Google, Mozilla, Apple Block Kazakhstan’s Root CA Certificate to Prevent Spying

In a move to protect its users based in Kazakhstan from
government surveillance, Google, Apple and Mozilla finally today
came forward and blocked Kazakhstan’s government-issued root CA
certificate within their respective web browsing software.

Starting today, Chrome, Safari and Firefox users in Kazakhstan
will see an error message stating that the certificate should not
be trusted when attempting to access a website that responds with a
government-issued certificate.

As The Hacker News reported last
month, all major Kazakh Internet Service Providers (ISPs) are
forcing their customers into installing a government-issued root
certificate on their devices in order to regain access to their
Internet services.
^[1]

The root certificate in question, labeled as “trusted
certificate” or “national security certificate,” if installed,
allows ISPs to intercept, monitor, and decrypt users’ encrypted
HTTPS and TLS connections, helping the government spy on its 18
million people and censor content.

Once installed, the certificate allowed the Kazakh government
to decrypt and read anything a user visiting popular
sites—Facebook, Twitter, and Google, among others—types or posts,
including intercepting their account information and passwords.

Making installation of the custom root CA certificate not just
allow the government to surveil its citizens’ online activities,
but also leaves them at risk of social engineering attacks as an
opportunity for hackers to trick users into installing a malicious
root cert from unofficial websites and sources.
After facing worldwide criticism, the Kazakh government described the
initial roll-out of the certificate as a test for monitoring cyber
threats and then abandoned its plans to intercept citizens’
internet traffic.

This is not the first time when the Kazakhstan government
intercepted the internet traffic of its citizens.

In 2015, the government attempted to have a root certificate
included in Mozilla’s trusted root store program, but the company
denied the request as soon as it was discovered that the Kazakhstan
government was intending to use that certificate to intercept user
data.

Both Google and Mozilla are encouraging you to remove the
Kazakhstan government root certificate from your devices if you
have already installed it and to change your passwords for each of
your online accounts immediately.

^[2][4]