Evidence shows CNNIC and CAC behind MITM attacks
Since 2013, we have repeatedly called on major software vendors to revoke CNNIC-issued certificates. Most notably, we raised this issue when we reported on the Cyberspace Administration of China’s (CAC) man-in-the-middle (MITM) attacks on Google, Microsoft’s Outlook, Apple, Yahoo and Github. Mainstream media have reported about these security vulnerabilities before and on March 24, Ars Technica reported on Google’s announcement that they have definitive evidence that CNNIC (China Internet Network Information Center) was behind a new MITM attack on Google.
From our October, 2014 blog post:
CNNIC has implemented (and tried to mask) internet censorship, produced malware and has very bad security practices. Tech-savvy users in China have been protesting the inclusion of CNNIC as a trusted certificate authority for years. In January 2013, after Github was attacked in China, we publicly called for the the revocation of the trust certificate for CNNIC. In light of the recent spate of man-in-the-middle (MITM) attacks in China, and in an effort to protect user privacy not just in China but everywhere, we again call for revocation of CNNIC Certificate Authority.
CNNIC is either complicit in the recent MITM attacks or has intentionally allowed these attacks to happen. We have been witness to the Chinese authorities using MITM attacks against Apple’s iCloud, Google, Microsoft’s Outlook and Yahoo in this month alone.
CNNIC is responsible for the “operation, administration and service organization of national network fundamental resources”. We have evidence that the recent attacks originated from the Chinese internet backbone. Attacks against Yahoo and Google have been implemented on the internet backbone for weeks.
Today we have concrete proof from Google that CNNIC (and by extension CAC) is indeed complicit in MITM attacks. Google states in its own blog post:
On Friday, March 20th, we became aware of unauthorized digital certificates for several Google domains. The certificates were issued by an intermediate certificate authority apparently held by a company called MCS Holdings. This intermediate certificate was issued by CNNIC.
CNNIC is included in all major root stores and so the misissued certificates would be trusted by almost all browsers and operating systems. Chrome on Windows, OS X, and Linux, ChromeOS, and Firefox 33 and greater would have rejected these certificates because of public-key pinning, although misissued certificates for other sites likely exist.
We are delighted that Google, Microsoft and Mozilla have taken steps to blacklist the intermediate certificate used in the attack. The Ars Technica story provides more details about Mozilla’s statement. Apple has not made a public statement about this issue. However, more action is needed. CNNIC is still trusted by these platforms and the Chinese authority can sign other intermediate certificates in order to launch future MITM attacks. We once again call for Google, Mozilla, Microsoft and Apple to revoke trust for CNNIC immediately in order to protect Chinese user data and user data worldwide.