To gain access to unsuspecting user data, the Chinese Communist Party (CCP) could take advantage of a universal authentication process that is considered secure but may not be in reality, cybersecurity experts have warned. , although encryption is still the preferred method of protecting digital data. and Protecting computers – in some cases, the same digital certificates used for internet authentication allow the Chinese regime to infiltrate and wreak havoc on various computer networks, they said.

A digital certificate can be compared to a passport or driver’s license, according to Andrew Jenkinson, CEO of cybersecurity firm Cybersec Innovation Partners (CIP) and author of the book Stuxnet to Sunburst: 20 Years of Digital Exploitation and Cyber ​​Warfare.

“Without it, the person or device you are using may not meet industry standards, and the encryption of critical data could be bypassed so that what should be encrypted remains in plain text,” Jenkinson told The Epoch Times Used to Encrypt internal and external communications that prevent a hacker, for example, from intercepting and stealing data. But “fake certificates” or invalid certificates can tamper with any data. 

Sense of security, “said Jenkinson. Cybersecurity firm Global Cyber ​​Risk LLC said digital certificates are generally issued by trusted CAs and then the same level of trust is passed on to intermediaries However, there are opportunities for a communist entity, malicious actor, or other untrustworthy entity to issue certificates to other “hideous people” who appear trustworthy but are not, he said.

Layers of False Trust

“If you issue a certificate from a trusted authority, you will trust it,” said Michael Duren,. “But what the issuer could actually do is pass that trust on to someone who shouldn’t be trusted. Duren said he would never trust.” a Chinese certification authority for this reason, stating that it is aware of a number of companies that have banned Chinese certificates because they were issued to untrustworthy agencies. 

Jenkinson said that Chinese certification bodies make up a small part of the overall industry and the certificates they issue are generally limited to Chinese companies and products.

In 2015, certificates from the China Internet Network Information Center (CNNIC), the state agency that oversees domain name registration in China, were challenged. Mozilla revoked CNNIC certificates because it knew of the existence of unauthorised digital certificates associated with multiple domains. Both Internet companies opposed CNNIC delegating its authority to issue certificates to an Egyptian company that issued the unauthorised certificates. According to Jenkinson, CNNIC certificates were banned because they had “back doors”.

A back door means the [Chinese certification body] could literally have administrative access and send data back to the mothership,” he said. Since 2016, Mozilla, Google, Apple and Microsoft have also blocked Chinese certification authorities WoSign and its subsidiary StartCom due to unacceptable security practices.

Digital certificates are typically valid for a few years depending on the certification authority, and a renewal is required to keep them valid and keep the data they are supposed to protect secure, he said. “But in 2019, CIP Chinese discovered certificates that were valid for 999 years,” said Jenkinson. His company made this discovery while researching the laptops of a leading global consulting firm.

Jenkinson made the company aware of the vulnerability and offered, “They are either incredibly accommodating or complicit,” he said, noting that the company’s customers include government agencies. This multi-billion dollar company’s failure to fix this problem means hundreds of thousands of people could be exposed to Chinese infiltration through the company’s lax safeguards, Jenkinson said. The company engages its customers every time someone uses one of its laptops, he said. 

Jenkinson made the company aware of the vulnerability and offered, “You are either incredibly accommodating or complicit,” he said, noting that the company’s customers could include government agencies exposed to Chinese infiltration due to the company’s lax security practices. said Jenkinson. The company engages its customers every time someone uses one of its laptops, he said.