China could use the internet security process to steal data, cyber experts warn

0
228

TechCrunch

To access the data of unsuspecting users, the Chinese Communist Party (CCP) could use a universal authentication process that is believed to be secure but may not actually be, cybersecurity experts warned, although encryption is still the preferred method for protecting digital data and protecting Computers – in some cases, the same digital certificates used for internet authentication allow the Chinese regime to break into and hack different computer networks, they said.

Digital certificates that verify the identity of a digital entity on the Internet. A digital certificate can be compared to a passport or driver’s license, according to Andrew Jenkinson, CEO of cybersecurity company Cybersec Innovation Partners (CIP) and author of the book Stuxnet to Sunburst: 20 Years of Digital Exploitation and Cyber ​​Warfare.

“Without it, the person or device you are using may not meet industry standards and the encryption of critical data could be bypassed so that what should be encrypted stays in the clear,” Jenkinson told The Epoch Times Used to Encrypt internal and external communication that prevents a hacker, for example, from intercepting and stealing data. But “fake certificates” or invalid certificates can manipulate all data.

Sense of security, ”said Jenkinson. Cybersecurity firm Global Cyber ​​Risk LLC said that digital certificates are generally issued by trusted CAs and then the same level of trust is passed on to intermediaries, but there are opportunities for a communist entity, malicious actors, or other untrustworthy entity to obtain certificates exhibit to other “hideous people” who appear trustworthy but are not, he said.

“If you issue a certificate from a trusted authority, you will trust them,” said Duren. “But what the issuer could actually do is pass that trust on to someone who shouldn’t be trusted. Duren said he would never trust.” for this reason a Chinese certification authority, which states that it is aware of a number of companies that have banned Chinese certificates because they were issued to untrustworthy agencies.

Jenkinson said that Chinese certification bodies make up a small portion of the overall industry and the certificates they issue are generally limited to Chinese companies and products.

Prince a member of the Chinese hacking groupPrince, a member of the Red Hacker Alliance hacker group who refused to give his real name, uses his computer in her office in Dongguan, Guangdong Province. China, on Aug. 4, 2020. (Nicolas Asfouri / AFP via Getty Images).

In 2015, certificates from China Internet Network Information Center (CNNIC), the state agency overseeing domain name registration in China, were challenged. Mozilla revoked CNNIC certificates because it knew about unauthorized digital certificates associated with multiple domains. Both internet companies refused to let CNNIC delegate its authority to issue certificates to an Egyptian company that issued the unauthorized certificates. According to Jenkinson, CNNIC certificates were banned because they had “back doors”.

A back door means that [the Chinese certification body] could literally take administrative access and send data back to the mothership, ”he said. Since 2016, Mozilla, Google, Apple and Microsoft have also been blocking the Chinese certification authorities WoSign and their subsidiary StartCom because of unacceptable security practices. Vulnerability Despite these bans on Chinese digital certificates in recent years, the CCP has not been deterred and the term gambling, said Jenkinson, referring to an alarming discovery by his cybersecurity firm two years ago that it was a multinational consulting firm.

Digital certificates are typically valid for a few years depending on the certification authority, and a renewal is required to keep them valid and keep the data they are supposed to protect secure, he said. “But in 2019, CIP Chinese discovered certificates that were valid for 999 years,” Jenkinson said. His company made this discovery while researching the laptops of a leading global consulting firm.

Jenkinson pointed out the vulnerability to the company and offered, “You are either incredibly courteous or complicit,” he said, noting that the company’s customers include government agencies. This multi-billion dollar company’s failure to fix this problem means hundreds of thousands of people could be exposed to Chinese infiltration through the company’s lax safeguards, Jenkinson said. The company engages its customers every time someone uses one of its laptops, he said.

Companies or customers who use the company’s services could be held for ransom, they have their intellectual advantages

Source Link

Leave a Reply