Kazakhstan is the transcontinental country.
Considered the world's largest landlocked country, its government had instructed Internet Service Providers (ISPs) in the country to install a state-issued certificate on all devices and in every browser before citizens can browse the web.
Kazakhstan government initially said that the strategy for using this ‘Qaznet Trust Network’ root CA (Certificate Authorities) certificate is to monitor cyber threats.
But having this certificate installed, the government can use it to validate a website’s identity, which makes it possible for man-in-the-middle attacks and spying from the government, even on HTTPS connections.
According to a post by the University of Michigan’s Censored Planet, the certificate can intercept traffic from many websites and domains, including social media platforms like Facebook, Instagram, YouTube, Google Hangouts, and Russia’s VK.
This is why Google, Apple and Mozilla in a joint announcement, said that they are deploying a technical solution to prevent the use of this certificate on Chrome, Safari and Firefox.
"Each company will deploy a technical solution unique to its browser," said Mozilla in a blog post.
Since browsers in general will implicitly trust certificates that have been locally installed on a user’s computer or smartphone, the behavior raised serious security concerns.
Here, the three browser makers want to make sure that their users won't be surreptitiously snooped by the government, by tweaking their browsers to revoke the certificate.
However, this comes with a consequence: users of the browsers that want to visit one of the 37 websites the certificate is tracking, are presented with an error message stating that the certificate should not be trusted.
What this means, users won’t effectively be able to proceed to the desired web page.
Using HTTPS, ISPs and the government won't be able to read or modify any information that happens between users' browser and the websites they visit. This is because HTTPS secures communications by encrypting data using certificates that are digitally signed by CAs, entities trusted by web browsers to vouch for the identity of sites.
But by using the installed fake CA certificate, ISPs and the government can tap into this supposed to be secured communication protocol.
However, ISPs and the government cannot get any legitimate CAs to sign a certificate for a domain they don't control.
And because browsers will detect and thwart this custom certificate, Kazakhstan that may not be able to convince all people to install its fake CA certificate, urged its ISPs to have the certificate installed on every mobile phones and browsers downloaded from the country.
"We also strongly encourage anyone who followed the steps to install the Kazakhstan government root certificate to remove it from your devices and to immediately change your passwords, using a strong, unique password for each of your online accounts," said Mozilla.
"People around the world trust Firefox to protect them as they navigate the internet, especially when it comes to keeping them safe from attacks like this that undermine their security. We don’t take actions like this lightly, but protecting our users and the integrity of the web is the reason Firefox exists."
“We will never tolerate any attempt, by any organization—government or otherwise—to compromise Chrome users’ data. We have implemented protections from this specific issue, and will always take action to secure our users around the world," said Chrome.
Kazakhstan in intercepting its citizens' internet activities was first detected on July 17, 2019.
Kazakhstan initially said that the urging ISPs to install the certificate was only a "test". But the move is certainly a surveillance, and does concerns users' privacy and rights.
