{"id":11439,"date":"2019-07-24T10:43:07","date_gmt":"2019-07-24T17:43:07","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=11439"},"modified":"2021-07-26T08:34:00","modified_gmt":"2021-07-26T15:34:00","slug":"new-research-confirms-kazakhstan-is-spying-on-connections-to-facebook-twitter-vk-instagram-youtube-google-and-more","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/new-research-confirms-kazakhstan-is-spying-on-connections-to-facebook-twitter-vk-instagram-youtube-google-and-more\/","title":{"rendered":"New research confirms Kazakhstan is spying on connections to Facebook, Twitter, VK, Instagram, Youtube, Google, and more"},"content":{"rendered":"

Kazakhstan is actively spying on its citizens\u2019 internet connections to Facebook, Twitter, VK, Instagram, Youtube, Google, along with many other sites. New research<\/a> published by Ram Sundara Raman, Leonid Evdokimov, Eric Wustrow, Alex Halderman, and Roya Ensafi has identified 37 domains that are being targeted by Kazakhstan\u2019s ongoing man-in-the-middle (MITM) internet attack. The group of researchers hail from the University of Michigan and the University of Colorado, Boulder. The research also builds on continuing work at Censored Planet<\/a>, a University of Michigan lab founded by Roya Ensafi to create and utilize tools that could continuously monitor disruptions on the world wide web. Censored Planet has been tracking the ongoing situation in Kazakhstan since July 20th and published their research on July 23rd.<\/p>\n

The fake root certificate authority (CA) attack being used by the Kazakh government is very brute force and relies on forcing its citizens to install and trust the fake government\u2019s fake root certificate either through nudging by the internet service provider (ISP) or by breaking functionality. Unlike previously reported, not every connection out of Kazakhstan is affected \u2013 and researchers showed that it is possible to have HTTPS traffic intercepted from outside of Kazakhstan, which is how the research was carried out. The researchers clarified:<\/p>\n

\u201cSo far, the attack appears to affect a fraction of connections passing through the country\u2019s largest ISP, Kazakhtelecom (AS 9198 KazTelecom). This means some, but not all, of the Kazakh Internet population is affected.\u201d<\/p><\/blockquote>\n

Kazakhstan is targeting social media and communication websites as it spies on its citizens\u2019 internet traffic<\/h2>\n

The Kazakh government is using a \u201cmiddlebox\u201d located at Kazakhtelecom to decrypt and then re-encrypt traffic. Currently, the system is only set up to spy on a handful of websites \u2013 likely due to hardware limitations. Technically, the Kazakh government could use their fake root CA to attack and decrypt traffic to any website and the government could still just be saving that functionality for more individually targeted attacks.<\/p>\n

The full list of 37 sites identified by Censored Planet thus far are:<\/p>\n