iCloud face man-in-the-middle attack in China

Yesterday, I was posted an article to report iCloud got Man-in-the-middle attack in China,
http://www.zhoushuguang.com/2014/10/icloud-ssl-attack.html
and repost to two major Chinese geek community,
http://www.freebuf.com/news/47744.html
http://www.solidot.org/story?sid=41521

Chinese attacker is running a Man-in-the-middle attack on SSL encrypted traffic between iCloud server and China Unicom users. The ISP (probably asked by the government to do so) replaced the certificate of iCloud with a self-issued one. The government conducted similar attacks against GitHub, Google, Windows Live and Yahoo.

Evidence and Reproduce:

iCloud.com using CDN provide by akamai.com ，they have a lot of DNS result when you access iCloud.com, such as:  23.48.140.239 , 23.13.186.46 , 23.59.94.46

When you access those IP via SSL like https://23.59.94.46/ , it will popup the SSL warning and you can check the certificate issued by trust certificate authority, but did not match the domain because we are using IP directly. end user get above DNS records randomly when access iCloud.com.

we are confirm that https://23.59.94.46/ face man-in-the-middle attack in China, when people who live in China mainland access https://23.59.94.46/ , it will popup the SSL warning, but the certificate not issued by trust certificate authority, it is self-issued. it means China ISP can steal anyone iCloud user’s information when they using DNS Pollution(DNS spoofing)  and Man-in-the-middle attack both. now we don’t know the attacker using anycast technology to fake response from 23.59.94.46/ or just insert content between end user and real 23.59.94.46 , it seems not personal resource can m
ake it. it is possible State sponsored attack and operate by China Unicom.

self-issued certificate

self-issued certificate

here is the trace route result when I using China VPN: