{"id":2211,"date":"2014-10-19T08:56:00","date_gmt":"2014-10-19T00:56:00","guid":{"rendered":"http:\/\/www.zuola.com\/weblog\/2014\/10\/2211.htm"},"modified":"2014-10-19T08:56:00","modified_gmt":"2014-10-19T00:56:00","slug":"icloud-%e6%9c%8d%e5%8a%a1%e5%99%a8%e5%9c%a8%e4%b8%ad%e5%9b%bd%e8%a2%abssl%e4%b8%ad%e9%97%b4%e4%ba%ba%e5%8a%ab%e6%8c%81%ef%bc%8c%e4%b8%ad%e5%9b%bd%e8%8b%b9%e6%9e%9c%e7%94%a8%e6%88%b7%e9%9a%90%e7%a7%81","status":"publish","type":"post","link":"https:\/\/www.zuola.com\/weblog\/2014\/10\/2211.htm","title":{"rendered":"iCloud \u670d\u52a1\u5668\u5728\u4e2d\u56fd\u88abSSL\u4e2d\u95f4\u4eba\u52ab\u6301\uff0c\u4e2d\u56fd\u82f9\u679c\u7528\u6237\u9690\u79c1\u4e0d\u4fdd"},"content":{"rendered":"

\u770b\u5230 http:\/\/www.v2ex.com\/t\/139723<\/a> \u6709\u4eba\u5728\u8ba8\u8bba iCloud \u88ab\u4e2d\u95f4\u4eba\u52ab\u6301\u3002\u6211\u4e5f\u53bb\u9a8c\u8bc1\u4e86\u4e00\u4e0b\u3002<\/p>\n

iCloud.com \u6709\u591a\u4e2aIP\uff0c https:\/\/23.48.140.239<\/a> \u548c https:\/\/23.13.186.46<\/a> \u8fd9\u4e24\u4e2a iCloud \u670d\u52a1\u5668\u4e0a\u6ca1\u6709\u88ab\u66ff\u6362\u8bc1\u4e66\u3002<\/p>\n

\u4f46\u662f\u76f4\u63a5\u8bbf\u95ee https:\/\/23.59.94.46\/ <\/a>\uff0c\u5728\u53f0\u6e7e\u6ca1\u6709\u88ab\u66ff\u6362\u8bc1\u4e66\uff0c\u6362\u82cf\u5dde\u8054\u901a\u7684VPN\u540e\uff0c\u8bc1\u4e66\u88ab\u66ff\u6362\u4e3a\u81ea\u7b7e\u540d\u7684\u8bc1\u4e66\u3002\u8fd9\u51b5\u5473\u7740 iCloud \u670d\u52a1\u5668\u5728\u4e2d\u56fd\u88ab\u4eba\u4f7f\u7528SSL\u4e2d\u95f4\u4eba\u52ab\u6301<\/a>\uff0c\u4e2d\u56fd\u82f9\u679c\u7528\u6237\u9690\u79c1\u4e0d\u4fdd\u3002\u82e5\u6709\u4eba\u4e0d\u5e78\u8fd0\u88abDNS\u670d\u52a1\u5668\u8fd4\u56de\u8fd9\u4e2aicloud.com\u7684IP\u5730\u5740\uff0c\u53c8\u5ffd\u7565\u4e86\u7f51\u9875\u4e0a\u7684\u5b89\u5168\u8b66\u544a\u7684\u8bdd\uff0c\u8f93\u5165\u5230icloud\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\u90fd\u4f1a\u88ab\u8fd9\u4e2a\u5236\u9020\u81ea\u7b7e\u540d\u8bc1\u4e66\u7684\u4eba\u62ff\u5230\uff0c\u4ed6\u5b58\u50a8\u5728icloud\u7684\u79c1\u623f\u7167\u7247\u3001\u94a5\u5319\u5708\u91cc\u7684\u5404\u79cd\u5e10\u53f7\u5bc6\u7801\u90fd\u4f1a\u88ab\u522b\u4eba\u5077\u5077\u590d\u5236\u5230\u3002<\/p>\n

\u4ee5\u4e0b\u662f\u8bc1\u636e\uff1a
\u4f7f\u7528\u82cf\u5dde\u7684IP\u8bbf\u95ee \u76f4\u63a5\u8bbf\u95ee https:\/\/23.59.94.46\/ <\/a> \u51fa\u73b0\u81ea\u884c\u7b7e\u540d\u6ca1\u6709\u7ecf\u8fc7\u4fe1\u4efbCA\u8ba4\u8bc1\u7684\u5b89\u5168\u8bc1\u4e66\uff1a
<\/a><\/p>\n

\u8fd9\u610f\u5473\u7740\u7528\u6237\u8bbf\u95ee\u5230\u7684icloud\u670d\u52a1\u5668\u4e0d\u662f\u771f\u6b63\u7684icloud\u670d\u52a1\u5668\uff0c\u5b58\u5728\u5e10\u53f7\u4fe1\u606f\u88ab\u7b2c\u4e09\u65b9\u83b7\u53d6\u7684\u98ce\u9669\u3002
<\/a><\/p>\n

\u4f7f\u7528\u53f0\u6e7e\u7684IP \u76f4\u63a5\u8bbf\u95ee https:\/\/23.59.94.46\/ <\/a>\uff0c\u8fd9\u4e2a\u6ca1\u6709\u95ee\u9898\uff0c\u5f97\u5230\u7684\u8bc1\u4e66\u7684\u6307\u7eb9\u4e0e\u771f\u6b63\u7684icloud.com \u7684\u8bc1\u4e66\u7684\u6307\u7eb9\u4e00\u81f4\uff1a<\/p>\n

<\/div>\n

 <\/a><\/p>\n

\u800c\u8bbf\u95ee https:\/\/23.48.140.239<\/a> \u8fd9\u4e2a iCloud \u670d\u52a1\u5668\uff0c\u65e0\u8bba\u662f\u5728\u53f0\u6e7e\u8fd8\u662f\u5728\u82cf\u5dde\uff0c\u5f97\u5230\u7684\u8bc1\u4e66\u7684\u6307\u7eb9\u4e0e\u771f\u6b63\u7684icloud.com \u7684\u8bc1\u4e66\u7684\u6307\u7eb9\u662f\u4e00\u81f4\u7684\uff1a<\/p>\n

<\/a><\/div>\n

<\/p>\n

<\/a><\/div>\n
<\/div>\n

https:\/\/23.13.186.46<\/a> \u7684\u60c5\u51b5\u4e5f\u548c \u800c\u8bbf\u95ee https:\/\/23.48.140.239<\/a> \u4e00\u6837\uff0c\u65e0\u8bba\u7528\u4e0d\u7528\u4e2d\u56fdIP\uff0c\u5f97\u5230\u7684\u8bc1\u4e66\u7684\u6307\u7eb9\u4e0e\u771f\u6b63\u7684icloud.com \u7684\u8bc1\u4e66\u7684\u6307\u7eb9\u4e00\u81f4\u3002<\/p>\n

<\/a><\/div>\n

<\/p>\n

<\/a><\/div>\n
<\/div>\n

\u9644iCloud.com \u7684\u771f\u6b63\u7684\u8bc1\u4e66\u7684\u6307\u7eb9\uff1a<\/p>\n

<\/a><\/div>\n

iCloud.com \u4f7f\u7528akamai \u63d0\u4f9b\u7684CDN\u670d\u52a1\uff0c\u6709\u591a\u4e2aIP\uff0c \u76ee\u524d\u81f3\u5c11\u53d1\u73b0\u4e86\u4e09\u4e2aIP\u3002<\/p>\n

https:\/\/23.48.140.239<\/a> \u548c https:\/\/23.13.186.46<\/a> \u8fd9\u4e24\u4e2a iCloud \u670d\u52a1\u5668\u4e0a\u6ca1\u6709\u88ab\u66ff\u6362\u8bc1\u4e66\u3002 \u4f46\u662f\u76f4\u63a5\u8bbf\u95ee https:\/\/23.59.94.46\/ <\/a>\uff0c\u5728\u53f0\u6e7e\u76f4\u63a5\u8bbf\u95ee\u6ca1\u6709\u88ab\u66ff\u6362\u8bc1\u4e66\uff0c\u6362\u82cf\u5dde\u8054\u901a\u7684VPN\u540e\uff0c\u8bc1\u4e66\u88ab\u66ff\u6362\u4e3a\u81ea\u7b7e\u540d\u7684\u8bc1\u4e66<\/a>\u3002\u5e76\u5f97\u5230\u591a\u4f4d\u7f51\u53cb\u7684\u8bc1\u5b9e\uff081<\/a> \u30012<\/a>\uff09\u3002\u8fd9\u610f\u5473\u7740 iCloud \u670d\u52a1\u5668\u5728\u4e2d\u56fd\u88ab\u4eba\u4f7f\u7528SSL\u4e2d\u95f4\u4eba\u52ab\u6301<\/a>\uff0c\u4e2d\u56fd\u82f9\u679c\u7528\u6237\u9690\u79c1\u4e0d\u4fdd\u3002\u82e5\u6709\u4eba\u4e0d\u5e78\u8fd0\u88abDNS\u670d\u52a1\u5668\u8fd4\u56de23.59.94.46<\/a>\u8fd9\u4e2aicloud.com\u7684IP\u5730\u5740\uff0c\u53c8\u5ffd\u7565\u4e86\u7f51\u9875\u4e0a\u7684\u5b89\u5168\u8b66\u544a\u7684\u8bdd\uff0c\u8f93\u5165\u5230icloud\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\u90fd\u4f1a\u88ab\u8fd9\u4e2a\u5236\u9020\u81ea\u7b7e\u540d\u8bc1\u4e66\u7684\u4eba\u62ff\u5230\uff0c\u4ed6\u5b58\u50a8\u5728icloud\u7684\u79c1\u623f\u7167\u7247\u3001\u94a5\u5319\u5708\u91cc\u7684\u5404\u79cd\u5e10\u53f7\u5bc6\u7801\u90fd\u4f1a\u88ab\u522b\u4eba\u5077\u5077\u590d\u5236\u5230\u3002\u7528\u963f\u91cc\u6d4b\u7684DNS\u89e3\u6790\u5de5\u5177\u68c0\u6d4b<\/a>\u53ef\u77e5\uff0c\u81f3\u5c11\u5e7f\u4e1c\u3001\u9ed1\u9f99\u6c5f\u3001\u5409\u6797\u7b49\u5730\u7684 icloud\u7528\u6237\u4f1a\u88ab\u8fd4\u56de23.59.94.46<\/a>\u8fd9\u4e2aIP\u5730\u5740\uff0c\u4ea6\u6781\u53ef\u80fd\u5f71\u54cd\u4f7f\u7528icloud\u5e10\u53f7\u3002\u76ee\u524d\u8fd8\u6ca1\u6709\u770b\u5230\u4efb\u4f55\u7ec4\u7ec7\u58f0\u79f0\u5bf9\u6b64\u9ed1\u5ba2\u884c\u4e3a\u8d1f\u8d23\u3002<\/p>\n

<\/p>\n

Chinese attacker is running a Man-in-the-middle attack<\/a> on SSL encrypted traffic between iCloud server and China Unicom users. The ISP (probably asked by the government to do so) replaced the certificate of iCloud with a self-issued one. The government conducted similar attacks against GitHub<\/a>, Google<\/a>, Windows Live<\/a> and Yahoo<\/a>.
<\/span><\/div>\n

Evidence and Reproduce:<\/h2>\n
iCloud.com using CDN provide by akamai.com \uff0cthey have a lot of DNS result when you access iCloud.com, such as:  23.48.140.239 , 23.13.186.46 , 23.59.94.46<\/div>\n
When you access those IP via SSL like https:\/\/23.59.94.46\/<\/a> , it will popup the SSL warning and you can check the certificate issued by trust certificate authority, but did not match the domain because we are using IP directly. end user get above DNS records randomly when access iCloud.com.<\/div>\n
we are confirm that https:\/\/23.59.94.46\/<\/a> face man-in-the-middle attack in China, when people who live in China mainland access https:\/\/23.59.94.46\/ , it will popup the SSL warning, but the certificate not issued by trust certificate authority, it is self-issued. it means China ISP can steal anyone iCloud user\u2019s information when they using DNS Pollution<\/a>(DNS spoofing)  and Man-in-the-middle attack<\/a> both. now we don\u2019t know the attacker using anycast technology to fake response from 23.59.94.46\/ or just insert content between end user and real 23.59.94.46 , it seems not personal resource can m
ake it. it is possible State sponsored attack and operate by China Unicom<\/a>.<\/div>\n
\u8fd9\u4e24\u5929\u8bb8\u591a\u5a92\u4f53\u8ddf\u8fdb\u62a5\u9053\u4e86\uff1a<\/span>

<\/span>http:\/\/www.freebuf.com\/news\/47744.html<\/a>
http:\/\/www.solidot.org\/story?sid=41521<\/a>
http:\/\/blog.zuola.com\/2014\/10\/icloud-face-man-in-the-middle-attack-in-china.htm<\/a><\/p>\n

http:\/\/mashable.com\/2014\/10\/20\/china-attacks-apple-microsoft\/<\/a>
http:\/\/it.people.com.cn\/n\/2014\/1021\/c1009-25874921.html<\/a>
http:\/\/www.dw.de\/a-18009603?maca=chi-rss-chi-all-1127-rdf<\/a><\/p>\n

10\u670821\u65e5\u4e0b\u534818\u70b9\u5de6\u53f3\uff0c\u6211\u8fd8\u4e3aWSJ\u9a8c\u8bc1\u4e86\u8fd9\u4e2a\u653b\u51fb\u4ecd\u7136\u5b58\u5728\uff0c\u4e0d\u8fc7\u665a\u4e0a10\u70b9\u6211\u518d\u4e3amashable\u9a8c\u8bc1\u65f6\uff0c\u653b\u51fb\u4f3c\u4e4e\u6682\u65f6\u505c\u6b62\u4e86\uff0c\u6ca1\u6709\u8fd4\u56de\u5047\u7684\u5b89\u5168\u8bc1\u4e66\u4e86\u3002<\/p>\n

10\u670822\u65e5\uff1a<\/p>\n

\u81ea\u7531\u4e9a\u6d32\uff1a\u82f9\u679c\u53ef\u80fd\u5df2\u88ab\u4e2d\u56fd\u9a87\u5ba2\u201c\u5077\u54ac\u4e00\u53e3\u201d
http:\/\/www.rfa.org\/mandarin\/yataibaodao\/meiti\/cyl-10212014150319.html<\/a>
\u534e\u5c14\u8857\u65e5\u62a5\uff1a\u82f9\u679c\u4e2d\u56fd\u5185\u5730iCloud\u670d\u52a1\u53d7\u653b\u51fb
http:\/\/cn.wsj.com\/gb\/20141022\/tec071917.asp<\/a><\/p>\n

\u82f9\u679c\u5173\u4e8e\u4e2d\u56fd\u7684\u4e2d\u95f4\u4eba\u653b\u51fb\u4e8b\u4ef6\u7684\u5b98\u65b9\u58f0\u660e\uff1a\u300aApple \u6709\u5173 iCloud.com \u5b89\u5168\u7684\u6700\u65b0\u6d88\u606f\u300b http:\/\/support.apple.com\/kb\/HT6550?viewlocale=zh_CN&locale=en_US<\/a><\/div>\n

\n
<\/div>\n<\/div>\n<\/div>\n
\u6765\u81ea\u5468\u66d9\u5149\u7684BLOGSPOT\u7a7a\u95f4<\/div>\n","protected":false},"excerpt":{"rendered":"

\u770b\u5230 http:\/\/www.v2ex.com\/t\/139723 \u6709\u4eba\u5728\u8ba8\u8bba iC Continue Reading …<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2211","post","type-post","status-publish","format-standard","hentry","category-random"],"views":156,"_links":{"self":[{"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/posts\/2211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/comments?post=2211"}],"version-history":[{"count":0,"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/posts\/2211\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/media?parent=2211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/categories?post=2211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zuola.com\/weblog\/wp-json\/wp\/v2\/tags?post=2211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}