21 ms·
Belarus finally bans Tor
- rudePolice 10y agoCould they use remote relays still?
- imaginenore 10y agoYou probably could do all kinds of things, but is it worth the risk of getting jailed?
- molloy 10y agoThe answer to that depends on the cause.
- eatbitseveryday 10y agoOnly if banned = illegal?
- cookiecaper 10y agoDepends on how serious the risk is. You run the risk of "getting jailed" for all kinds of minor crimes that people routinely commit. Are people actually going to get arrested for trying to use Tor? I don't think that's very plausible. You could pretty easily claim it was malware trying to make the connection and you don't know anything about it.
- jlgaddis 10y agoYeah, you could claim that. Then, they search your computer and find no traces of malware but they find a copy of the Tor Browser Bundle. Now what? Besides, law enforcement never just "takes your word for it". I've got a lot of friends in law enforcement and -- as far as "suspects" go -- they'll pretty much (attempt to) verify every claim you make.
- cookiecaper 10y agoPlausible deniability/difficulty of conviction means that LEOs rarely pursue cases where that would apply. I agree once they open an investigation, they'll verify the claim; I'm saying that crimes that have high acquittal rates and/or low prosecutorial uptake will get less attention from the police because it's frustrating/difficult/wasteful to spend a lot of time on things that don't usually pan out. I don't know how the system works in Belarus so I understand it may not really matter there. The point is that it's going to be difficult to prove that the accused made an intentional connection to Tor as long as the accused and/or his/her lawyer has some technical literacy and knows what to say.
- kbart 10y agoIt's Belarus, police and laws work quite differently there.
- ttmprow 10y agoThe article says it's only direct connections to public relays that are being interrupted, so plain ordinary connections (ie. not even using a pluggable transport) to a bridge still works.
- gtirloni 10y agoWhy "finally"? From a quick search it seems a shot at Belarus' desire to ban Tor back in 2015 but only now achieving it.
- verandaguy 10y agoThat's the point. The article itself mentions that Belarus had officially ratified (not implemented) a law blocking Tor in February 2015, but only now is it actually being implemented.
- gtirloni 10y agoSorry, I missed that although it's in the very first line.
- EGreg 10y agoLukashenko has to get around to it lol
- ChuckMcM 10y agoI wonder about the first RST with zeros in the sequence and acknowledge fields. Probably just bad software but if it is always the first RST it could be a sort of canary such that people in the "know" could note the malformed reset and pre-program a 'ignore RST this session' bit.
- jandrese 10y agoI guess they had to custom build a solution for this and screwed it up. The weird thing is that it seems like this should have been caught in testing. Unless it is a form of silent protest from the hapless programmers forced to write this oppression aid. Might even be some IOCCC level trickery at play here where it works in testing and with official IP addresses, but doesn't work for the majority of the population.
- flevo 10y agoI thought we aren't supposed to talk politics on HN anymore..
- grzm 10y agoThe week-long experiment was terminated early. See https://news.ycombinator.com/item?id=13133855 https://news.ycombinator.com/item?id=13133855
- darkstar999 10y agoEven if it was still in effect, I think this would be fair game. ... and this is why they lifted the restriction early.
- beedogs 10y agoWhat a terrible decision that was. Glad it was reversed. It never would've worked.
- dang 10y agoIt did work. The "decision" was to try changing the rules for a short time to see what we could learn by doing so, and we learned a lot. We ended it early because (a) the learning stabilized and (b) there were costs to continuing. It's strange to me that so many people heard "just for a week" as "forever" and are continuing to comment as if those mean the same thing. The internet is weird.
- chippy 10y agoWill you be making a "Tell HN" saying the experiment has ended with your thoughts? Are you okay replying to comments by users who do not know the experiment has ended? I would be comparing a) data after the first announcement b) data after your comment in an unrelated thread saying the experiement is over c) data after the week is over and d) data after you write the promised lessons learnt post.
- dang 10y ago
- netule 10y agoIs it possible for anyone to share the full text of the post for those of use behind a great firewall? Edit: thanks!
- willvarfar 10y agourandom.pcap: Belarus (finally) bans Tor Leonid Evdokimov 2016-12-08 00:00:00 +0000 UTC Country: Belarus Probed ISPs: Beltelecom (AS 6697) Censorship method: TCP injections We have recently heard of network anomalies in Belarus. Tor has been finally blocked in December 2016, although it had been explicitly declared that Tor should be blocked since February 2015. Directly connected users from Belarus An anonymous cypherpunk has helped to gather some evidence regarding Tor being blocked in Belarus. It’s neither a complete study nor an in-depth research and it’s unclear if any other further evidence will be gathered, so we decided to share current knowledge as-is: Tor directory authorities are not blocked Public onion routers have their ORPort blocked by TCP RST injection The onion routers’ DirPort is not blocked Plain-old non-obfuscated Tor Bridges from BridgeDB circumvent the interference Beltelecom (or its upstream) has strange configuration of the networking gear injecting reset packets The strangeness in equipment is the following. The first injected RST packet does not have have proper SEQ/ACK numbers. These packet fields are just filled with zeroes. So this packet is dropped by the client’s TCP/IP stack per RFC5961 and does not actually terminate the client’s connection: $ tshark -Tfields -eframe.time_relative -eip.src -etcp.srcport -eip.dst -etcp.dstport \ -eip.ttl -etcp.flags.str -etcp.seq -etcp.ack -r urandom.pcap | sed | awk | perl 0.000000 192.168.1.2 42555 87.118.94.227 443 64 **********S* 899897236 0 0.029459 87.118.94.227 443 192.168.1.2 42555 125 *********R** 0 0 (sic!) 0.096914 87.118.94.227 443 192.168.1.2 42555 52 *******A**S* 1984028404 899897237 0.096958 192.168.1.2 42555 87.118.94.227 443 64 *******A**** 899897237 1984028405 0.136874 87.118.94.227 443 192.168.1.2 42555 125 *********R** 1984028405 0 That’s all for today. Remember, fried potato is better with onion!
- varjag 10y ago("fried potato" is a reference to cliché Belarusian obsession with potato)
- lorenzop 10y agoCan someone please explain the "fried potatoes are better with onion"? Is this an in-joke? A secret key? Many potatoes, -l
- zitterbewegung 10y agoOnion routing probably. TOR stands for the onion router .
- lorenzop 10y agoYES! get in lads
- catfood 10y agoEastern Europe eats a lot of potatoes. Onion = Onion Router
- erikpukinskis 10y agoIt's just a good reminder.
- notdang 10y agoFrom wikipedia: In the Soviet Union, Belarusians were sometimes called bulbashi, a pejorative conjugation of the Belarusian word for potato.
- tetromino_ 10y agoThat's because Belarusians eat a lot of potatoes. The per capita potato consumption there is probably the highest in the world: http://www.fao.org/potato-2008/en/world/ http://www.fao.org/potato-2008/en/world/
- tomjakubowski 10y agoFunny, I was just reading about how non-German residents of Germany use "Kartoffel" (potato) as a perjorative for Germans in Germany. I didn't realize "potato" was such an effective insult it would exist in another country too!
- kahoon 10y agoI know very little of networking but I assume to perform a TCP reset injection attack, the ISP would need to rely on the IP address of the public onion routers. Now, why do they play around with the reset flag instead of just simply swallowing the packets directed at a tor router?
- marshray 10y agoBecause effectively blocking packets at requires supervising all routes through which they might escape (i.e., managing a lot of dynamic rules on a lot of very critical routers), whereas injecting forged packets only requires one little box. Kinda like the Berlin Wall. Easier to shoot people attempting to cross than hermetically seal the entire border.
- openasocket 10y agoI don't quite follow. You can't inject an RST packet unless you know someone is trying to connect to a Tor node, so you still need to supervise all the routes, right?
- betaby 10y agoAnd ignoring RST may work. In fact that method worked against earlier implementations of the great firewall of China.
- detaro 10y agoYou can sniff the traffic out-of-band, possibly implement it on already existing spy/monitoring infrastructure.
- spydum 10y agoDifference is I can do traffic analysis and RST generation over lots of machines (if it gets slow, worst case my RST gets there late). Changing routes/forwarding table action has to happen on machine moving large data, in real time.
- anigbrowl 10y agoComing soon to a jurisdiction near you!
- mavdi 10y agoYup, UK next.
- anigbrowl 10y agoRace you edit: in the interests of clarification, this means I expect to see attacks on Tor within the US before the UK.
- SomeStupidPoint 10y agoThe US is too busy using TOR as a honeypot and offensive weapon to shut down access. TOR actually amplifies the asymmetry betweem the NSA and smaller actors: the NSA by owning the whole network can easily break it, but it prevents smaller players from getting the same access. Of course, the FBI seem to routinely compromise TOR sites they don't like.
- dleslie 10y agoUsually via traditional investigative means.
- mirimir 10y agoAnd then they exploit Firefox bugs to drop phone-home malware on users. But so far, it's only been Windows malware :) And it relies on bypassing Tor's socks proxy.
- rblatz 10y agoIf you truly wanted anonymity why wouldn't you buy a $35 raspberry pi and stuff it between your computer and the internet and route all traffic through it through tor? Too many zero days out there in browsers, flash, java, office not to mention configuration slip ups that could nullify your tor protection.
- ncdr 10y agoWall Street Journal is actually praising Belarus: http://www.wsj.com/articles/belarus-is-emerging-as-the-silicon-valley-of-eastern-europe-1481032802 http://www.wsj.com/articles/belarus-is-emerging-as-the-silic...
- okocha 10y agoWhen I read your comment it made it seem like the WSJ was praising Belarus for banning Tor, which is not the case. (at least from reading the portion of the article that is not behind a paywall)
- anigbrowl 10y agoNot for banning Tor, but I get the impression that if that had happened in time they'd have thrown it in there as a positie. And many in Belarus said the country’s reputation as Europe’s last dictatorship is no hindrance to their work. “Success stories and a business’s scalability are more important than politics,” said Nick Vyhouski [...] Charming.
- varjag 10y agoThis is a PR piece by Belarus national tech hub development agency. And they still put caveats about dictatorship and all.
- niij 10y agoNo paywall: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0ahUKEwjK556hvefQAhULwmMKHduVAoUQFggcMAA&url=http%3A%2F%2Fwww.wsj.com%2Farticles%2Fbelarus-is-emerging-as-the-silicon-valley-of-eastern-europe-1481032802&usg=AFQjCNF6EULFPe2Ohs8ZyJMA29DYS2btIg https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...
- okocha 10y agoThis reminds me of a paper I read recently about the techniques that China employs to block Tor and other anonymity servers. Great read, especially the annotated version: http://fermatslibrary.com/s/examining-how-the-great-firewall-discovers-hidden-circumvention-servers http://fermatslibrary.com/s/examining-how-the-great-firewall...
- zenlikethat 10y agoI found a PDF version for those interested: http://conferences.sigcomm.org/imc/2015/papers/p445.pdf http://conferences.sigcomm.org/imc/2015/papers/p445.pdf
- myf01d 10y agoup next: your country too
- dang 10y agoPlease don't post unsubstantive comments to HN.
- deepsun 10y agoI'm from Belarus. Belarus laws and politics had been for a long time a playground for Russia. Kinda "before implementing it for all users in production, let's try it on a smaller audience to see if it works or not." So this ban is mostly an exercise for Russia, to get some experience.
- Proof 10y agoI'm from Finlan ld but visting the US, till February and I have a feeling US will watch Belarus very closely to see if it is successful thrn will try to quietly implement a ban or interfere with Tor as best as they can. Rule 41 is a mere Apptizer. The Americans have yet to receive their Entrés. What's even more scary is the radical laws being fought for in Canada as of today.
- rblatz 10y agoI doubt it, the US government invented and has been a major sponsor to the tor project. https://pando.com/2014/07/16/tor-spooks/ https://pando.com/2014/07/16/tor-spooks/
- whybroke 10y agoHistorically yes. But I suggest bookmarking this comment and coming back to it in a few years to see how prophetic or absurd it turns out.
- wruza 10y agohttps://xkcd.com/628/ https://xkcd.com/628/
- whybroke 10y agoReally? A cartoon about the Jeane Dixon fallacy is a response? I think you're going to find the next years very surprising indeed. Even now, using tor is de facto grounds for a wiretap[1] And I apologize in advance if my evidence is actually on topic and doesn't have funny pictures. [1]https://techcrunch.com/2016/12/05/section-702-mohamud-appeals-ruling/ https://techcrunch.com/2016/12/05/section-702-mohamud-appeal...
- darkhorn 10y agoThey are late. Turkey already did it few weeks ago.
- madaxe_again 10y agoWe are talking about a political ban, on politics detox week. Why is this thread still here? I see nothing about security or routing technology, just reportage on the actions of a government - politics.
- grzm 10y agoThe week-long experiment was terminated early. See https://news.ycombinator.com/item?id=13133855 https://news.ycombinator.com/item?id=13133855
- chippy 10y agoAnd yet it's almost as if there's been no announcement of this and people still think it's going on. I wonder what the flagging behaviour is?
- grzm 10y agoIf you see people who are questioning the status of the detox week, I encourage you to let them know and point them to the thread I did above.
- dang 10y agoSorry I didn't see this earlier (your comment defeated my search queries). Flagging behavior appears to have returned to normal surprisingly quickly.
- socmag 10y agoGot me thinking about hidden communication techniques using DNS queries or ICMP as the "transport" layer. That would confuse the hell out of everyone :P
- Nemo157 10y agoIP-over-DNS: http://code.kryo.se/iodine/ http://code.kryo.se/iodine/
- amnezia 10y agoThere are VPN solutions that work over ICMP https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#1.6._VPN_over_ICMP.2C_and_VPN_over_DNS_(Awesome!) https://www.softether.org/1-features/1._Ultimate_Powerful_VP...
- kbart 10y agoBoth techniques are known and have effective counter-measurements. While it might work for a while, as soon as such "exotic" solutions get more widespread, it can be banned and filtered too (just few more rules to firewalls/IDs). China is a great example of this mouse&cat game.
- alexellisuk 10y agoFunnily enough I can read the comments here but my employer's filtering proxy (Blue Coat) blocked the torproject.org ;-)
- florenciaa 10y agoBelarus is just making sure Belarusian workers stay productive with that Tor ban just like in BlueCoat.
- abhineet97 10y agoOpening this website in Chrome on my Android device gives me the "ERR_CERT_AUTHORITY_INVALID" error. Checking the certificate details, I found out that the certificate is issued to the organization "OpenDNS, Inc." I use OpenDNS's family safety DNS. I don't think that TOR is owned by OpenDNS. Is it possibly that OpenDNS is MITMing me like previously Avast was reported? But how is that possible? I don't have any OpenDNS software installed that could change certificates.