8 ms·
I have some close acquaintances in BY, so this has been hard. We saw that (at least as of 8 PM UTC) outbound connections to HTTP servers wasn't really a proble
by yabones 6y ago
I have some close acquaintances in BY, so this has been hard.
We saw that (at least as of 8 PM UTC) outbound connections to HTTP servers wasn't really a problem. A fresh ec2 box with a basic web server wasn't effected.
So, early yesterday I set up an OpenVPN server on ec2 (eu-west-1) to try to get some slow but functional internet access. What we saw was that about 15-30 seconds after the TLS handshake the connection would stall and drop out. To me this says they're doing some deep packet inspection to find TLS and dropping those firewall states. I also noticed while running `tcpdump` that almost every tcp segment from a BY address had incorrect CRC's after the IDS kicked in.
Tonight we're going to try using an xor tcp proxy to obfuscate the VPN traffic. The system we're using has a name, but I'm not going to say it to risk KGB (yes it's still called that there) creating IDS signatures and killing our VPN. I'm sure that after a few hours it will start dropping these connections as well, but if we can buy some time that's worth while.
This, really, is the real problem with the internet. In many small countries there's only one IX, often under government ownership or supervision. You might think that they know better than to do stuff like this, but push comes to shove they'll all lock it down as soon as there's a threat to their authority.
- baybal2 6y agoDo you have a clue on physical location of this middlebox?
- yabones 6y agoNot sure. My information is largely based on observations made by people that live or have lived in BY. It's sort of common knowledge there that regardless which ISP or carrier you're on there's always one hop in common when traceroute'ing outside of the country.
- dylz 6y agoAs far as I can tell, virtually every network marked BY has a common transit or peer of AS6697 Republican Unitary Telecommunication Enterprise Beltelecom
- baybal2 6y agoAny Belorussian ASes behind it?
- dylz 6y agoAssuming the index of 144 total ASNs is correct marked BY, there are a handful of cloud providers/university systems (that I can count in one hand) that might have their own connectivity, but anything remotely advertised as eyeball goes through "Beltelecom" or "Business Network Ltd" (which in turn goes through "Beltelecom" or "National Traffic Exchange Center" (60330)) At a casual glance, look at how Beltelecom is one of the very, very few that has any international peers just based on the flags: https://bgp.he.net/AS6697#_peers https://bgp.he.net/AS6697#_peers Then look at the others: https://bgp.he.net/AS12406#_peers https://bgp.he.net/AS12406#_peers https://bgp.he.net/AS60330#_peers https://bgp.he.net/AS60330#_peers https://bgp.he.net/AS25106#_peers https://bgp.he.net/AS25106#_peers This is similar to to Iran's ITC/TIC (there's a handful of them, pop in 12880, 49666, 48159, etc. onto bgp.he for a quick look) where they are the in-between to international peers and domestic peers.
- mimi89999 6y agoMaybe protesters should set up some mesh to keep the information flow and coordination if the internet will be cut completely.
- anonymfus 6y agoCurrently there is no need for this as Telegram messages still work and Telegram channel network NEXTA (https://t.me/nexta_tv https://t.me/nexta_tv, from Belarusian word Нехта (someone), pronounced [ˈnʲexta](nyekhta), see https://be.wikipedia.org/wiki/Сцяпан_Аляксандравіч_Пуціла https://be.wikipedia.org/wiki/Сцяпан_Аляксандравіч_Пуціла ) became the main tool for spreading news and coordination.
- pvg 6y agofrom Belarusian word Нехта I've been wondering why it's called that for the last few days, thanks! Curiously, it's not mentioned on the Russian NEXTA wikipedia page.
- mehrdadn 6y agoI don't get how XOR helps here? Isn't this stuff based on timing + length information?
- yabones 6y agoWell, it does more than just XOR but the goal is to just scramble the traffic enough that it looks like a bunch of nonsense rather than a TLS handshake. The actual VPN provides the encryption, this layer adds a socket on top that garbles up the data.
- mehrdadn 6y agoAh ok that makes more sense, thanks.
- Waterluvian 6y agoWhat are the odds this is some western commercially packaged product that lets them do all this? Like some Sandvine stuff or whatever.
- xenospn 6y ago100%
- stjohnswarts 6y agoThe Chinese are also rather good at shutting down the internet as well. why not blame all possible parties?
- Scoundreller 6y agoDoes China sell/license/supply their GFW tech to anyone? Sandvine seems to sell to anyone that tear gas fabricators will sell to (Oh, you'll use this against your own citizens and that's legal because you wrote the law? Great, just check this box!).
- jariel 6y ago"why not blame all possible parties?" 10 years ago I would have said 'it's probably Western companies helping them'. Now, I would say probably it's Chinese. Frankly, because it's going to be so, so much cheaper, let alone it probably doesn't come with any potential political headaches, and, they are developing a 'core competency' in this. That said, Putin has serious geopolitical interest in Belarus, and himself is supportive of the regime. Since the Russian state is also 'good at that stuff' it could very well be a state-sponsored initiative. Finally, Belarus is not Venezuela, wherein they might have difficulty recruiting all the talent necessary to do this. Belarus has enough native talent to contemplate the task. But it'd be interesting to know 'who' is helping them do this.
- sueuu3rid8 6y agoFrankly, I don't see why it matters who is selling or managing the equipment. It's a pointless debate that misses the forest for the trees. Only children thought refusing to produce and export this kind of expertise would stop it from from proliferating. The demand and the money aren't going to go away because anyone in particular took the high road. Refusing to participate just means someone else gets the money.
- justinclift 6y agoIf udp connections are working, it may be feasible to proxy something over that.
- rigrassm 6y agoCurious if something like zerotier would be effective for a while.
- out_of_protocol 6y agoUDP is blocked completely or almost completely
- justinclift 6y agoICMP then?
- out_of_protocol 6y agointernet is restored, for now. There could be some ways to bypass blocking (e.g. SSH tunnel via TCP works just fine, unlike all popular proxy protocols), needs more investigation. Until next time then :/
- justinclift 6y agoAhhh. With SSH working you have options. :) If it happens again (but SSH still works), then to enable general web browsing you can: 1. Set up Squid (a proxy server) on a remote host. eg a VM in Digital Ocean. You may need to ask someone to do this for you, if you don't have a VM you can access remotely already. 2. Configure SSH to proxy traffic from your (desktop) web browser to that remote Squid server 3. Configure your browser (eg Firefox/Chrome) to use the new SSH proxy It sounds like you're familiar with the Linux or macOS command line, so you shouldn't have much trouble. I've done exactly this before, and it works reliably. Browsing speed is a bit slower than standard though, but not horrible. :)
- ardy42 6y ago> Tonight we're going to try using an xor tcp proxy to obfuscate the VPN traffic. You might want to pad the traffic too. IIRC, the GFW can detect many kinds of VPN connections based off of a sequence of characteristic packet lengths during the handshake.
- yabones 6y agoThat's a great idea! Unfortunately it looks like they've fully locked down their network since about 20:00 (EDT), so that will have to wait for tomorrow to try out.
- strls 6y agoPrivate OpenVPN definitely didn't work for the last 3 days, on any port.