China hit by Outlook, Hotmail MITM attacks

Chinese authorities have been accused of conducting a man-in-the-middle (MITM) attack against Microsoft's Outlook mail service as a means of monitoring citizens' communications, a stark look at what could be in store for the UK if David Cameron's cryptography pledge bears fruit.

According to a report by local news outlet GreatFire.org, users connecting to Hotmail and Outlook.com - both now run under the generalised brand-name Outlook by Microsoft - over IMAP and SMTP connectivity have discovered wildcard certificates in the TLS chain which have not been signed by Microsoft. The result: if a server identity warning message is ignored by the user, the owner of the wildcard certificate in question will be able to monitor the supposedly encrypted connection and retrieve usernames, passwords and the contents of all emails sent or received during the transaction.

The attack lasted 'about a day,' the site reported, and did not affect the TLS-secured web interfaces for either service. The site further claimed that 'we once again suspect that Lu Wei and the Cyberspace Administration of China have orchestrated this attack or have willingly allowed the attack to happen. If our accusation is correct, this new attack signals that the Chinese authorities are intent on further cracking down on communication methods that they cannot readily monitor.'

The man-in-the-middle attack comes as China continues to block access to Google's Gmail service, and is part of a continuing trend for the country to attempt to insert itself into the middle of encrypted communications in order to monitor its citizens - a breach of privacy David Cameron is eager to see repeated within the UK.

The Cyberspace Administration of China (CAC) has not commented on the claims that it was responsible for the attack, and no other group has come forward to claim responsibility.