If no foreign nation is allowed to put a POP in China, then why is China allowed to put POP’s all around the world?

[olliej]

Or the government of Australia which has laws allowing similar...

[StudentStuff]

Its not as though our domestic technology vendors care about security. JunOS is constantly having new vulnerabilities found, and Cisco ain't much better, but charges a premium price as they are viewed as the market leader and pay some lip service to security.

[gcb0]

lol. typical anachronistic oracle. their blog fails fail to render on 2 out of 3 browsers I tested. What is this? 1995?

[praneshp]

Can I ask what browsers? If you've disabled Javascript, I'd argue that's the anachronism.