0

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone.

Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but this never happens on my laptop.

Currently I'm trying to access m.facebook.com and I get a warning that the certificate is mismatching. I have one here now that says that the certificate presented belongs to someone with a "common name" that is a ip address that goes to a hosting provider in Germany. I get this both while being connected to a Hong Kong and a Taiwan VPN server.

Is it reasonable to assume that this is an attack, or could this kind of issues have natural causes? If this is an attack, what kind of attack vectors could fit into this description?

Update

Well, when you speak of the devil... I just experienced this issue from my laptop as well. And the mismatching certificates seem vary in a arbitrary way, the latest are issued by 144.76.99.230, *.sslserve.jp, RapidSSL SHA256 CA - G3, webmail.elclubexpress.com. The local malware theory seems to weaken?

I have another VPN provider as well for backup (these things are unstable in China), and I have not experienced these issues on that provider.

  • 1
    "Honest mistakes" do not happen in SSL. Does your VPN provide their own SSL encryption? – Ohnana Jan 15 '15 at 16:00
  • What browser on each device? – AlexH Jan 15 '15 at 16:01
  • @Ohnana I don't know what "own SSL encryption" is, I'm using ExpressVPN, basically in plug'n play mode. Not much to configure. – Alex Jan 15 '15 at 16:04
  • @darkf On my laptop (where I never have any problem) it's firefox, on my phone is the built-in browser in android. The facebook-app don't seem to be able to connect either when this happens, but I get no detailed error message. – Alex Jan 15 '15 at 16:06
  • 1
    "How suspicious is this?" Suspicious enough that your browser pops up a warning to let you know something isn't right. You'll have to do some research about the certs to see why they are working one place but not the other, but I'd suggest, as your browser already has, that you don't continue to those sites over that connection. – CoverosGene Jan 15 '15 at 16:58
2

Is it reasonable to assume that this is an attack, or could this kind of issues have natural causes?

It can be an attack or just really badly implemented login portal or something like that.

Does it happen only on facebook or on any site you try to access?

What it is saying is that the SSL certificate presented to you does not match the site you are trying to connect to.

If this happens only on some sites, yes, it looks like an attack.

If this is an attack, what kind of attack vectors could fit into this description?

Probably someone is sniffing your connection. By accepting a fake certificate,you establish a SSL connection to the attacker, not to the facebook server. The attacker MAY redirect the data to and from the facebook and you. Therefore the attacker can intercept your data and communication on facebook.

  • 1
    I have only noticed the problem on facebook, but I can investigate further the next time. But if someone is sniffing my connection over VPN, does that mean that they have manipulated the vpn connection as well? – Alex Jan 15 '15 at 17:55
  • 1
    First supect would be that an malware on your computer could be diverting traffic from the VPN to an attacker, but would be hard to believe that this would happen on both computer and android device. That if your traffic is really going through VPN. Do you have the same experience when trying to connect without VPN? – CristianTM Jan 15 '15 at 18:03
  • 1
    Well, facebook is blocked in China so I can not compare. But malware on the phone could explain why I never have problems on the computer, but in that case - why only sometimes? China has a lot of resources, maybe it's not unplausable that they got into the vpn connection directly? Is it possible to analyze this somehow? – Alex Jan 15 '15 at 18:11
  • Oh, ok, only on the phone. I misunderstood that it was happening on both cases, sorry. It is very hard to believe that they could break into a big VPN provider like ExpressVPN, and IF they did it, they could invest more resources on a harder-to-detect attack. I really think a malware or misconfiguration is more probable. – CristianTM Jan 15 '15 at 18:19
  • Thanks, I'll try to investigate some more with this information. Kind of tricky environment on the phone, but let's see what one can make of it... – Alex Jan 15 '15 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.