South Korea NIS admits to "packet tapping" Gmail

http://english.hani.co.kr/arti/english_edition/e_national/496473.html

by ajdecon • 15 years ago

57 40 15 years ago

english.hani.co.kr

pnathan• 15 years ago

Tapping is a mistranslation of "sniffing".

(At least according to Reddit's discussion on this event).

fraserharris2• 15 years ago

Link?

corin_• 15 years ago

I don't really see why it needs any discussion as a citation, it's fairly obvious that "tapping", as in "phone tapping", means listening in to, aka sniffing when talking packets.

wx77• 15 years ago

Discussion: http://www.reddit.com/r/netsec/comments/kj25j/south_korea_ad...

Specific comment: http://www.reddit.com/r/netsec/comments/kj25j/south_korea_ad...

To corin_ : perhaps he wanted a link to see the discussion rather than a source.

hannibalhorn• 15 years ago

One would assume they forced a CA to sign a false google.com certificate and substituted that for the real one, MitM style, in order to do the decryption. Governments are obviously capable of this.

Firefox's Cert Patrol or Chrome's certificate pinning are really the best defenses against this kind of thing. If you're on Chrome 13 or later, you're mostly guaranteed that gmail.com is the real deal.

tptacek4• 15 years ago

South Korea does not "possess the technology to decrypt the packets transmitted over Internet lines after intercepting them", no matter what this credulous article says.

The list of things law enforcement can do to capture GMail messages without secretly having compromised the most important encrypted protocol in the world includes:

* Having owned up the target's box and installed malware

* Having owned up the target's box and installed a bogus certificate

* Redirecting the target to a bogus GMail and assuming the target doesn't care about cert warnings

* Posing as a man in the middle and assuming the target doesn't care about cert warnings

and on and on.

Is it outside the realm of possibility that a nation state actor might have figured out a flaw in the SSL/TLS protocol that would allow them to decrypt traffic? No.

Is it outside the realm of possibility that such an actor could have a bogus root certificate, or a bogus Google certificate? No.

Is it outside the realm of possibility that an actor possessing one of those things would then proceed to use that capability in the course of mundane law enforcement activity, on the record, exposed to public court proceedings? Yes. It is unpossible that that happened.

brador2• 15 years ago

How can you be so sure that SK does not possess the technology required?

psykotic• 15 years ago

Even if they did have it, they wouldn't risk tipping their hand by using it in mundane law enforcement, so we can rule that out.

qx24b• 15 years ago

The most probable situation here (if it actually occurred) is that South Korea owns a certificate authority that is accepted by browsers and did a MITM attack with their own google cert.

andreyf2• 15 years ago

If so, it seems to be a pattern: http://googleonlinesecurity.blogspot.com/2011/08/update-on-a...

tptacek4• 15 years ago

I don't know how probable it is that South Korea has the capability to mint bogus Google certificates.

I do think it's highly improbable that they would use that capability for run-of-the-mill law enforcement cases.

huhtenberg• 15 years ago

For what it worth, the support for this sort of MITM was the feature du jour among "unified security" appliance vendors back in 2003-04. Basically the idea was that the corporate IT department would install an additional CA certificate on all company's computers and this would enable the appliance to access raw data of SSL/TLS streams going in and out of company's networks. The purpose was benign and it was to scan downloads for viruses and malware.

I do not doubt for a second that any reasonable national cybersecurity agency has this functionality readily available, utilizing one of the CA certificates bundled with common OSes. Whether they are actually using it and to what extent is another question, which ties into political implications should someone detect the certificate forgery.

FaceKicker• 15 years ago

Isn't HTTPS disabled by default in Gmail (other than the login page)? This was definitely true about a year ago, if not today.

If so I would imagine 95+% of users aren't/weren't using HTTPS, making it trivial to read most of the population's Gmail.

Edit: I was wrong about "definitely true about a year ago", they turned HTTPS on by default in January 2010. http://gmailblog.blogspot.com/2010/01/default-https-access-f... . Seems reasonable that the government could only have been "packet tapping" before 2010.

mattmanser• 15 years ago

Ahh, takes me back, I sent a bug report to Google when I first joined GMail saying that most of it was in http!

They never responded.

breck• 15 years ago

Odds that NIS is actually decoding SSL packets: 00.1%

Odds that this was before Gmail instituted HTTPS or that there is some other explanation that the reporter missed: 99.9%

However, importance if the former is the case: World changing news. But extremely unlikely.

lukeschlather2• 15 years ago

Seems to me pretty clear that SSL is kind of a joke as far as security goes, a little like WEP wireless security. Yes, unlike WEP if everything is working properly SSL is in theory safe. But there are so many gotchas, from the byzantine CA system to the fact that most of the time when a browser warns you that a certificate is bad there's nothing wrong, SSL just doesn't hold up to a determined attacker (especially a government.)

jmillikin2• 15 years ago

WEP is completely broken. Even if you do everything right, it's trivial for an attacker to access a WEP-protected network.

  most of the time when a browser warns you that a certificate is bad there's nothing wrong

I've never had a false-positive browser warning. I assume you're complaining about Firefox's and Chrome's treatment of self-signed certificates, which is completely appropriate. Self-signed certificates should always be rejected, unless the user has manually added them to the keystore.

rmc3• 15 years ago

No, SSL is not as bad as WEP. If you follow all the rules and do things right with WEP, everyone knows how to break it. It's like doing rot-13 correctly. No matter how correct you are, you are not protected. In theory and in practice, WEP is insecure.

SSL is possible and commonly done correctly. It is not a joke security wise. (If it is a security joke, show me something that isn't a security joke).

Unless you are a government (or have similar resources), you cannot hack SSL.

foobarbazetc• 15 years ago

Every country in the world is "packet tapping" (whatever this means) Gmail.

Tsagadai• 15 years ago

This is probably an old pre-default HTTPS Gmail, man in the middle attack and the original article is badly written as others have posted. However, the man in the middle based packet inspection and injection is widely used. From what I can tell this is how the censorship banner (http://en.wikipedia.org/wiki/File:KCSC-Warning.png) gets pasted over JS and html partials within sites the government takes issue to. Packet inspection is almost certainly being widely used.

South Korea NIS admits to "packet tapping" Gmail

Related Stories