Article Details

Chinese government website security is often worryingly bad, say Chinese researchers. Bad configurations, insecure versions of jQuery, and crummy cookies are some of myriad problems. Exclusive Five Chinese researchers examined the configurations of nearly 14,000 government websites across the country and found worrying lapses that could lead to malicious attacks, according to a not-yet-peer-reviewed study released last week. The authors, all from the Harbin Institute of Technology, described the study as scrutinizing "the security and dependency challenges besieging China's governmental web infrastructure." They claim to have revealed "substantial vulnerabilities and dependencies that could impede the digital efficacy and safety of governmental web systems." The researchers considered domain name resolution, utilization of third-party libraries, Certificate Authority (CA) services, Content Delivery Network (CDN) services, Internet Service Providers (ISP), the adoption of HTTPS, IPv6 integration, Domain Name System Security Extensions (DNSSEC) implementation, and website performance. The paper found plenty of problems. Over a quarter of domain names used by Chinese government websites were found not to have name server (NS) records – meaning it’s possible they lack effective DNS configuration and could be unreliable or inaccessible. Another finding was a "notable dependence" on five DNS service providers – a lack of diversity that could open the network infrastructure to single points of failure. "In the event of a technical issue, cyber attack, or regulatory action affecting one of these major providers, a significant portion of the DNS infrastructure could be compromised, impacting accessibility and security across a wide area," wrote the researchers. Furthermore, 4250 of the systems used versions of the jQuery JavaScript library that are vulnerable to CVE-2020-23064 – meaning they were open to a remote attack that has been a known problem for around four years. And although ISPs used by government websites were found to have a geographical spread that was moderately distributed, the researchers suggested that server redundancy fell short of what is required for optimal security and reliability. "Among the ISPs, China Mobile, China Telecom, China Unicom, and Alibaba Cloud occupy 98.29 percent of the market," found the team, which explained that "if one of the ISPs experiences a failure or attack, the entire network could be affected, causing widespread service outages." The researchers also found a slate of unsigned DNSSEC signatures – even though 101 subdomain records were found to have RRSIG (Resource Record Signature) records. "This discrepancy suggests that while specific DNS records may have been signed, such signatures might not be accurately represented in the whois database, or alternatively, the signing may be limited to certain subdomains rather than encompassing the entire domain," explained the authors. And finally, a Zed Attack Proxy (ZAP) analysis found: The researchers concluded the investigation has uncovered "pressing security and dependency issues" that may not have a quick fix. "Despite thorough analyses, practical solutions to bolster the security of these systems remain elusive," wrote the researchers. "Their susceptibility to cyber attacks, which could facilitate the spread of malicious content or malware, underscores the urgent need for real-time monitoring and malicious activity detection." The study also highlights the need for "stringent vetting and regular updates" of third-party libraries and advocates "a diversified distribution of network nodes, which could substantially augment system resilience and performance." The study will likely not go down well in Beijing, as China's government has urged improvements to government digital services and apps often issues edicts about improving cybersecurity.