> I am more surprised that they don't have common Chinese software install a set of MitM CAs.

It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly."

https://en.wikipedia.org/wiki/Qihoo

See my other comment.

* The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used".

* If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.

According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.

How do you know that Firefox and Chrome have not been altered?

The app code signing process provides some assurance that the app has not been altered.

https://developer.apple.com/library/mac/documentation/Securi...

edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.

Any software installed on the system can add root CAs to both of them.

This may no longer be true for Chrome at least. They recently added protection against unauthorized configuration changes by third party programs. I'm having trouble determining whether that protection extends to root CAs though.

Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.