Outlook grim - Chinese authorities attack Microsoft

On January 17, we received reports that Microsoft’s email system, Outlook (which was merged with Hotmail in 2013), was subjected to a man-in-the-middle (MITM) attack in China.

The following screenshot shows what happens when a Chinese user accesses Outlook via an email client (in this case, Ice-dove):

We have tested Outlook to verify the attack and have produced the same results. IMAP and SMTP for Outlook were under a MITM attack. Do note however that the web interfaces (https://outlook.com and https://login.live.com/ ) were not affected. The attack lasted for about a day and has now ceased.

This form of attack is especially devious because the warning messages users receive from their email clients are much less noticeable than the warning messages delivered to modern browsers (see screenshot at the end of this post for comparison).

(Sample error message from default iPhone mail client)

In addition, email clients normally run in the background. Users will only see an abrupt pop-up warning when the client tries to automatically retrieve messages. Users will then be able to tap on a “continue” button and ignore the warning message. As the user did not initiate the retrieval of emails, most users will not think twice about clicking on “continue” and will likely attribute the warning message to a network problem. If users do click on the “continue” button, then all of their emails, contacts and passwords will be logged by the attackers.

This attack comes within a month of the complete blocking of Gmail (which is still entirely inaccessible). Because of the similarity between this attack and previous, recent MITM attacks in China (on Google, Yahoo and Apple), we once again suspect that Lu Wei and the Cyberspace Administration of China have orchestrated this attack or have willingly allowed the attack to happen. If our accusation is correct, this new attack signals that the Chinese authorities are intent on further cracking down on communication methods that they cannot readily monitor.

This new MITM attack comes three months after the iCloud MITM attack, which was widely reported in the media and which prompted Apple’s CEO Tim Cook to fly to China to raise the matter directly with the Chinese authorities. The Chinese foreign press spokesperson denied the “hacking” allegation and Apple has not made any public statements addressing the outcome of the discussions. However Apple did add a Chinese language help page (and an English one) which addresses similar issues. Apple refers to episodes of this nature as “organized network attacks”.

At the time of the iCloud attack, Google (over CERNET) and Yahoo were both experiencing MITM attacks and Outlook (web portal only) was under a MITM attack for a short period of time. Since the wide reporting of these attacks, GFW had not attempted any large scale attacks until this one. The authorities are most likely continuing to test their MITM technology. The authorities may also be gauging user response. By keeping track of how many users ignore the certificate warnings, the authorities will be able to determine the effectiveness of this type of attack.

We strongly recommend that users never bypass certificate error messages by clicking “continue”.

Call to Action

We suspect that the Cyberspace Administration of China, which is directly in charge of censorship and GFW, is directly responsible for the MITM attack against Outlook, and the recent related MITM attacks in China. CNNIC (China Internet Network Information Center) is directly governed by the Cyberspace Administration of China and should not be trusted as a certificate authority by major software vendors.

We have outlined CNNIC's dubious history in a previous blog post. Given the dangerous nature of this attack on Outlook, we again strongly encourage organizations, including Microsoft and Apple, to immediately revoke trust for the CNNIC certificate authority.

What are certificates used for?

Certificates are used primarily to verify the identity of a person or device, authenticate a service, or encrypt files.

What is a certification authority (CA)?  

Certification authorities are the organizations that issue certificates. They establish and verify the authenticity of public keys that belong to people or other certification authorities, and they verify the identity of a person or organization that asks for a certificate.

Technical Details

IMAP/SMTP are commonly used on mobile email clients (e.g the default mail application on iPhones) and desktop email clients like Thunderbird. Internet Message Access Protocol (IMAP) is a protocol which allows users to connect to the same mailbox through multiple devices (i.e. your desktop, mobile, etc.). Simple Mail Transfer Protocol (SMTP) is typically used by users to send messages to a server which are then relayed to the recipient.

Wikipedia defines a man-in-the-middle (MITM) attack in the following way:

The man-in-the-middle attack...is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.

Tests

To reproduce the result in a Firefox browser, we first configured Firefox to allow access on port 993 which is the port used by IMAP. We then accessed https://imap-mail.outlook.com:993. We immediately received the warning message. As you can see, the certificate is self-signed, which is consistent with previous MITM attacks in China.

  outlook-MITM.png

The certificate error message shown in Chrome. Chrome was configured to allow connections via port 993.

The fake certificate used in the attack:

https://github.com/chengr28/RevokeChinaCerts/blob/master/Windows/Certs/[Fake]AnyHotmailCom_201501.crt

WireCapture:

https://www.cloudshark.org/captures/8bf76336e67d

Reports:

https://www.v2ex.com/t/163062 and https://www.v2ex.com/t/163018.

 

Comments

More Blog Posts

Subscribe to our mailing list
Show content from Blog | Google+ | Twitter | All. Subscribe to our blog using RSS.

Mon, Jun 10, 2019

Apple Censoring Tibetan Information in China

Apple has a long history of censorship when it comes to information about Tibet. In 2009, it was revealed that several apps related to the Dalai Lama were not available in the China App Store. The developers of these apps were not notified that their apps were removed. When confronted with these instances of censorship, an Apple spokesperson simply said that the company “continues to comply with local laws”.

In December, 2017, at a conference in China, when asked about working with the Chinese authorities to censor the Apple App Store, Tim Cook proclaimed:

"Your choice is: do you participate, or do you stand on the sideline and yell at how things should be. And my own view very strongly is you show up and you participate, you get in the arena because nothing ever changes from the sideline."

In the ten years since Apple was first criticized for working with the Chinese authorities to silence already marginalized voices, what has changed? Apple continues to strictly follow the censorship orders of the Chinese authorities. When does Tim Cook expect that his company will help to bring about positive change in China?

Based on data generated from https://applecensorship.com, Apple has now censored 29 popular Tibetan mobile applications in the China App Store. Tibetan-themed apps dealing with news, religious study, tourism, and even games are being censored by Apple. A full list of the censored apps appear below.

Thu, Jun 06, 2019

Report Shines Spotlight on Apple’s Censorship Practices in China

The newest Ranking Digital Rights Corporate Accountability Index makes recommendations on what companies and governments need to do in order to improve the protection of internet users’ human rights around the world. Ranking Digital Rights (RDR) works to promote freedom of expression and privacy on the internet by creating global standards and incentives for companies to respect and protect users’ rights.

In their 2019 Accountability Index, RDR looks at the policies of 24 of the world’s most important internet companies in respect to freedom of expression and privacy and highlights the companies that have made improvements and those companies that need to do more. RDR notes that:

Insufficient transparency makes it easier for private parties, governments, and companies themselves to abuse their power over online speech and avoid accountability.

In particular, the report highlights how Apple has abused their power over online speech, and notes instances of this in China. According to the report, Apple has not disclosed data around the content that it removes from its App Store when faced with requests from the government authorities.

While [Apple] disclosed data about government requests to restrict accounts, it disclosed no data about content removal requests, such as requests to remove apps from its App Store. Apple revealed little about policies and practices affecting freedom of expression, scoring below all other U.S. companies in this category.

The report makes intelligent and sensible recommendations for governments. However, the recommendations also highlight how difficult it is to have these discussions with governments like China’s.

Thu, Nov 30, 2017

About those 674 apps that Apple censored in China

Apple opened the door on its censorship practices in China - but just a crack.

Tue, May 23, 2017

Is China establishing cyber sovereignty in the United States?

Last week Twitter came under attack from a DDoS attack orchestrated by the Chinese authorities. While such attacks are not uncommon for websites like Twitter, this one proved unusual. While the Chinese authorities use the Great Firewall to block harmful content from reaching its citizens, it now uses DDoS attacks to take down content that appears on websites beyond its borders. For the Chinese authorities, it is not simply good enough to “protect” the interests of Chinese citizens at home - in their view of cyber sovereignty, any content that might harm China’s interests must be removed, regardless of where the website is located.

And so last week the Chinese authorities determined that Twitter was the target. In particular, the authorities targeted the Twitter account for Guo Wengui (https://twitter.com/KwokMiles), the rebel billionaire who is slowly leaking information about corrupt Chinese government officials via his Twitter account and through his YouTube videos. Guo appeared to ramp up his whistle-blowing efforts last week and the Chinese authorities, in turn, ramped up theirs.

via https://twitter.com/KwokMiles/status/863689935798374401

Mon, Dec 12, 2016

China is the obstacle to Google’s plan to end internet censorship

It’s been three years since Eric Schmidt proclaimed that Google would chart a course to ending online censorship within ten years. Now is a great time to check on Google’s progress, reassess the landscape, benchmark Google’s efforts against others who share the same goal, postulate on the China strategy and offer suggestions on how they might effectively move forward.

flowers on google china plaque

Flowers left outside Google China’s headquarters after its announcement it might leave the country in 2010. Photo: Wikicommons.

What has Google accomplished since November 2013?

The first thing they have accomplished is an entire rebranding of both Google (now Alphabet) and Google Ideas (now Jigsaw). Throughout this blog post, reference is made to both new and old company names.

Google has started to develop two main tools which they believe can help in the fight against censorship. Jigsaw’s DDoS protection service, Project Shield, is effectively preventing censorship-inspired DDoS attacks and recently helped to repel an attack on Brian Krebs’ blog. The service is similar to other anti-DDoS services developed by internet freedom champions and for-profit services like Cloudflare.

Subscribe to our blog using RSS.

Comments

Removing CNNIC root isn't practical, as it prevents the company from selling devices in China. Please make more practical recommendations. For example, only accept CNNIC-signed certificates for .CN domains. That would allow CNNIC to continue to exercise control over Chinese domains without jeopardizing the security of the entire Internet. (This is basically "TLD pinning" for root CAs.)

 Romantic Getaways: You can also plan a romantic holiday with
your loved one. It is really nice to see all these valentine's
day gift ideas for dogs, cause you two will be hollering with
love don't you know. This need not always be romantic love but any love.

Review my site: Propose Day SMS

After Daytona Beach Police Detectives finished their investigation of the incident, the scene was turned over to a site manager for Clean
Fuels National, who police emphasized was not at the
scene when the incident happened. It has emerged as one of the
best weekend destinations especially for families.
The last four or five years there's been more of a mix of INDYCAR drivers going over, which
is good for both series.

Also visit my web site ... daytona 500 live streaming

this post is awesome, great msg for us, plz update ur blog for daily basis, i am regular visitor of this site, so keep posting for us,

click the below links to create backlink
best free backlink website
click here for msg movie

thanks for this post, keep it up for updating us, i am waiting for ur new article.

thanks again
IPL8 live stream 2015

It’s certainly fresh to writing and seeing concepts which are truly helpful to get the direction

mothers day quotes
happy mothers day qutes 2015
happy mothers day 2015

Nice post to share
http://listacademyanik.com/

Nice post to share.
CLICK HERE>>
http://www.100kfactoryultraeditionreview.com/

----------------------------------------
There many errors that can hurt your PPC project without you even understanding it. For this factor, I wish to present to you the leading 5 factors your Pay Per Click project suffers online. look at part 1 of this article
----------------------------------------
CHECKOUT>>www.100kfactoryultraeditionreview.com

--------------------------------------------------------------------------------
http://listacademyanik.com/
============================================

Hey,

"Good website! I really love how it is easy on my eyes and the data are well written. I am wondering how I could be notified when a new post has been made. I have subscribed to your RSS feed which must do the trick! Have a nice day!"

======================
CLICK HERE>>http://listacademyanik.com/

======================

Hey ,
I would like to thank you for the efforts you have put in writing this website. I'm hoping the same high-grade web site post from you in the upcoming also. In fact your creative writing abilities has inspired me to get my own web site now. Actually the blogging is spreading its wings rapidly.

http://listacademyanik.com/dna-wealth-blueprint-3-0-review-bonus

good Study how to setup Kodi earlier known as noted as XBMC Kodi Download Linux, iOS, Windows, and Android. Moreover, Kodi App Android nice.

good The formal webpage of Droid4x packages a tiny method data file on Droid4x your laptop when you struck the ‘download&' button. nice.

good cannot send or receive messages or pictures utilizing it. snapchat sign in file from its web site and also run the installer as well as nice.

Download caller name announcer from callernameannouncer.uniqsofts.com to read al incoming notifications.

Thanks mate for share this nice post
obat pembesar penis klg: http://obatfrigid.com/obat-klg.html

Playstore in our android devices since long. Though Playstore is fairly aptoide apk you uninstall the app, simply click the apk once again and install

Game Guardian is an amazing game hack/alteration tool. Game guardian helps you modify money, HP, Sp and more aspects of the game.
game guardian apk

I definitely enjoyed every bit of it and I have you bookmarked to see new information on your blog.
my boy

A festival is an event ordinarily celebrated by a community and centering on some characteristic aspect of that community and its religion or traditions. It is often marked as a local or national holiday, mela, or eid.

http://festival-status.wallinside.com

For a lot of us looking to establish an online store, 'e-commerce' is where it all begins. When you find this phrase in articles and testimonials - it simply refers to the buying and selling of products on the internet.
To Get More Info>> https://www.7figurecyclereviewbonus.com/ << VISIT HERE

After reading the article I updated my knowledge regarding the same.
It really helped me a lot.
Thanks for sharing this with us.

https://www.kickstarter.com/profile/netgearsupport/about

At this rate, shouldn't China create their own operating system like what North Korea did? Everything is banned, it's so annoying for tourists. Thank you for sharing the news! I want to visit China some day but with this policy, I can't receive email from work when traveling, it's very hard for me.
https://htmlcolor-codes.com/

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
By submitting this form, you accept the Mollom privacy policy.