Skip to main content

Kazakhstan Government Forcefully Begins Intercepting HTTPS Internet Traffic Of All Citizens.




Automated Blog Post.

If you are in Kazakhstan and unable to access the Internet service without installing a certificate, you're not alone.
The Kazakhstan government has once again issued an advisory to all major local Internet Service Providers (ISPs) asking them to make it mandatory for all their customers to install government-issued root certificates on their devices in order to regain access to the Internet services.
The root certificate in question, labeled as "trusted certificate" or "national security certificate," if installed, allows ISPs to intercept and monitor users' encrypted HTTPS and TLS connections, helping the government spy on its citizens and censor content.
In other words, the government is essentially launching a "man in the middle" attack on every resident of the country.


But how installing a "root certificate" allow ISPs to decrypt HTTPS connection? For those unaware, your device and web browsers automatically trust digital certificates issued by only a specific list of Certificate Authorities (CA) who have their root certificates installed on your system.
Therefore compelling Internet users into installing a root certificate that belongs to a Government Organisation gives them the authority to generate valid digital certificates for any domain they want to intercept through your HTTPS traffic.
Starting from April this year, Kazakh ISPs began informing their users about the "national security certificate" that would be mandatory to install in order to continue uninterrupted access to a list of "allowed" HTTPS websites.
Now, Tele2, one of the major Kazakh ISPs, has finally started redirecting all HTTPS connections of its customers to a web page containing certificate files and instructions on how to install it on Windows, macOS, Android, and iOS devices.
One of the most serious security implications we can easily spot here is that — since users can only browse non-HTTPS sites before installing the certificates, the Cert files are available for download only over insecure HTTP connections, which can easily allow hackers to replace Certificate files using MiTM attacks.
kazakhstan trusted security certificate
Other national ISPs, listed below, also have plans to start forcing their Internet users into installing the root certificate shortly to comply with the law.
Beeline
K-Cell
Active (also lists allowed HTTPS websites)
Altel
Kazakhtelecom
The controversial advisory has been issued with respect to amendments to the Law on Communications 2004 (the "Communications Law") that the Kazakhstan government passed in November 2015.
According to Clause 11 of Article 26, the "Rules for Issuing and Applying a Security Certificate," all national communications service providers are obliged to monitor the encrypted Internet traffic of their customers using government-issued security certificates.


The law was intended to come in force starting 1 January 2016, but the Kazakhstan government failed to force the local ISPs following a series of lawsuits.
It seems now the Kazakhstan government is making another attempt to force the amendments, putting privacy and security of millions of its citizens at risk from both hackers and the government itself by breaking the fundamentals of Internet security protocol.
kazakhstan https certificate
According to the note displayed by Internet providers, the amendments have been forced "in connection with the frequent cases of theft of personal and credential data, as well as money from bank accounts of Kazakhstan."
"A security certificate has been introduced that will become an effective tool for protecting the country's information space from hackers, Internet fraudsters and other types of cyber threats," the note reads.
"The introduction of a security certificate will also help in the protection of information systems and data, as well as identifying hackers and Internet fraudsters before they can cause damage."
"It will also allow Kazakhstan Internet users to be protected from hacker attacks and viewing illegal content."
From these statements, it's evident that the Kazakh government wants to take control over what content their citizens should be allowed to view on the Internet and also to turn Kazakhstan into a deep surveillance state.
Also, since half of the education is more dangerous than no education, I find it very concerning that ISPs are promoting "custom CA root certificate installation" as a better solution that boosts online security.


The pages and press releases created by ISPs with instructions on "why and how to install the government-issued certificate" doesn't correctly explain the threat of installing a wrong root certificate.
It littery leaves the majority of citizens at risk of social engineering attacks, and an opportunity for hackers to trick users into installing a malicious root cert from unofficial websites and sources.
Besides this, intercepting HTTPS communications will also allow ISPs to inject advertisements or tracking scripts on all web pages users visit.
At this moment, it is not clear how major tech companies and web browsers will respond to this new privacy infringement of the Kazakh citizens. We'll update the story with more information as soon as they are available.

Comments

Popular posts from this blog

UGANDA ELECTORAL COMMISSION TO ELIMINATE NATIONAL IDENTIFICATION CARDS (IDs) FOR 2021 GENERAL ELECTIONS.

The elimination of using National IDs (Ndagamuntu) for the 2021 elections should not have come as a surprise. One would be very NAIVE to think that Bobi Wine has not prepared for this in his Business Plan under the RISK section. It is public knowledge that our EC is not independent.  It is also public knowledge that Military Dictator Yoweri Museveni will never lose an election. What stunned us this morning is when we noticed that on social media, people were mocking Bobi with his "get your Ndagamuntu".  We are on record for saying to all Our readers that the National ID is like Apartheid in South Africa. Students of History would know how those IDs were being used to arrest people, deny them jobs, deny them basic services. Consequently, Bobi was not wrong and will never be wrong on the Ndagamuntu. Except the ones attacking him and mocking him forget that in Uganda, now, no National ID (Ndagamuntu), no service.  If you have not been denied registering your child i...

Here is Why Our Utterances For Praying Jesus And God To Come Liberate Ugandans, May Be Misplaced. This Phrase is like inform of a Letter To Some Categorized Section Of Ugandans.

https://m.facebook.com/yusufosuta/photos/a.1896701010557789/2070383359856219/?type=3 OPEN LETTER TO NRM SUPPORTERS - NATIONAL ROBBERS MOVEMENT. .................................................................................. Last week of March, a friend told me to pray for Uganda.  I told him that he was an Idiot and we have prayed for too long and we are still hungry and sick and Jesus is not coming soon to liberate us. He then ignored the STUPID and sent me a picture we all now know.  It got me totally messed up.  This guy was telling me to pray then sends a picture of men bowing down in blood.  He might have meant guns but I blocked him because his utterances of praying for Uganda were misplaced. I unblocked him 3 weeks later and asked him about praying and assassinations.  His reply "eithrr prayers or guns or both". I hate violence with a passion.  So he is now blocked in like FOREVER. Do you feel safe?  Do not feel safe. Uganda regim...

The Full List of Permanent Secretaries Appointed by President Museveni.

By virtue of the Powers given to the President by Article 174 (2) of the 1995 Constitution of the Republic of Uganda, I hereby, appoint the following as Permanent Secretaries as indicated below: 1. Head of Public Service and Secretary to Cabinet- Lucy Nakyobe 2. Deputy Head of Public Service And Secretary to Cabinet - Deborah Katuramu 3. State House Comptroller - Jane Barekye 4. Principal Private Secretary to the President- Dr. Kenneth Omona 5. Principal Private Secretary to H.E. the Vice President - Alex Kakooza 6.  Office of the Prime Minister - Keith Muhakanizi 7.  Office of the President - Yunus Kakande 8.  Ministry of Agriculture, Animal - Industry and Fisheries David Kyomukama Kasura (Maj. Gen.) 9.  Ministry of Defence and Veteran Affairs- Rosette Byengoma 10. Ministry of Education and Sports -       Kate Lamaro  11. Ministry of Energy and Mineral Development -   Batebe Irene  12. Ministry of Foreign Affairs - Vincent Bag...