The Kazakhstan government is intercepting all HTTPS-encrypted internet traffic within its borders.
Under a new directive effective 7/17, the Kazakhstan government is requiring every internet service provider in the country to install a security certificate onto every internet-enabled device and browser. Once installed, this certificate allows the government to decrypt and analyze all incoming internet traffic.
Kazakhstan ISP Kcell posted a notification on its website of the new policy, stating:
“In connection with the frequent cases of theft of personal and credential data, as well as money from bank accounts of Kazakhstan, a security certificate was introduced that will become an effective tool for protecting the country’s information space from hackers, Internet fraudsters and other types of cyber threats.
The introduction of a security certificate will help in the protection of information systems and data, as well as in identifying hacker cyber attacks of Internet fraudsters on the country’s information space systems, private, including the banking sector, before they can cause damage.”
The notification warned that “technical limitations may arise” for users who don’t install the certificate.
Despite the stated intention of the government, this requirement has all of the defining characteristics of a hacking technique called “Man in the Middle” attacks, where data relayed across the internet is intercepted and either adjusted or scanned for sensitive and potentially compromising content.
Read more about the story here.
