9

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA.

The original post has been taken down, archived version here: https://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729

Hacker News: https://news.ycombinator.com/item?id=10663843

Did this go actually into effect, is the policy active?

  • IMHO, I am considering such post as "conspiracy theory". The message from the given link only talk about install a new root CA into their browser. This is quite common to country with new root CA that are not added into browser by default. – mootmoot Jul 16 '18 at 12:50
  • No @mootmoot, it is not common. Countries sometimes get signing authority over a new TLD and since that process takes a while to spin up it can be jump started, but that's not what is being talked about here. We're talking about a CA root used to MITM other sites. Also your opinion that this was a conspiracy theory was not grounded in fact, they had the law on the books in 2015 and now they are enforcing it. – Caleb Jul 21 at 5:01
7

As the previous answer suggests, the 2015/2016 attempt at this stunt got so much backlash they basically backed away from it and it sat for a while. The original January 1st 2016 deadline came and went with no real enforcement. Their request that Mozilla trusts their root certificate was declined. The MITM attempts still cropped up in individual cases of sites put under surveillance, but nothing widespread.

Until July 2019! Apparently, they never let go of the idea itself, the project was resurrected, and in the last few days enforcing started en masse through many ISPs (first implementation seen on July 17th, 2019). See this Mozilla bug report for technical details, Hacker News for discussion, or this ZDNet article for the news take.

Here is KCELL's (a major telecom company in KZ) information page in English that is a sample of what locals are being prompted to do when trying to access sites that have been MITM'ed.

Pursuant to the Law of the Republic of Kazakhstan On Communications and clause 11 of Rules for Issuing and Applying Security Certificates, Kcell JSC informs its customers of the need to install Security Certificate on devices capable of connecting to the Internet. According to law, telecom network operators are to ensure that customers with whom the operators have service contracts are able to install the security certificate on their mobile devices.

We draw your attention to the fact that installation of the security certificate must be done on each device that will be used to access the Internet (iOS/Android mobile phones and tablets, Windows/MacOS personal computers and laptops).

Customers failing to install Security Certificate on their mobile devices may face technical limitations when accessing certain websites.

Is spite of reports that it would be mandated first only in the capital (Nur-Sultan, formerly Astana) the enforcement seems to be rolling out on a per ISP basis, and has started impacting other cities as well. Bulk SMS messages have gone out (mostly to Nur-Sultan area subscribers) with instructions on how to add the government root cert to many cell phone OSes.

The certificate they are demanding everybody install is identified as Qaznet Trust and distributed through qca.kz. While the demand that all HTTPS traffic be intercepted is a governmental one and the root CA certificate in question is a Kazakhstan government-controlled one, it should be noted that the actual interception is being implemented by ISPs. Technical details of this are still not clear, but this likely means that each and every government authorized ISP will be able to intercept data from all website traffic.

  • As per knb.gov.kz/ru/news/v-otnoshenii-sertifikata-bezopasnosti (which you can read through google translate) "С учетом полученных положительных результатов тестирования, КНБ информирует о прекращении тестирования с 7 августа т.г. В ближайшее время на официальном сайте будут размещены инструкции по удалению сертификата безопасности с личных устройств." they are no longer intercepting traffic and will post instructions for deleting the certificate. – Boris Aug 7 at 20:53
0

Government got sued by association of local internet companies, banks and public organizations with the help of international organizations and foreign governments. On top of they realized how costly that entire plan would be both in terms of economic burden and international image of the country, so they temporarily backed off.

However they have a master switch now to disable most of the social networks and messengers which they already do and entire country's internet access in case of emergency (have not happened yet). There are strong rumors that biggest local provider Kazakhtelecom (basically internet backbone monopolist that owns >90% of physical network ) is actively building several large-scale data centers.

Allegedly they are going to re-route all of the incoming traffic through them and store the data in analogy with US run PRISM. If they successfully complete this step, they will be able to easily enforce MITM countrywide.

Source: me. I am from Kazakhstan. Actively use internet and believe in the freedom of communication and open source initiative. I've been closely following developments in this field, and that's all I know so far.

  • 5
    Do you have any references or links for all this information? – schroeder Nov 5 '18 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.