During 18 minutes earlier this year, 15% of the worlds internet traffic accidentally or intentionally passed through China. This has upset mainly Americans since it may have included some military traffic as well.

These types of disruptions aren't really disruptions, since routing traffic on the internet is not bound by geographical location. You may send an e-mail to your neighbor, still it may be routed around the world without you noticing it.

However, in effect, the Chinese incident may also be labeled as a man-in-the-middle-attack. Really, it is rather a machine-in-the-middle, since the wires of the internet are connected via lots of computers. If traffic passes through my computer, I am able to copy it.

If this happened in the Chinese case, perhaps 15% of the worlds internet traffic was copied for 18 minutes. Strategically, this makes a perfect case for eavesdropping and analyzing the traffic.

Now, there is another twist to it. From National Defense Magazine


McAfee has briefed U.S. government officials on the incident, but they were not alarmed. They said their Internet communications are encrypted. However, encryption also works on a basis of trust, McAfee experts pointed out. And that trust can be exploited.

Internet encryption depends on two keys. One key is private and not shared, and the other is public, and is embedded in most computer operating systems. Unknown to most computer users, Microsoft, Apple and other software makers embed the public certificates in their operating systems. They also trust that this system won’t be abused.

Among the certificates is one from the China Internet Information Center, an arm of the China’s Ministry of Information and Industry.

This is exactly why we should not trust corporate encryption and certificates. When traveling around the world, we may at any time access our "secure" services. But the one controlling the computers in between cables may at any time insert a fake certificate, since these are sold, bought and sometimes stolen. Even the Stuxnet virus infecting nuclear power plants ran as "legitimate" code on the infected computers, since even stolen certificates are trusted blindly by computers.

The only way of solving this problem is to make your own certificates. The OTR-tutorial that I wrote contains two such procedures. First you manually verify the telecomix XMPP server's certificate, then you manually verify your buddies OTR. You will thus be alerted to whether the server is hijacked or not, and even if this is the case, you have forward secrecy. Even if the traffic is intercepted, it will still be encrypted.

My GPG-tutorial contains another method of securing end-to-end encryption. With GPG you verify the certificates of your friends manually, preferably at key-signing parties.

The Chinese routing error may have been accidental, or it may have been planned. It doesn't really matter. The important thing is that we learn end-to-end encryption, because there is always someone listening in on the traffic.

Skriven av admin den 16 november 2010