9 ms·

Someone on Reddit highlighted that the block seems to key off of the SSL SNI header, regardless of which IP you try to connect to. There must be some Deep Packe

by 0x0 10y ago

Someone on Reddit highlighted that the block seems to key off of the SSL SNI header, regardless of which IP you try to connect to. There must be some Deep Packet Inspection going on here, then? https://www.reddit.com/r/europe/comments/56h0s3/they_just_blocked_dropbox_in_turkey/d8jfvw5 https://www.reddit.com/r/europe/comments/56h0s3/they_just_bl... Is the blocking able to handle stuff like fragrouter where the TCP stream is broken down into 1byte payload packets?

nikcub 10y ago
We started seeing more sophisticated DPI capabilities after the Feb '14 internet regulations[0] that required ISPs to block by URL and content strings IMO blocking so many sites so broadly is a sign that their DPI is failing, because their preference seems to be to block as narrowly as possible because of negative economic effects. [0] http://aa.com.tr/en/turkey/turkey-s-general-assembly-ratifies-internet-bill/179203 http://aa.com.tr/en/turkey/turkey-s-general-assembly-ratifie...
- hueving 10y ago
  With ssl the best they can do is this host level blocking unless they perform mitm attacks.
  - metachris 10y ago
    > unless they perform mitm attacks Which any state-sponsored actor can easily do, of course.
    - MichaelGG 10y ago
      Please tell me how Turkey is going to MITM Google on a recurring basis, enough to implement filtering.
      - bumblebeard 10y ago
        By using a CA they control to generate a fake certificate for Google like they've already "accidentally" done: http://arstechnica.com/security/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/ http://arstechnica.com/security/2013/01/turkish-government-a...
        gruez 10y ago
        Which they can only pull off once before their CA is distrusted. See: how Chinese government CA was restricted to .cn domains only
kyrra 10y ago
Snort can at least get you close. A custom snort module maybe able to do the specific cert: https://www.snort.org/faq/readme-ssl https://www.snort.org/faq/readme-ssl It's stream5 preprocessor can deal with most evasion techniques as it does full tcp stream reconstruction. http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node17.html#SECTION00323600000000000000 http://manual-snort-org.s3-website-us-east-1.amazonaws.com/n...
- 0x0 10y ago
  But does that scale to ISP or even country level of traffic? Having enough RAM to reassemble all the TCP connections in a country sounds wild.
  - kyrra 10y ago
    Snort is now owned by Cisco (the company is formerly known as Sourcefire). It makes money via hardware integrated with snort. I think a single 3U box pushes 60Gbps. Though that number is highly dependent on the tuning for stream5 and other preprocessors. You don't need to reconstruct the entire stream, just enough to know what the connection is doing. Normally it's only a few packets per stream. Stream fragmentation has its own entire configuration in snort as it is a known attack method to bypass detection. Last I remember that top end box was 2x 12 or 16 core Xeon CPUs with 256GB ram.

by 0x0 10y ago

nikcub 10y ago

We started seeing more sophisticated DPI capabilities after the Feb '14 internet regulations[0] that required ISPs to block by URL and content strings IMO blocking so many sites so broadly is a sign that their DPI is failing, because their preference seems to be to block as narrowly as possible because of negative economic effects. [0] http://aa.com.tr/en/turkey/turkey-s-general-assembly-ratifies-internet-bill/179203 http://aa.com.tr/en/turkey/turkey-s-general-assembly-ratifie...

hueving 10y ago
With ssl the best they can do is this host level blocking unless they perform mitm attacks.
- metachris 10y ago
  > unless they perform mitm attacks Which any state-sponsored actor can easily do, of course.
  - MichaelGG 10y ago
    Please tell me how Turkey is going to MITM Google on a recurring basis, enough to implement filtering.
    - bumblebeard 10y ago
      By using a CA they control to generate a fake certificate for Google like they've already "accidentally" done: http://arstechnica.com/security/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/ http://arstechnica.com/security/2013/01/turkish-government-a...
      - gruez 10y ago
        Which they can only pull off once before their CA is distrusted. See: how Chinese government CA was restricted to .cn domains only

kyrra 10y ago

Snort can at least get you close. A custom snort module maybe able to do the specific cert: https://www.snort.org/faq/readme-ssl https://www.snort.org/faq/readme-ssl It's stream5 preprocessor can deal with most evasion techniques as it does full tcp stream reconstruction. http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node17.html#SECTION00323600000000000000 http://manual-snort-org.s3-website-us-east-1.amazonaws.com/n...

0x0 10y ago
But does that scale to ISP or even country level of traffic? Having enough RAM to reassemble all the TCP connections in a country sounds wild.
- kyrra 10y ago
  Snort is now owned by Cisco (the company is formerly known as Sourcefire). It makes money via hardware integrated with snort. I think a single 3U box pushes 60Gbps. Though that number is highly dependent on the tuning for stream5 and other preprocessors. You don't need to reconstruct the entire stream, just enough to know what the connection is doing. Normally it's only a few packets per stream. Stream fragmentation has its own entire configuration in snort as it is a known attack method to bypass detection. Last I remember that top end box was 2x 12 or 16 core Xeon CPUs with 256GB ram.