Skip to content

To access unsuspecting user data, the Chinese Communist Party (CCP) could take advantage of a universal authentication process that is considered secure but may not in reality be, cybersecurity experts have warned. , although encryption remains the preferred method of protecting digital data. and Protecting computers – in some cases, the same digital certificates used for internet authentication allow the Chinese regime to infiltrate and wreak havoc on various computer networks, they said.

Digital certificates that verify the identity of a digital entity on the Internet. A digital certificate can be compared to a passport or driver’s license, according to Andrew Jenkinson, CEO of cybersecurity firm Cybersec Innovation Partners (CIP) and author of the book Stuxnet to Sunburst: 20 Years of Digital Exploitation and Cyber Warfare.

“Without it, the person or device you are using might not meet industry standards, and the encryption of critical data could be bypassed so that what should be encrypted remains in plain text,” Jenkinson told The Epoch Times Used to Encrypt internal and external communications. that prevent a hacker, for example, from intercepting and stealing data. But “fake certificates” or invalid certificates can falsify any data.

Sense of security, ”Jenkinson said. Cyber ​​security firm Global Cyber ​​Risk LLC said digital certificates are typically issued by trusted certification authorities and then the same level of trust is passed on to intermediaries. However, there are opportunities for a communist entity, malicious actor, or other untrustworthy entity to issue certificates to other “hideous people” who appear trustworthy but are not, he said. he declares.

“If you issue a certificate from a trusted authority, you will trust it,” Duren said. “But what the transmitter could do is convey that trust to someone who shouldn’t be trusted. Duren said he would never trust.” a Chinese certificate authority for this reason, stating that it is aware of a number of companies that have banned Chinese certificates because they were issued to untrustworthy agencies.

Jenkinson said Chinese certification bodies are only a small part of the entire industry, and the certificates they issue are generally limited to Chinese companies and products.

China could use internet security process to steal data, warn cyber experts

Prince, a member of the Red Hacker Alliance hacking group who refused to give his real name, uses his computer in their office in Dongguan, Guangdong Province, China, August 4, 2020 (Nicolas Asfouri / AFP via Getty Images).

In 2015, the certificates of the China Internet Network Information Center (CNNIC), the state agency overseeing domain name registration in China, were challenged. Mozilla revoked CNNIC certificates because it knew of unauthorized digital certificates associated with multiple domains. The two internet companies objected to CNNIC delegating its authority to issue certificates to an Egyptian company that issued the unauthorized certificates. According to Jenkinson, CNNIC certificates were banned because they had “back doors.”

A backdoor means that [the Chinese certification body] could literally take administrative access and send data back to the mothership, ”he said. As of 2016, Mozilla, Google, Apple and Microsoft have also been blocking Chinese certification authorities WoSign and their subsidiary StartCom due to unacceptable security practices. Vulnerability Despite these bans on Chinese digital certificates in recent years, the CPC has not been discouraged and term gambling, Jenkinson said, referring to an alarming discovery by his cybersecurity company two years ago that it was of a multinational consulting firm.

Digital certificates are typically valid for a few years depending on the CA, and renewal is needed to keep them valid and secure the data they are meant to protect, he said. “But in 2019, CIP Chinese discovered certificates valid for 999 years,” Jenkinson said. His company made this discovery while researching laptops from a leading global consulting firm.

Jenkinson informed the company of the vulnerability and proposed, “They are either incredibly accommodating or complicit,” he said, noting that the company’s clients include government agencies. The failure of this multibillion-dollar company to solve this problem means hundreds of thousands of people could be exposed to Chinese infiltration through the company’s lax guarantees, Jenkinson said. The company engages its customers every time someone uses one of its laptops, he said.

Companies or customers who use the services of the company could be held for ransom, they have their intellectual advantages

Not all news on the site expresses the point of view of the site, but we transmit this news automatically and translate it through programmatic technology on the site and not from a human editor.