China Telecom diverted internet traffic in U.S. and Canada, report finds
theglobeandmail.com
theglobeandmail.com
https://www.schneier.com/blog/archives/2018/10/chinas_hackin...
People need to get serious about protecting the privacy of their communications and data. Nobody cares until it is too late. Seems like this kind of event might be the incentive people need to make the extra effort to use products that encrypt their data in rest and in motion.
1: https://www.afr.com/technology/web/security/how-chinese-hack...
BGP, SSL, and DNS, create an atmosphere ripe for hijack, MITM and other nefarious activity, and it happens ALL THE TIME.
In other words, the very system “designed to provide trust” actually is also designed to allow rogue actors to utilize that same trust.
It’s insecure AF.
Clients can choose to insist upon seeing proof that the certificates they're shown were logged (SCTs), Google's Chrome browser does this today.
Name owners can choose to check which certificates were logged for their names, either by operating their own log monitor or by having somebody else do it for them (Facebook will do this for free, but you're welcome to pay somebody if you don't like Facebook, or as I said, you can do it all yourself since the logs are public).
In practice even though the existing system is far from perfect we see relatively few problems, and fewer still actual attacks rather than screw-ups.
They can freely sign anything that isn't either certificate pinned, or has a CAA record. And both those things are client dependent, pretty much any ssl client besides chrome or firefox will not have the capability to do either.
This submission was the first I've seen of the story.
Many companies with diverse home countries run global networks, but it's only an issue when it's a Chinese company?
If the route is [whatever us transit] -> china telecom -> [whatever connectivity in south korea], the US transit provider is generally going to send the traffic to china telecom on the US side of the undersea cable, then it can use china telecom's provisioned bit of bandwidth.
Here's the quote from the article:
> One such example the authors give is the diverting of routes between Canada and South Korean government sites. For six months beginning in February, 2016, internet traffic was diverted by China Telecom and routed through its PoP in Toronto, then forwarded to its PoP on the West Coast, then on to China and finally to South Korea. The shortest route for this traffic would normally have been Toronto to the United States to South Korea, the authors says.
But there's no cable from US to South Korea listed on the submarine cable map https://www.submarinecablemap.com/
And they didn't show any work -- it's not unreasonable to me to go through China instead of Japan, especially since BGP is generally picking routes based on the least number of ASNs in between, rather than shortest distance or anything. Probably China Telecom had a peering or transit arrangement with the destination network (or one of their transit providers), and the other available routes would have had to switch networks one extra time -- or maybe it was even, and the China Telecom session was up longer.
With so many dupe on a paper which in my personal opinion is poorly written, it looks more like a xenophobia or propaganda attack.
It is bad either way.
>I don't care if the Chinese government has my data, I'm not a Chinese citizen
>The US spies as well
>The US did something wrong in the last 100 years, therefore you shouldn't complain that China did it last week
The US is doing certain things that seem outrageous.
The US is supposedly an ally of my country.
China is not explicitly an ally (just a trade partner).
So if the US spies on us, that's scandalous but it significantly lowers the bar for what I expect our non-allies to do to us.
It's not whataboutism, it's a precedent by which all future actions are measured. I'm not discounting the news story, I'm asking whether this is just a news story that will be forgotten about in a few weeks or so, or whether this is a total shift in expectations like when we found out what the US was doing to its own allies.
I'm not a US citizen so the US spying on me is already scandalous but if the US is doing it, I expect countries that aren't our allies to do the same.