After previous attacks on Github, Google, Yahoo and Microsoft, the Chinese authorities are now staging a man-in-the-middle (MITM) attack on Apple’s iCloud.
I have posted previously about MITM attacks on Google and Github and broke the news about the recent attack on Yahoo. Refer to the appendix at the end of this post to see technical evidence of the attack.
This case is different, however, for a few of reasons.
This is clearly a malicious attack on Apple in an effort to gain access to usernames and passwords and consequently all data stored on iCloud such as iMessages, photos, contacts, etc. Unlike the recent attack on Google, this attack is nationwide and coincides with the launch today in China of the newest iPhone. While the attacks on Google and Yahoo enabled the authorities to snoop on what information Chinese were accessing on those two platforms, the Apple attack is different. If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities. Many Apple customers use iCloud to store their personal information, including iMessages, photos and contacts.
What should users do to counteract this attack? Internet users in China should first use a trusted browser on their desktops and mobile devices - Firefox and Chrome will both prevent users from accessing iCloud.com when they are trying to access a site that is suffering from a MITM attack. Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly.
If users have ignored the security warnings, they should find an undisrupted connection to iCloud.com. This can be accomplished by using a VPN or by finding a different internet access point because the GFW’s MITM is not that stable. They should also enable two-step verification for their iCloud accounts. This will protect iCloud accounts from attackers even if the account password is compromised.
Technical evidence of attacks against iCloud.com (Apple) and login.live.com (Microsoft)
The GFW (Great Firewall of China) is now wiretapping Apple’s iCloud. GFW implemented a MITM attack on iCloud using a self-signed certificate.
The authorities only attacked IP 22.214.171.124. Not all users in China are affected because the iCloud DNS might return different IP addresses.
Wirecapture with MITM: https://www.cloudshark.org/captures/03a6b0593436
Self-signed certificate used in the attack:http://www.mediafire.com/download/ampbnqncc277krv/fakeicloudcert.zip
Connection log: http://pastebin.com/tN7kbDV3
TCP Traceroute: https://twitter.com/siyanmao/status/518963824481681408