Skip to content
Snippets Groups Projects
Commit 58b67390 authored by chengr28's avatar chengr28
Browse files

2014-10-05

A new fake certification and restore batsh.
parent f45fcce2
No related branches found
No related tags found
No related merge requests found
......@@ -3,12 +3,18 @@
Anti China Certifications.
### 更新日期
**2014-10-03**
**2014-10-05**
### Windows 批处理类型
* Base 为基础版本,删除信任并吊销了几个可疑的根或假证书,直接运行 AntiChinaCerts_Base.bat 即可
* Extended 为扩展版本,删除信任并吊销了所有可疑的根或假证书,直接运行 AntiChinaCerts_Extended.bat 即可,**建议使用这个版本**
* All 为完全版本,删除信任并吊销了所有可疑的证书,直接运行 AntiChinaCerts_All.bat 即可
* Restore 为恢复批处理,直接运行 AntiChinaCerts_Restor.bat 可恢复所有在上面几个版本中被加入吊销列表的证书的使用
* 具体的根和假证书列表参见下文涉及的CA根证书的介绍
### 方法
* Windows
* 直接选择运行在 Windows 目录里的批处理,**建议使用 Extended 版本**
* Base 版本直接运行 AntiChinaCerts_Base.bat 而 Extended 版本直接运行 AntiChinaCerts_Extended.bat 也即 Extended 版本扩展了 Base 版本,而 AntiChinaCerts_All.bat 也即 All 版本则包含了所有列表中的证书。具体的根证书列表参见涉及的CA根证书的介绍
* 选择好不同的版本,直接运行位于 Windows 目录里的批处理
* 操作完毕建议清空所有浏览器数据和系统缓存,并重启网络连接
* Linux
* 以 Debian 系列为例子,其它 Linux 发行版操作方法参见其官方说明
......@@ -72,6 +78,12 @@ Anti China Certifications.
* Fake Google.Com(2014-07-24)
* SHA-1 指纹 F6BEADB9BC02E0A152D71C318739CDECFC1C085D
* 此伪造证书被用于 2014-09-01 大规模中间人攻击 Google 网站
* Fake Yahoo.Com(2014-09-23)
* SHA-1 指纹 2290C311EA0F3F57E06DF45B698E18E828E59BC3
* 此伪造证书被用于 2014-09-30 大规模中间人攻击 Yahoo 网站
* Fake Hotmai.Com(2014-10-02)
* SHA-1 指纹 30F3B3ADC6E570BDA606B9F96DE24190CE262C67
* 此伪造证书被用于 2014-10-02 大规模中间人攻击 Microsoft 网站
* CNNIC ROOT
* SHA-1 指纹 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F
* 所属机构为 [China Internet Network Information Center/CNNIC/中国互联网络信息中心](http://www.cnnic.net.cn)
......
......@@ -27,6 +27,9 @@ CertMgr_x86 -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s -r localMa
:: Fake Yahoo.Com(2014-09-30)
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine Root
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine AuthRoot
:: Fake Hotmai.Com(2014-10-02)
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine Root
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine AuthRoot
:: CNNIC ROOT
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine Root
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine AuthRoot
......@@ -81,6 +84,7 @@ CertMgr_x86 -del -c -sha1 7C88AE178AE6AB8E69C30AF586D84EF29B6E6AE3 -s -r localMa
CertMgr_x86 -add -c FakeGitHubCom_201301.crt -s Disallowed
CertMgr_x86 -add -c FakeGoogleCom_201407.crt -s Disallowed
CertMgr_x86 -add -c FakeYahooCom_201409.crt -s Disallowed
CertMgr_x86 -add -c FakeHotmaiCom_201410.crt -s Disallowed
CertMgr_x86 -add -c CNNIC_ROOT.crt -s Disallowed
CertMgr_x86 -add -c China_Internet_Network_Information_Center_EV_Certificates_Root.crt -s Disallowed
:: Add certifications to CRL(Extended)
......@@ -94,7 +98,7 @@ CertMgr_x86 -add -c ROOTCA.crt -s Disallowed
CertMgr_x86 -add -c SRCA.crt -s Disallowed
CertMgr_x86 -add -c Certification_Authority_Of_WoSign.crt -s Disallowed
CertMgr_x86 -add -c Certification_Authority_Of_WoSign_Chinese.crt -s Disallowed
CertMgr_x86 -add -c Class_1_Primary_CA -s Disallowed
CertMgr_x86 -add -c Class_1_Primary_CA.crt -s Disallowed
CertMgr_x86 -add -c China_Trust_Network_1.crt -s Disallowed
CertMgr_x86 -add -c China_Trust_Network_2.crt -s Disallowed
CertMgr_x86 -add -c China_Trust_Network_3.crt -s Disallowed
......@@ -112,6 +116,9 @@ CertMgr -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s -r localMachin
:: Fake Yahoo.Com(2014-09-30)
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine Root
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine AuthRoot
:: Fake Hotmai.Com(2014-10-02)
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine Root
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine AuthRoot
:: CNNIC ROOT
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine Root
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine AuthRoot
......@@ -166,6 +173,7 @@ CertMgr -del -c -sha1 7C88AE178AE6AB8E69C30AF586D84EF29B6E6AE3 -s -r localMachin
CertMgr -add -c FakeGitHubCom_201301.crt -s Disallowed
CertMgr -add -c FakeGoogleCom_201407.crt -s Disallowed
CertMgr -add -c FakeYahooCom_201409.crt -s Disallowed
CertMgr -add -c FakeHotmaiCom_201410.crt -s Disallowed
CertMgr -add -c CNNIC_ROOT.crt -s Disallowed
CertMgr -add -c China_Internet_Network_Information_Center_EV_Certificates_Root.crt -s Disallowed
:: Add certifications to CRL(Extended)
......@@ -179,7 +187,7 @@ CertMgr -add -c ROOTCA.crt -s Disallowed
CertMgr -add -c SRCA.crt -s Disallowed
CertMgr -add -c Certification_Authority_Of_WoSign.crt -s Disallowed
CertMgr -add -c Certification_Authority_Of_WoSign_Chinese.crt -s Disallowed
CertMgr -add -c Class_1_Primary_CA -s Disallowed
CertMgr -add -c Class_1_Primary_CA.crt -s Disallowed
CertMgr -add -c China_Trust_Network_1.crt -s Disallowed
CertMgr -add -c China_Trust_Network_2.crt -s Disallowed
CertMgr -add -c China_Trust_Network_3.crt -s Disallowed
......
......@@ -38,6 +38,9 @@ CertMgr_x86 -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s -r localMa
:: Fake Yahoo.Com(2014-09-30)
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine Root
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine AuthRoot
:: Fake Hotmai.Com(2014-10-02)
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine Root
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine AuthRoot
:: CNNIC ROOT
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine Root
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine AuthRoot
......@@ -51,6 +54,7 @@ CertMgr_x86 -del -c -sha1 4F99AA93FB2BD13726A1994ACE7FF005F2935D1E -s -r localMa
CertMgr_x86 -add -c FakeGitHubCom_201301.crt -s Disallowed
CertMgr_x86 -add -c FakeGoogleCom_201407.crt -s Disallowed
CertMgr_x86 -add -c FakeYahooCom_201409.crt -s Disallowed
CertMgr_x86 -add -c FakeHotmaiCom_201410.crt -s Disallowed
CertMgr_x86 -add -c CNNIC_ROOT.crt -s Disallowed
CertMgr_x86 -add -c China_Internet_Network_Information_Center_EV_Certificates_Root.crt -s Disallowed
goto Exit
......@@ -66,6 +70,9 @@ CertMgr -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s -r localMachin
:: Fake Yahoo.Com(2014-09-30)
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine Root
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine AuthRoot
:: Fake Hotmai.Com(2014-10-02)
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine Root
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine AuthRoot
:: CNNIC ROOT
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine Root
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine AuthRoot
......@@ -79,6 +86,7 @@ CertMgr -del -c -sha1 4F99AA93FB2BD13726A1994ACE7FF005F2935D1E -s -r localMachin
CertMgr -add -c FakeGitHubCom_201301.crt -s Disallowed
CertMgr -add -c FakeGoogleCom_201407.crt -s Disallowed
CertMgr -add -c FakeYahooCom_201409.crt -s Disallowed
CertMgr -add -c FakeHotmaiCom_201410.crt -s Disallowed
CertMgr -add -c CNNIC_ROOT.crt -s Disallowed
CertMgr -add -c China_Internet_Network_Information_Center_EV_Certificates_Root.crt -s Disallowed
......
......@@ -38,6 +38,9 @@ CertMgr_x86 -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s -r localMa
:: Fake Yahoo.Com(2014-09-30)
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine Root
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine AuthRoot
:: Fake Hotmai.Com(2014-10-02)
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine Root
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine AuthRoot
:: CNNIC ROOT
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine Root
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine AuthRoot
......@@ -72,6 +75,7 @@ CertMgr_x86 -del -c -sha1 B9C9F58B3BBEF575E2B58328770E7B0076C40B5E -s -r localMa
CertMgr_x86 -add -c FakeGitHubCom_201301.crt -s Disallowed
CertMgr_x86 -add -c FakeGoogleCom_201407.crt -s Disallowed
CertMgr_x86 -add -c FakeYahooCom_201409.crt -s Disallowed
CertMgr_x86 -add -c FakeHotmaiCom_201410.crt -s Disallowed
CertMgr_x86 -add -c CNNIC_ROOT.crt -s Disallowed
CertMgr_x86 -add -c China_Internet_Network_Information_Center_EV_Certificates_Root.crt -s Disallowed
:: Add certifications to CRL(Extended)
......@@ -95,6 +99,9 @@ CertMgr -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s -r localMachin
:: Fake Yahoo.Com(2014-09-30)
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine Root
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s -r localMachine AuthRoot
:: Fake Hotmai.Com(2014-10-02)
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine Root
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s -r localMachine AuthRoot
:: CNNIC ROOT
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine Root
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s -r localMachine AuthRoot
......@@ -129,6 +136,7 @@ CertMgr -del -c -sha1 B9C9F58B3BBEF575E2B58328770E7B0076C40B5E -s -r localMachin
CertMgr -add -c FakeGitHubCom_201301.crt -s Disallowed
CertMgr -add -c FakeGoogleCom_201407.crt -s Disallowed
CertMgr -add -c FakeYahooCom_201409.crt -s Disallowed
CertMgr -add -c FakeHotmaiCom_201410.crt -s Disallowed
CertMgr -add -c CNNIC_ROOT.crt -s Disallowed
CertMgr -add -c China_Internet_Network_Information_Center_EV_Certificates_Root.crt -s Disallowed
:: Add certifications to CRL(Extended)
......
:: AntiChinaCerts Restore batch
:: Anti China Certifications.
::
:: Author: Chengr28
::
@echo off
cd /d %~dp0
:: Update certifications
RootSUPD_201403_x86
::cls
cd /d %~dp0\Certs
:: Architecture check
if "%PROCESSOR_ARCHITECTURE%%PROCESSOR_ARCHITEW6432%" == "x86" (goto X86) else goto X64
:X86
:: Delete certifications(Base)
:: Fake GitHub.Com(2013-01-25)
CertMgr_x86 -del -c -sha1 27A29C3A8B3261770E8B59448557DC9E9339E68C -s Disallowed
:: Fake Google.Com(2014-07-24)
CertMgr_x86 -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s Disallowed
:: Fake Yahoo.Com(2014-09-30)
CertMgr_x86 -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s Disallowed
:: Fake Hotmai.Com(2014-10-02)
CertMgr_x86 -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s Disallowed
:: CNNIC ROOT
CertMgr_x86 -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s Disallowed
:: China Internet Network Information Center EV Certificates Root
CertMgr_x86 -del -c -sha1 4F99AA93FB2BD13726A1994ACE7FF005F2935D1E -s Disallowed
:: Delete certifications(Extended)
:: CFCA GT CA
CertMgr_x86 -del -c -sha1 EABDA240440ABBD694930A01D09764C6C2D77966 -s Disallowed
:: CFCA EV ROOT
CertMgr_x86 -del -c -sha1 E2B8294B5584AB6B58C290466CAC3FB8398F8483 -s Disallowed
:: UCA Global Root
CertMgr_x86 -del -c -sha1 0B972C9EA6E7CC58D93B20BF71EC412E7209FABF -s Disallowed
:: UCA Root
CertMgr_x86 -del -c -sha1 8250BED5A214433A66377CBC10EF83F669DA3A67 -s Disallowed
:: UCA EV Root
CertMgr_x86 -del -c -sha1 B9C9F58B3BBEF575E2B58328770E7B0076C40B5E -s Disallowed
:: Delete certifications(All)
:: ROOTCA
CertMgr_x86 -del -c -sha1 DBB84423C928ABE889D0E368FC3191D151DDB1AB -s Disallowed
:: SRCA
CertMgr_x86 -del -c -sha1 AE3F2E66D48FC6BD1DF131E89D768D505DF14302 -s Disallowed
:: Certification_Authority_Of_WoSign
CertMgr_x86 -del -c -sha1 B94294BF91EA8FB64BE61097C7FB001359B676CB -s Disallowed
:: Certification_Authority_Of_WoSign(Chinese)
CertMgr_x86 -del -c -sha1 1632478D89F9213A92008563F5A4A7D312408AD6 -s Disallowed
:: Class_1_Primary_CA
CertMgr_x86 -del -c -sha1 6A174570A916FBE84453EED3D070A1D8DA442829 -s Disallowed
:: China_Trust_Network_1
CertMgr_x86 -del -c -sha1 C2CAEB0DC296FD50596BCA0F53C5364521167039 -s Disallowed
:: China_Trust_Network_2
CertMgr_x86 -del -c -sha1 B39B0B24B156D8B6123CAF7BA249DC81F27E39FA -s Disallowed
:: China_Trust_Network_3
CertMgr_x86 -del -c -sha1 7C88AE178AE6AB8E69C30AF586D84EF29B6E6AE3 -s Disallowed
goto Exit
:X64
:: Delete certifications(Base)
:: Fake GitHub.Com(2013-01-25)
CertMgr -del -c -sha1 27A29C3A8B3261770E8B59448557DC9E9339E68C -s Disallowed
:: Fake Google.Com(2014-07-24)
CertMgr -del -c -sha1 F6BEADB9BC02E0A152D71C318739CDECFC1C085D -s Disallowed
:: Fake Yahoo.Com(2014-09-30)
CertMgr -del -c -sha1 2290C311EA0F3F57E06DF45B698E18E828E59BC3 -s Disallowed
:: Fake Hotmai.Com(2014-10-02)
CertMgr -del -c -sha1 30F3B3ADC6E570BDA606B9F96DE24190CE262C67 -s Disallowed
:: CNNIC ROOT
CertMgr -del -c -sha1 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F -s Disallowed
:: China Internet Network Information Center EV Certificates Root
CertMgr -del -c -sha1 4F99AA93FB2BD13726A1994ACE7FF005F2935D1E -s Disallowed
:: Delete certifications(Extended)
:: CFCA GT CA
CertMgr -del -c -sha1 EABDA240440ABBD694930A01D09764C6C2D77966 -s Disallowed
:: CFCA EV ROOT
CertMgr -del -c -sha1 E2B8294B5584AB6B58C290466CAC3FB8398F8483 -s Disallowed
:: UCA Global Root
CertMgr -del -c -sha1 0B972C9EA6E7CC58D93B20BF71EC412E7209FABF -s Disallowed
:: UCA Root
CertMgr -del -c -sha1 8250BED5A214433A66377CBC10EF83F669DA3A67 -s Disallowed
:: UCA EV Root
CertMgr -del -c -sha1 B9C9F58B3BBEF575E2B58328770E7B0076C40B5E -s Disallowed
:: Delete certifications(All)
:: ROOTCA
CertMgr -del -c -sha1 DBB84423C928ABE889D0E368FC3191D151DDB1AB -s Disallowed
:: SRCA
CertMgr -del -c -sha1 AE3F2E66D48FC6BD1DF131E89D768D505DF14302 -s Disallowed
:: Certification_Authority_Of_WoSign
CertMgr -del -c -sha1 B94294BF91EA8FB64BE61097C7FB001359B676CB -s Disallowed
:: Certification_Authority_Of_WoSign(Chinese)
CertMgr -del -c -sha1 1632478D89F9213A92008563F5A4A7D312408AD6 -s Disallowed
:: Class_1_Primary_CA
CertMgr -del -c -sha1 6A174570A916FBE84453EED3D070A1D8DA442829 -s Disallowed
:: China_Trust_Network_1
CertMgr -del -c -sha1 C2CAEB0DC296FD50596BCA0F53C5364521167039 -s Disallowed
:: China_Trust_Network_2
CertMgr -del -c -sha1 B39B0B24B156D8B6123CAF7BA249DC81F27E39FA -s Disallowed
:: China_Trust_Network_3
CertMgr -del -c -sha1 7C88AE178AE6AB8E69C30AF586D84EF29B6E6AE3 -s Disallowed
:Exit
:: Print to screen.
@echo.
@echo Done. Please confirm the messages on screen.
@echo.
@pause
-----BEGIN CERTIFICATE-----
MIICYjCCAcugAwIBAgIBKTANBgkqhkiG9w0BAQQFADA4MQswCQYDVQQGEwJjbjEU
MBIGA1UEChMLaG90bWFpbC5jb20xEzARBgNVBAMTCmhvdG1haS5jb20wHhcNMTQw
OTIzMTEzNDAzWhcNMTUwOTIzMTEzNDAzWjA4MQswCQYDVQQGEwJjbjEUMBIGA1UE
ChMLaG90bWFpbC5jb20xEzARBgNVBAMTCmhvdG1haS5jb20wgZ8wDQYJKoZIhvcN
AQEBBQADgY0AMIGJAoGBAJ0A+/fnNmwleMfxTRBS5iYkwq4jdOzdXMdWxJjYCJSL
izdyB2lfR1UFK0Q6230HkIYqUVzaUC4hsS9nvin3jQB37W5UESXAextNCIgpSQ9N
Baf4t5q5ud3AkbR11rdb559e/wMLzGsyD4CML3HlJwgcf4ZHAtrKIVbbBRcGt86J
AgMBAAGjfDB6MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgQwMB0GA1UdDgQW
BBQ0j1vwhAYDwOUlEFdLxqlBjF0t6TARBglghkgBhvhCAQEEBAMCBeAwKAYJYIZI
AYb4QgENBBsWGWV4YW1wbGUgY29tbWVudCBleHRlbnNpb24wDQYJKoZIhvcNAQEE
BQADgYEANQTg2dSEXNPVBJYPSSEe6jLuFbAF7mULievq90yRzPDvXpzdBDxnevbg
A2bkXJJUJ3CimwvSg2WVgu4VK+fJMFiXBZthHjkcjGbPydtO7f+WeQKaEUK7EZe1
rNGBhbyz/1RpgXRwAw+oBp/Ii9ZoNsde1qD4hkP3OOlTTQNP2kg=
-----END CERTIFICATE-----
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment