1680927 - MITM in Kazakhstan

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, enhancement)

Description

[O(n log n)]

Attachment: cert.pem.crt

+++ This bug was initially created as a clone of Bug #1680922 +++

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0

Actual results:

06.12.2020 will be exercises on "security". And will be tests with CA from government.
https://www.gov.kz/memleket/entities/mdai/press/news/details/132113?lang=ru https://www.kcell.kz/ru/product/trust-certificate
https://www.tele2.kz/support/sertificat

Expected results:

I think Mozilla must add it for blacklist(blocklist).

Comment 1

[StudioMaX]

Proofs at RIPE Atlas Probe 6745 (Located in Kazakhstan, Nur-Sultan (ex. Astana)): https://atlas.ripe.net/frames/measurements/28334289/#!probes

Comment 2

[O(n log n)]

In mass media: https://www.zdnet.com/article/kazakhstan-government-is-intercepting-https-traffic-in-its-capital/

Comment 5

[Leonid Evdokimov]

twitter.com is affected as well. That's observed from RIPE Atlas Probe 6745: https://atlas.ripe.net/measurements/28334941/#probes

Comment 6

[Frederik Braun [:freddy]]

Thanks for filing this! I'm moving it into the right component for blocklist consideration, so the right group will see this bug.

Comment 7

[Kathleen Wilson]

https://censoredplanet.org/kazakhstan/live

Comment 8

[Kathleen Wilson]

Cert: https://beeline.kz/binaries/content/assets/cert/information_security_certification_authority_ca_pem.crt
Test site: https://check.isca.gov.kz/

Comment 9

[Kathleen Wilson]

== Certificate Information ==
Country: KZ
Common Name: Information Security Certification Authority CA
Valid From: 2020-02-28T04:08:03Z
Valid To: 2040-02-28T04:08:03Z
Serial Number: 287dce0ce3c6f7aaa33ff965e76ea98c824a59db
SHA-256 Fingerprint: 61C0FC2E38B5B6F9071B42CEE54A9013D858B6697C68B460948551B3249576A1
SHA-1 Fingerprint: EE45853E5C81DB8FDBB7F92C18B20972C744911C

Comment 10

[Dana Keeler (she/her) (use needinfo) [:keeler]]

[11:21:50] Stage-Stage: 1305 Stage-Preview: 1305 Stage-Published: 1305                                                                                                                         compare.py:67
           Prod-Stage: 1305 Prod-Preview: 1305 Prod-Published: 1304                                                                                                                            compare.py:75
[11:21:51] Verifying stage against preview                                                                                                                                                     compare.py:82
           stage/security-state-staging (1305) and stage/security-state-preview (1305) are equivalent                                                                                          compare.py:87
           stage/security-state-staging (1305) and prod/security-state-staging (1305) are equivalent                                                                                           compare.py:87
           stage/security-state-staging (1305) and prod/security-state-preview (1305) are equivalent                                                                                           compare.py:87
           stage/security-state-preview (1305) and prod/security-state-staging (1305) are equivalent                                                                                           compare.py:87
[11:21:52] stage/security-state-preview (1305) and prod/security-state-preview (1305) are equivalent                                                                                           compare.py:87
           prod/security-state-staging (1305) and prod/security-state-preview (1305) are equivalent                                                                                            compare.py:87
           No changes are waiting in staging                                                                                                                                                   compare.py:90
           There are 1 changes waiting in production. Adding:                                                                                                                                  compare.py:99
{
    'details': {'bug': '1680927', 'who': '[e-mail]', 'why': 'Kazakhstan MITM (#3)', 'name': 'Information Security Certification Authority CA', 'created': '2020-12-07T23:52:21Z'},
    'enabled': True,
    'issuerName': 'MFYxODA2BgNVBAMTL0luZm9ybWF0aW9uIFNlY3VyaXR5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IENBMQ0wCwYDVQQKEwRJU0NBMQswCQYDVQQGEwJLWg==',
    'serialNumber': 'KH3ODOPG96qjP/ll526pjIJKWds='
}
           Staging is updated, and production changes are waiting, so Firefox can use                                                                                                         compare.py:110
           Remote Settings DevTools (https://github.com/mozilla-extensions/remote-settings-devtools)                                                                                                        
           and cert-storage-inspector (https://github.com/mozkeeler/cert-storage-inspector) to test                                                                                                         
           OneCRL.

Comment 11

[Ilhan Yumer]

Can you also add the https://check.isca.gov.kz/ address to the the black list (Phishing and Malware Protection) please.

Comment 12

[Kathleen Wilson]

This root was added to OneCRL in December.
https://blog.mozilla.org/netpolicy/2020/12/18/kazakhstan-root-2020/