github.io 大规模中间人？

kenvix · 2020-03-26T07:02:27Z

刚刚注意到 *.github.io 的连接都被劫持了，证书变成了一个自颁发的无效证书，还留了个 QQ 号挂代理是没问题的询问其他省的朋友也是如此

证书

中间人

QQ

劫持

211 replies • 2020-03-28 18:06:37 +08:00

1 2 3

❮

❯

1

mayx

Mar 26, 2020 via Android

我这里直接 reset 了

2

syahd

Mar 26, 2020

@mayx #1 我推测你是移动宽带？

3

scnace

Mar 26, 2020 via Android

/t/656367

4

hahasong

Mar 26, 2020

湖北电信可复现，一样是这个 QQ

5

lzp7

Mar 26, 2020

移动宽带复现成功与该主题中截图的证书相同

6

genezx

Mar 26, 2020

上海、浙江、湖北、广东、电信、联通全部中招

7

randyo

Mar 26, 2020 via Android

这不抓起来判几年？

8

yulihao

Mar 26, 2020

移动复现
根据 TCP Tracert 443,都还没出国就事先响应了

9

tankren

Mar 26, 2020

这么傻还留个人信息的？

10

xiri

Mar 26, 2020

https://desktop.github.com
https://pages.github.com
这两个也炸了

11

ronman

Mar 26, 2020 via Android

移动不能复现啊，试了几个网站都正常

12

yujiang

Mar 26, 2020 via Android

福建电信，中。留 QQ 号我还是第一次见。。。太蠢了吧

13

abclucifer

Mar 26, 2020

电信不能复现

14

hszhakka2ex

Mar 26, 2020

难怪之前几周我在 4G 网下访问 github.io 都经常打不开。

15

Curtion

Mar 26, 2020

四川电信一样

16

hoyixi

Mar 26, 2020

那个 QQ 估计就是个摆设。

几年前的一次，某网站的访问都被重定向到一个英文 blog，当时大家还猜测这个 blog 当天的广告费是不是赚爽了

17

allenby

Mar 26, 2020 via Android

福建移动中
curl -k -v https://z.github.io
* Rebuilt URL to: https://z.github.io/
* Trying 185.199.109.153...
* TCP_NODELAY set
* Connected to z.github.io (185.199.109.153) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: none
CApath: /system/etc/security/cacerts
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=CN; ST=GD; L=SZ; O=COM; OU=NSP; CN=SERVER; [email protected]
* start date: Sep 26 09:33:13 2019 GMT
* expire date: Sep 23 09:33:13 2029 GMT
* issuer: C=CN; ST=GD; L=SZ; O=COM; OU=NSP; CN=CA; [email protected]
* SSL certificate verify result: self signed certificate in certificate chain (19), conti
nuing anyway.
> GET / HTTP/1.1
> Host: z.github.io
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Connection: keep-alive
......

18

lshero

Mar 26, 2020

8

原来码农学东西都是喜欢看着教程一步一步的复制粘贴来操作
下面的网页搜索 [email protected]
https://www.lagou.com/lgeduarticle/52972.html

19

webshe11

Mar 26, 2020

教育网复现成功

20

4DAX07B8Kle4Dm6T

Mar 26, 2020

安徽电信复现

21

yujizmq

Mar 26, 2020

上海电信：
# echo | openssl s_client -servername z.github.io -connect z.github.io:443 2>/dev/null | openssl x509 -noout -subject
subject=C = CN, ST = GD, L = SZ, O = COM, OU = NSP, CN = SERVER, emailAddress = [email protected]

上海联通：
# echo | openssl s_client -servername z.github.io -connect z.github.io:443 2>/dev/null | openssl x509 -noout -subject
subject=C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = www.github.com

22

RyuZheng

Mar 26, 2020

广州电信，成功复现

23

unixeno

Mar 26, 2020 via Android

武汉电信成功复现

24

webshe11

Mar 26, 2020

25

Curtion

Mar 26, 2020

1

emmm...

26

lework1234

Mar 26, 2020

上海电线也这样

27

wenyifancc

Mar 26, 2020

江苏联通 4G/5G 成功复现

28

AII

Mar 26, 2020

目前看来只有 443 端口 TCP 路由被劫持了，DNS 无误，80 端口和 ICMP 都正常。
海外正常，仅国内有这个问题。

29

codevvvv9

Mar 26, 2020

我的网站 nicebluejs.com ，也中招了，这时候怎么办呢，打不开了

30

Vinceeeent

Mar 26, 2020

有人能解释一下原理吗? 是 TLS 连接时 CA 认证过程中被劫持了?

31

zackxu233

Mar 26, 2020

深圳电信成功复现。同时前 2 分钟访问 JD 也出现了~

32

tsening

Mar 26, 2020

福建电信成功复现

33

windyskr

Mar 26, 2020 via Android

杭州阿里云
tcping github.io 80
traceroute to github.io (185.199.108.153), 255 hops max, 60 byte packets
seq 0: tcp response from 185.199.108.153 (185.199.108.153) <syn,ack> 177.346 ms
traceroute to github.io (185.199.111.153), 255 hops max, 60 byte packets
seq 1: tcp response from 185.199.111.153 (185.199.111.153) <syn,ack> 209.708 ms
traceroute to github.io (185.199.109.153), 255 hops max, 60 byte packets

tcping github.io 443
traceroute to github.io (185.199.108.153), 255 hops max, 60 byte packets
seq 0: tcp response from 185.199.108.153 (185.199.108.153) <syn,ack> 4.570 ms
traceroute to github.io (185.199.110.153), 255 hops max, 60 byte packets
seq 1: tcp response from 185.199.110.153 (185.199.110.153) <syn,ack> 4.429 ms
traceroute to github.io (185.199.109.153), 255 hops max, 60 byte packets
seq 2: tcp response from 185.199.109.153 (185.199.109.153) <syn,ack> 16.266 ms

34

techoc

Mar 26, 2020

武汉电信复现成功~

35

csy123

Mar 26, 2020

重庆联通成功复现

36

Mogugugugu

Mar 26, 2020

山东联通中招、、、

37

marquina

Mar 26, 2020

北京联通复现成功

38

marquina

Mar 26, 2020

8

@randyo 堂下何人状告本官

39

onion83

Mar 26, 2020

今年 1 月份左右阿里云的 oss 域名也被干了，相同的 qq 相同的证书 ... 排除 dns 污染的可能性，工单排查了半天，最后不了了之。

40

marquina

Mar 26, 2020

北京阿里云复现成功

41

ZeroYe

Mar 26, 2020 via Android

深圳电信复现了，是个狠人

42

fancy111

Mar 26, 2020

哈哈，厉害哦。。。话说回来，这种在线储存运行类的是很容易被黑。
想不通这样做的意义在哪里

43

Xusually

Mar 26, 2020

北京电信复现

44

zhouyou457

Mar 26, 2020

四川电信复现..

45

n0way404

Mar 26, 2020 via Android

湖北襄阳电信复现。

46

charslee013

Mar 26, 2020

广东移动复现....

47

czwstc

Mar 26, 2020 via iPhone

上海联通复现...怎么做到的...哪里出了问题？

48

manami

Mar 26, 2020 via Android

1

这老哥厉害了，服

49

0x4F5DA2

Mar 26, 2020

上海电信复现

50

oicebot

Mar 26, 2020

福建电信表示也挂了

51

justin2018

Mar 26, 2020

1

腾某云

curl -k -v https://z.github.io

* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: [email protected],CN=SERVER,OU=NSP,O=COM,L=SZ,ST=GD,C=CN
* start date: Sep 26 09:33:13 2019 GMT
* expire date: Sep 23 09:33:13 2029 GMT
* common name: SERVER
* issuer: [email protected],CN=CA,OU=NSP,O=COM,L=SZ,ST=GD,C=CN