Subject: [Add] FYI: MiTM growth, post DoH

From: dagon <[email-masked]>
Date: Fri, 19 Jul 2019 02:24:20 +0000

One consequence predicted by DoH critics was that DoH motivates the
large-scale installation of tcp/443 MiTM devices.  That is, if DoH
diminishes the ability of networks to use existing DNS-based
filtration systems, operators will simply move from udp/53 filtration
to tcp/443.

(And, because of increased deployment of TLS 1.3, they will simply
force the installation of MiTM CAs; and further, the class of networks
enforcing this requirement will be immune to cost pressures, or make
use of sovereign powers; and further this will happen first in
countries already prone to monitoring; and further this moves users
from an "opt-out" situation in DNS-based filtering (where changing
their DNS settings evades many filters), to a mandatory surveillance
network under tcp/443, etc., so DoT provides a better trade off, etc.
Many of these points are in the add@ list history or even predate the
list.)

This predicted trend is taking place in industry.  But have
governments also turned to mass tcp/443 interception?

This report seems relevant to that question, noting that all end-users
of all network providers in Kazakhstan were required to install a
government-issued CA in every browser:

   https://bugzilla.mozilla.org/show_bug.cgi?id=1567114
   https://i.imgur.com/WyKjOug.jpg
   https://i.imgur.com/rFEjXKw.jpg

There is yet no report of a MiTM CA for known DoH servers, but one can
download the certificate here:

   http://qca.kz/qazca.{cer, pem, der}

which can assist local researchers in monitoring for likely DoH
session interceptions.

This development might be relevant to those able to attend IETF
105/Montreal.

-- 
David Dagon
[email-masked]
"The single raindrop never feels responsible for the flood."

---

From: Ben Schwartz <[email-masked]>
Date: Thu, 18 Jul 2019 22:55:18 -0400

In my view, the data you cite indicates the opposite of your inference.

1. This action is being taken in the absence of DoH, which is not currently
deployed.  The fact that this has been publicly planned since at least
2015, and is occurring now despite no significant deployment of DoH,
suggests that this action is not motivated by DoH.
2. This action is not being used to implement "filtering".  The attack is
passive.
3. The current known forged certificate (*.facebook.com) is not relevant to
DNS-based filtering or surveillance.  facebook.com can easily be "filtered"
by IP address, and its subdomains don't contain any information that is
likely to be useful for surveillance (unlike, say, wordpress.com).
4. Anyone who can mount such an attack on facebook.com could have blocked
access without creating the forged certificate.  The existence of the
forged certificate indicates that blocking access is not the primary
motivation.
5. The only reason to construct a forged certificate for facebook.com is to
surveil the content of citizens' interactions via Facebook, and perhaps to
implement selective filtering based on that content.  DNS, regardless of
transport, has little relevance to this class of attacks on HTTPS.

>From these observations, it's clear to me that emphasizing DoT over DoH, or
even abandoning DNS privacy altogether, would _not_ have had any effect on
this attack.  More broadly, this is a reminder that backing away from DoH
will not appease actors who desire MITM capability.

On Thu, Jul 18, 2019 at 10:24 PM dagon <[email-masked]> wrote:

> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 18 Jul 2019 22:17:16 -0700

Ben Schwartz <bemasc=[email-masked]> writes:

> 3. The current known forged certificate (*.facebook.com) is not relevant to DNS-based
> filtering or surveillance.  facebook.com can easily be "filtered" by IP address, and
> its subdomains don't contain any information that is likely to be useful for
> surveillance (unlike, say, wordpress.com).

As a reminder, a large number of DoH proponents believe the best model
of deployment is one where the DoH server also lies within the
unfilterable address ranges of major content providers (cloudflare,
akamai, AWS, DO, etc).  You're right that this may not affect facebook,
unless they shift to a cloud provider's address spaces that also house a
DoH server.

(or, maybe, governments will really really put their foot down and block
cloud provider addresses, breaking many sites that current rely on
centralized services)
-- 
Wes Hardaker
USC/ISI

---

From: Rob Sayre <[email-masked]>
Date: Thu, 18 Jul 2019 22:46:15 -0700

> unless they shift to a cloud provider's address spaces that also house a

This argument might make sense if DNS was actually the best way to enact
these types of polices.
It doesn't seem like that's the case, though.

Here's what they do in China:
https://en.wikipedia.org/wiki/Great_Firewall#Current_methods

There's some DNS functionality in there, but most of what they do relies on
other methods.

And, to be clear, I'm not trying to get into a moral argument about whether
this filtering is right. It's
just that DNS-based methods don't work if you're trying to break links on
the internet.

thanks,
Rob

---

From: dagon <[email-masked]>
Date: Fri, 19 Jul 2019 20:26:18 +0000

On Thu, Jul 18, 2019 at 10:55:18PM -0400, Ben Schwartz wrote:

> 5. The only reason to construct a forged certificate for
> facebook.com is to surveil the content of citizens' interactions via
> Facebook, and perhaps to implement selective filtering

One telco, https://www.kcell.kz/ru/product/3585/658 , claims this is
to comply with the laws of Kazakhstan, "On Communications", para 11,
which protects users from cyber attacks, and

   просмотра противоправного контента.

or "viewing illegal content".

I'm somewhat familiar with these laws, since they obliged me to
relocate some anti-malware services years ago.  And in reading more,
there are seven governmental groups that may use the new
telco-supported interception capability for blocking (roughly:
internal affairs, national security cmte, foreign intel authority, mil
intel, anticorruption authority, state protective services, and
finance/econ investigative groups).  Admittedly, some of these groups
seem more disposed to passive surveillance.  But others have an
explicit censoring mandate.

So I think we'll see the CA used for blocking, as promised, and
therefore also DoH filtration.  We might never know the true motive
and full use for the CA, since under Kazakhstan's Law on State
Secrets, the detailed methods of any investigation are confidential.
We know only that all the CA public explanations mention active
filtering.

I therefore urged others to download the certificate, and observe its
promised use. Of potential interest: 89.218.11.194, KAZTELECOM-AS, is
available for recursion, via:

  StrictNodes 1
  ExitNodes 85.159.237.210

and less reliably:

  ExitNodes 109.248.147.198

in torrc.  (While these hosts do use 8.8.8.8 in /etc/resolv.conf,
there is at least one KAZTELECOM-AS resolver on path.)  This might be
useful if flagging zones subject to udp/53 filtering, to test
correspondence with any MiTM DoH observation.

I'm confident Kazakhstan's investigative agencies know about DoH. So
looking for DoH MiTM events seems prudent (or, if foolish, at least on
topic for this list).

> this attack.

Bell tolls precede any possible unringing.

-- 
David Dagon
[email-masked]
D970 6D9E E500 E877 B1E3  D3F8 5937 48DC 0FDC E717