github.io 大规模中间人？

[kenvix]

刚刚注意到 *.github.io 的连接都被劫持了，证书变成了一个自颁发的无效证书，还留了个 QQ 号

挂代理是没问题的

询问其他省的朋友也是如此

[yujizmq]

上海电信：
# echo | openssl s_client -servername z.github.io -connect z.github.io:443 2>/dev/null | openssl x509 -noout -subject
subject=C = CN, ST = GD, L = SZ, O = COM, OU = NSP, CN = SERVER, emailAddress = [e-mail]

上海联通：
# echo | openssl s_client -servername z.github.io -connect z.github.io:443 2>/dev/null | openssl x509 -noout -subject
subject=C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = www.github.com

[RyuZheng]

广州电信，成功复现

[unixeno]

武汉电信成功复现

[webshe11]

-----BEGIN CERTIFICATE-----
MIIB4TCCAYcCFDjGwZUOfrr1+SWHR5GxJ/rwXsHZMAoGCCqGSM49BAMCMHExCzAJ
BgNVBAYTAkNOMQswCQYDVQQIDAJHRDELMAkGA1UEBwwCU1oxDDAKBgNVBAoMA0NP
TTEMMAoGA1UECwwDTlNQMQswCQYDVQQDDAJDQTEfMB0GCSqGSIb3DQEJARYQMzQ2
NjA4NDUzQHFxLmNvbTAeFw0xOTA5MjYwOTMzMTNaFw0yOTA5MjMwOTMzMTNaMHUx
CzAJBgNVBAYTAkNOMQswCQYDVQQIDAJHRDELMAkGA1UEBwwCU1oxDDAKBgNVBAoM
A0NPTTEMMAoGA1UECwwDTlNQMQ8wDQYDVQQDDAZTRVJWRVIxHzAdBgkqhkiG9w0B
CQEWEDM0NjYwODQ1M0BxcS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASJ
27aMaVclvmdT8m6l98K999FM4dYTg4ag0627S2bxbLYHyLdQ0jqay5kA9KCF9Ucw
uzcqtTrNERlLIsxDGkLjMAoGCCqGSM49BAMCA0gAMEUCIH1+jEiQTVA+siP2g9kw
ITFZZINVKyET48788OSCLK1hAiEA+c5bJvnrdtZ1rbsLXJWtglkXSeBaHy5Wdt7w
dGc7McM=
-----END CERTIFICATE-----

[Curtion]

emmm...

[lework1234]

上海电线也这样

[wenyifancc]

江苏联通 4G/5G 成功复现

[AII]

目前看来只有 443 端口 TCP 路由被劫持了，DNS 无误，80 端口和 ICMP 都正常。
海外正常，仅国内有这个问题。

[codevvvv9]

我的网站 nicebluejs.com ，也中招了，这时候怎么办呢，打不开了

[Vinceeeent]

有人能解释一下原理吗? 是 TLS 连接时 CA 认证过程中被劫持了?

[zackxu233]

深圳电信成功复现。同时前 2 分钟访问 JD 也出现了~

[tsening]

福建电信成功复现

[windyskr]

杭州阿里云
tcping github.io 80
traceroute to github.io (185.199.108.153), 255 hops max, 60 byte packets
seq 0: tcp response from 185.199.108.153 (185.199.108.153) <syn,ack> 177.346 ms
traceroute to github.io (185.199.111.153), 255 hops max, 60 byte packets
seq 1: tcp response from 185.199.111.153 (185.199.111.153) <syn,ack> 209.708 ms
traceroute to github.io (185.199.109.153), 255 hops max, 60 byte packets

tcping github.io 443
traceroute to github.io (185.199.108.153), 255 hops max, 60 byte packets
seq 0: tcp response from 185.199.108.153 (185.199.108.153) <syn,ack> 4.570 ms
traceroute to github.io (185.199.110.153), 255 hops max, 60 byte packets
seq 1: tcp response from 185.199.110.153 (185.199.110.153) <syn,ack> 4.429 ms
traceroute to github.io (185.199.109.153), 255 hops max, 60 byte packets
seq 2: tcp response from 185.199.109.153 (185.199.109.153) <syn,ack> 16.266 ms

[techoc]

武汉电信复现成功~

[csy123]

重庆联通成功复现

[Mogugugugu]

山东联通中招、、、

[marquina]

北京联通复现成功

[marquina]

@randyo 堂下何人状告本官

[onion83]

今年 1 月份左右阿里云的 oss 域名也被干了，相同的 qq 相同的证书 ... 排除 dns 污染的可能性，工单排查了半天，最后不了了之。

[marquina]

北京阿里云复现成功