A little over a month ago, the government of Kazakhstan began pressuring its citizens to install its public root in their browsers. It did so by using the country’s ISPs to require this root for internet access to be available, writes Tim Callan, Senior Fellow at Sectigo.
Tim Callan
Is appears that the aim of this operation was to intercept and spy on communications using man-in-the-middle attacks. This type of attack becomes much easier when the attacker controls a public root in the browsers of one or more participants in an online connection, as in effect it means that the observing party has the key to unlocking the secure communication.
As such, government agencies could decrypt users’ HTTPS traffic, capture its content, re-encrypt it, and send it to the receiver. In fact, just having the key to one participant’s side of the encrypted conversion would open up the entire data stream to spying. That means even parties that did not install this root or that took additional precautions like VPN use could still get caught in this next of surveillance.
Furthermore, there is no good way for users to tell when this kind of surveillance is happening; in effect, it would be a completely hidden operation.
Main Targets
We can guess at the main targets of such an initiative: political opponents, activists, journalists, and others interested in free speech and free political operation. Kazakhstan, after all, has a turbulent history: Since its independence from the Soviet Union in 1991 the country was governed by President Nursultan Nazarbayev until March 2019, when he stepped down to be succeeded by Kassym-Jomart Tokayev, who won the election in June 2019.
During Nazarbayev’s presidency, Kazakhstan had made a previous attempt to control private communications in the same manner. In 2016 the country applied to major browsers for inclusion in their root stores as a trusted public Certificate Authority. At the time this root store access did not come to be, at least in part due to the belief that it was intended for the abuse of, rather than the good of, end users.
Nevertheless, Kazakhstan persisted in its efforts to spy on its citizens. On July 17, 2019, local ISPs started guiding their customers to install the government’s root certificate after an official government announcement stated that it was “aimed at enhancing the protection of citizens, government bodies and private companies from hacker attacks, Internet fraudsters and other types of cyber threats.”
Content from our partners
There are scenarios where, man-in-the-middle observation can be benevolent and is well accepted. For example, enterprise firewalls may look at incoming and outgoing communications to make sure they do not include malware or prevent the exfiltration of confidential information. Private roots on browsers are not necessarily bad either. An organisation could want the browsers inside its firewall to have trust in its own pages on its own private root using a self-signed CA, granting encrypted access to users while preventing outside attackers from creating dangerous duplicates intended to execute scams.
Weaponization of PKI
The case for mass surveillance, however, is much harder to make. Rather than detecting and deterring fraud, this kind of widespread spying is more likely to be used to find and observe individuals deemed dangerous by those in power . In politically troubled communities, this can pose a real threat to free speech and free political action.
As of today, the world’s three most popular browsers – Chrome, Firefox and Safari – have decided to block the Kazakh government’s root certificate. Starting August 21 2019, these browsers will display error messages if they detect web traffic encrypted with the blocked roots. This threat could only have been addressed at the browser level, and it forced browsers into new territory when considering how to manage their trusted root stores. By taking this stand, Google, Apple and Mozilla join major internet services in declaring they are not simply neutral technology providers but instead have a social responsibility for how their technology offerings are used.
Kazakhstan’s attempted attack against its citizens was the first of its kind. Had it succeeded, however, we could have expected to see it followed by other governments employing the same tactic against their own people. Considering Kazakhstan’s persistent attempts to insert its root in encrypted communication, we should stay on the lookout for efforts by this or other governments to weaponize our shared PKI infrastructure.
