Solved SSL hijacking

zebal · Jun 22, 2023

I sometimes visit rt.com to weight on news around the world.

What happens is that SSL public key to this site has been modified:

NET::ERR_CERT_COMMON_NAME_INVALID

But in same time when I connect via proxy service there are no issues with SSL

This is not for the first time, it happens once or twice in a month and persists for up to a day or two.
And interestingly enough it started to happen since the war in Ukraine.

I've been testing with psiphon3 and if you want you can test it at this moment, although I'm not sure same would happen in your country.

Politics aside, can I with certainty conclude that my ISP is hijacking the SSL? (ex. on demand by government)
Who else beside ISP could that be?

TairikuOkami · Jun 22, 2023

What DNS do you use? Though it should not affect the webpage, a censored one might have triggered a redirect.

zebal · Jun 22, 2023

TairikuOkami said:
What DNS do you use? Though it should not affect the webpage, it might have triggered a redirect.

1.1.1.1 and 8.8.8.8 (encrypted version in settings)

btw. I've taken a look at false certificate and found out this (I've translated Subject filed for privacy reasons, it's not actual):

Subject: *.tax-administration.domain

Issuer: GeoTrust TLS RSA CA G1

Expires on: Feb 26, 2021

Current date: Jun 22, 2023

It also says:

Organizational Unit (OU): IT solution and implementation department

But this certificate is expired, so that's some insight.

However what's interesting, why would they block it only once or twice per month, why not all the time?
If that's government's fingers why would they expose them self with their own expired certificate?

The domain is from tax administration of my country.

zebal · Jun 22, 2023

TairikuOkami said:
What DNS do you use? Though it should not affect the webpage, a censored one might have triggered a redirect.

Ok, You've figure it out my friend!

I've just checked my DNS, yesterday I was resetting my adapter due to some issues and forgot to adjust manual DNS.
so I was using the DNS configured in router, as soon as I changed the DNS to 1.1.1.1 the site started to work normaly!

TairikuOkami · Jun 22, 2023

zebal said:
I was using the DNS configured in router, as soon as I changed the DNS to 1.1.1.1 the site started to work normaly!

Good to know, though not so good that the actual surveillance is in effect.
I am really glad that I use DNS with eSNI, especially in my lovely country.

zebal · Jun 22, 2023

There are some gambling sites which are blocked in my country because they don't align with tax law here,
however in all those cases the same domain which I discovered in this fake certificate opens the same tax-administration site with valid certificate and there is explanation from them that the site was blocked intentionally due to law.

I guess they have no valid reason to block press so they used expired certificate to guard themself, ex. to say "it's not us"
I see no other reasonable explanation.

Fabler2 · Jun 22, 2023

Is it worth reading? Just asking,

RT News (RT.Com)

QUESTIONABLE SOURCE A questionable source exhibits one or more of the following: extreme bias, consistent promotion of propaganda/conspiracies, poor or no

mediabiasfactcheck.com

zebal · Jun 22, 2023

Fabler2 said:
Is it worth reading? Just asking,

There are countless news online, but I prefer only those controlled by governments.

And here are my reasons:

1. Two sides at conflict each waging propaganda at each other which is normal and nothing new
2. If you read only one side you're not able to distinguish what's true from what's false
3. So I read opinions of both sides and then draw conclusions myself

Or the famous:
If the blind lead the blind, both will fall into a pit

z3r010 · Jun 22, 2023

zebal said:
There are countless news online, but I prefer only those controlled by governments.

WOW, Seriously?

zebal · Jun 22, 2023

z3r010 said:
WOW, Seriously

Yes not joking, my favorites are cnn, the guardian, rt and euronews. (although these are probably not all controlled by government, but who knows, I think they are, they look "official" enough for my taste.

I find it really fun to read all those accusations and then try to use logic to come at something that makes sense to me.

z3r010 · Jun 22, 2023

zebal said:
cnn, the guardian, rt and euronews

I have no words.

zebal · Jun 22, 2023

z3r010 said:
I have no words.

I'm interested to hear what news would you recommend?

z3r010 · Jun 22, 2023

You will find this a more reliable information source than any of those.

The Onion | America's Finest News Source.

The Onion brings you all of the latest news, stories, photos, videos and more from America's finest news source.

www.theonion.com

zebal · Jun 22, 2023

Thanks, won't say anything because it's too early but will check out from time to time for comparison.
I like estimating worldviews about hot topics.

z3r010 · Jun 22, 2023

Seriously, do you think that if a country shuts down the free press and imprisons anybody that says anything not following the government's narrative, is to be trusted with telling the truth?

zebal · Jun 22, 2023

of course not, I look at those news suspiciously but I find it interesting to see what they say and it's often times funny.

Primarily however as I said before I'm trying to grasp what's actually true by comparing claims of both sides that are not opinions of press workers but from officials because news are notorious to censor what they (or their masters) don't like and put forward only what they like.

I have countless times heard on local news something about what some foreign official said, but when I go their site I figure out that's indeed true but only excerpt taken out of some context, so I don't trust news for this reason, especially not local news.
And this happens with both news not just western news or just Russian news, it's not difficult to figure out but you probably already know this, it's propaganda.

If you ask me about my opinion about Russia and their way of governing, there are things I like and there are things I don't like, there are certain values in our countries which I especially do not like, it's mostly about conservatism vs (the other term I forgot), I'm conservatist.

imanlien2020 · Jun 22, 2023

z3r010 said:
WOW, Seriously?

I feel the same but we are all entitled to what we like. I DO NOT like or believe much on main stream networks that ARE controlled by the Government. Problem is, I DO NOT trust the government. But again my opinion.

z3r010 · Jun 22, 2023

imanlien2020 said:
I feel the same but we are all entitled to what we like. I DO NOT like or believe much on main stream networks that ARE controlled by the Government. Problem is, I DO NOT trust the government. But again my opinion.

Government controlled news is the last thing anybody should trust.

zebal · Jun 22, 2023

The essence of my reasoning is basically to get what somebody in fact said and then do the comparison, rather than to trust what ever is said what somebody said, it makes no sense to me.

Similar to how courts works, if you're a judge you listen to both sides and then do the judgment, but you don't have to trust any side.
philosophical over ideological.

windoc · Jun 22, 2023

I utilize a program which enables me to automatically intercept DNS requests at the system level and manage them using user-defined DNS settings. This program allows me to set up my own group of DNS servers and establish rules applicable to distinct domains and connections.

In order to safeguard against DNS hijacking, a rule can be set that restricts a page from loading if its domain name isn't cryptographically signed. However, this strategy depends on the domain name supporting DNSSEC, and as of now, many domain names do not provide this support. For example, RT does not currently support DNSSEC.

Utilizing a protocol like DNSCrypt can mitigate the risk of DNS hijacking. However, it's important to note that it doesn't provide a guarantee. For stronger assurance, DNSSEC should be used concurrently. Due to the lack of comprehensive support for DNSSEC, not all websites can be authenticated using this method.

Solved SSL hijacking

Well-known member

My Computer

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computer

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

EternalSoul

My Computer

Administrator

My Computers

Well-known member

My Computer

Well-known member

My Computer

Similar threads