29 ms·

So is this app using some other protocols that aren't DNS/http(s) that would make it immune to a dns level block? Because a native app that makes http calls is

So is this app using some other protocols that aren't DNS/http(s) that would make it immune to a dns level block? Because a native app that makes http calls is just as easy to block as a pwa

patrakov 5y ago
The app uses the same technology as some trojans: it connects to different pseudorandomly-generated domain names under Cloudflare protection, changing at least several times per day.
- maccard 5y ago
  The client still needs to receive those domains somehow though, and that's the tricky bit. Unless the domains are unique per user, the blocker can just install the app and block the domains as they change.
  - vadfa 5y ago
    You can embed the domains in the app, obfuscated. It's not foolproof but as long as they can't crack it in the few days that are left until the election...
- aasasd 5y ago
  Is there a name for this technique, or a thorough description of it somewhere? So that I could put it in my bookmarks & notes.
  - patrakov 5y ago
    Domain Generating Algorithm. https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/ https://blog.malwarebytes.com/security-world/2016/12/explain... Although in this case, the generated domains are all under global.ssl.fastly.net and similar CDNs, not traditional TLDs.
    - aasasd 5y ago
      Thanks!
jsn 5y ago
Not really. You can use whatever you like, the possibilities are endless. AFAIU, the most straightforward approach would be to use Android / IOS push notifications (which can't be easily blocked) to regularly push a constantly changing (to avoid censorship) URL of your backend API servers to the mobile apps.
- maccard 5y ago
  Unless those urls are unique per user, then the response to that is for the blocker (Russia in this case) to install the app and block the URLs as they change
  - jsn 5y ago
    They don't have to be strictly unique per user. You can send out different sets of URLs to different cohorts of users, then correlate new URL blockings with client IDs to detect rogue app installations and excommunicate them. Telegram did that when Russia tried (unsuccessfully) block it.
    - maccard 5y ago
      Given this is an app for tacical voting over a 2 day period (which has now passed) all the adversary needs to do is block it for a couple of days. Dns blocking cloudflare for 2 days would pretty much stop this in it's tracks. (You are right about not requiring completely unique urls per user by the way).
      - jsn 5y ago
        No, it (again) doesn't work like this at all. 1) DNS blocking of cloudflare is useless, you can receive IPs, or names in non-cloudflare zones, 2) IP blocking of the whole cloudflare will bring so much collateral damage (unrelated services going down) that it's a non-starter, politically speaking, 3) cloudflare is far from the only mass frontend / cdn available, there are hundreds high-collateral services out there.

So is this app using some other protocols that aren't DNS/http(s) that would make it immune to a dns level block? Because a native app that makes http calls is just as easy to block as a pwa

patrakov 5y ago

The app uses the same technology as some trojans: it connects to different pseudorandomly-generated domain names under Cloudflare protection, changing at least several times per day.

maccard 5y ago
The client still needs to receive those domains somehow though, and that's the tricky bit. Unless the domains are unique per user, the blocker can just install the app and block the domains as they change.
- vadfa 5y ago
  You can embed the domains in the app, obfuscated. It's not foolproof but as long as they can't crack it in the few days that are left until the election...
aasasd 5y ago
Is there a name for this technique, or a thorough description of it somewhere? So that I could put it in my bookmarks & notes.
- patrakov 5y ago
  Domain Generating Algorithm. https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/ https://blog.malwarebytes.com/security-world/2016/12/explain... Although in this case, the generated domains are all under global.ssl.fastly.net and similar CDNs, not traditional TLDs.
  - aasasd 5y ago
    Thanks!

jsn 5y ago

Not really. You can use whatever you like, the possibilities are endless. AFAIU, the most straightforward approach would be to use Android / IOS push notifications (which can't be easily blocked) to regularly push a constantly changing (to avoid censorship) URL of your backend API servers to the mobile apps.

maccard 5y ago
Unless those urls are unique per user, then the response to that is for the blocker (Russia in this case) to install the app and block the URLs as they change
- jsn 5y ago
  They don't have to be strictly unique per user. You can send out different sets of URLs to different cohorts of users, then correlate new URL blockings with client IDs to detect rogue app installations and excommunicate them. Telegram did that when Russia tried (unsuccessfully) block it.
  - maccard 5y ago
    Given this is an app for tacical voting over a 2 day period (which has now passed) all the adversary needs to do is block it for a couple of days. Dns blocking cloudflare for 2 days would pretty much stop this in it's tracks. (You are right about not requiring completely unique urls per user by the way).
    - jsn 5y ago
      No, it (again) doesn't work like this at all. 1) DNS blocking of cloudflare is useless, you can receive IPs, or names in non-cloudflare zones, 2) IP blocking of the whole cloudflare will bring so much collateral damage (unrelated services going down) that it's a non-starter, politically speaking, 3) cloudflare is far from the only mass frontend / cdn available, there are hundreds high-collateral services out there.