/>
X

Kazakhstan government is intercepting HTTPS traffic in its capital

This marks the third time since 2015 that the Kazakh government is mandating the installation of a root certificate on its citizens' devices.
catalin-cimpanu.jpg
Written by Catalin Cimpanu, Contributor on
Flag of Kazakhstan in Astana

Wind develops flag of the Republic of Kazakhstan in background of capital Nur-Sulta

Getty Images/iStockphoto

Under the guise of a "cybersecurity exercise," the Kazakhstan government is forcing citizens in its capital of Nur-Sultan (formerly Astana) to install a digital certificate on their devices if they want to access foreign internet services.

Once installed, the certificate would allow the government to intercept all HTTPS traffic made from users' devices via a technique called MitM (Man-in-the-Middle).

SEE: Meet the hackers who earn millions for saving the web, one bug at a time (cover story PDF) (TechRepublic)

Starting today, December 6, 2020, Kazakh internet service providers (ISPs) such as Beeline, Tele2, and Kcell are redirecting Nur-Sultan-based users to web pages showing instructions on how to install the government's certificate. Earlier this morning, Nur-Sultan residents also received SMS messages informing them of the new rules.

kazakhstan-sms.jpg
Image supplied

Kazakhstan users have told ZDNet today that they are not able to access sites like Google, Twitter, YouTube, Facebook, Instagram, and Netflix without installing the government's root certificate.

This is the Kazakh government's third attempt at forcing citizens to install root certificates on their devices after a first attempt in December 2015 and a second attempt in July 2019.

Both previous attempts failed after browser makers blacklisted the government's certificates.

Government calls it a cybersecurity training exercise

In a statement published on Friday, Kazakh officials described their efforts to intercept HTTPS traffic as a cybersecurity training exercise for government agencies, telecoms, and private companies.

They cited the fact that cyberattacks targeting "Kazakhstan's segment of the internet" grew 2.7 times during the current COVID-19 pandemic as the primary reason for launching the exercise.

Officials did not say how long the training exercise will last.

The Kazakh government used a similarly vague statement last year, in 2019, describing its actions as a "security measure to protect citizens."

Representatives for major browser makers, pivotal in blocking the Kazakh government's first two attempts to backdoor HTTPS traffic, told ZDNet they will investigate the recent incident and take appropriate measures.

Article updated at 18:55 ET, December 6 with the list of domains blocked in Kazakhstan. Article updated again at 06:00 ET, December 7 with response from major browser vendors.

The biggest hacks, data breaches of 2020 (so far)

Related

Capital One adds more rewards for its student cards, expanded access to Capital One Travel
capital-one-bank.jpg

Capital One adds more rewards for its student cards, expanded access to Capital One Travel

Credit Cards
NASA's InSight Mars lander has taken its final selfie. Here it is
jpegpia25287.jpg

NASA's InSight Mars lander has taken its final selfie. Here it is

Space
Why sudo is so important in Linux and how to use it
linux-security.jpg

Why sudo is so important in Linux and how to use it

Linux