19 ms·

Iran Shuts Down Major Websites and Https Protocol

399 points by Sara70 15y ago

I'm writing this to report the serious troubles we have regarding accessing Internet in Iran at the moment. Since Thursday Iranian government has shutted down the https protocol which has caused almost all google services (gmail, and google.com itself) to become inaccessible. Almost all websites that reply on Google APIs (like wolfram alpha) won't work. Accessing to any website that replies on https (just imaging how many websites use this protocol, from Arch Wiki to bank websites). Also accessing many proxies is also impossible. There are almost no official reports on this and with many websites and my email accounts restricted I can just confirm this based on my own and friends experience. I have just found one report here: http://kabirnews.com/iran-shut-down-gmail-google-yahoo-and-sites-using-https-protocol/202/ The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow. I just wanted to let you guys know about this. If you have any solution regarding bypassing this restriction please help!

cicloid 15y ago
Is Tor still working?
- Sara70 15y ago
  I used to use Tor with firefox before but with my internet connection it was very slow.
  - cicloid 15y ago
    Sadly from what I know, that's because of the lack of nodes. But you can volunteer! https://www.torproject.org/getinvolved/volunteer.html.en https://www.torproject.org/getinvolved/volunteer.html.en
rd108 15y ago
Does anyone know how they "shut down https"?
- gsa 15y ago
  Probably means port 443 is blocked.
  - nathan_f77 15y ago
    Way more sophisticated than that. See http://news.ycombinator.com/item?id=3575269 http://news.ycombinator.com/item?id=3575269
- Wilya 15y ago
  I guess they block all SSL connections, or all least all those targetting unknown (non governement-approved) hosts.
- emilsedgh 15y ago
  They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
  - haakon 15y ago
    Is it just by port, or do they detect SSL traffic at any port, and then block it?
    - emilsedgh 15y ago
      They have packet inspection and detect encrypted traffic on any port.
  - Simon_M 15y ago
    Is their filtering on a per TCP port basis? Or more advanced packet inspection?
  - Jach 15y ago
    How do they distinguish an encrypted connection from a non-encrypted connection? How do they know those indecipherable bits are an encrypted message vs. a part of an image or video? I suspect they just block domains and IPs and common ports or they sniff for common handshakes and key exchanges and kill those.
zckevin 15y ago
We Chinese use VPN or SSH port forwarding.
- emilsedgh 15y ago
  They drop all encrypted connections. Which means you cant even make a VPN or SSH connection.
  - kokey 15y ago
    Which basically means you need to do encryption in a manner that doesn't look like encryption, inside of something that's unencrypted. For example over DNS, inside of HTTP, or other protocols designed for moving code like RPC.
    - chernevik 15y ago
      Maybe embed the cipher text in files for images, video or music?
deleted 15y ago
[deleted]
dutchbrit 15y ago
And here I was, about to ask HN to force SSL on the login page..
- pooriaazimi 15y ago
  Please... don't. I have enough trouble with GitHub right now. Those guys enforce SSL not only on login page, but on all pages - yesterday it took me 2 hours to clone a github project (that was only 30k).
forcer 15y ago
I am really passionate about this problem. We are currently working on the VPN solution for consumers and I could dedicate some of our servers for this to develop a VPN that would work when governments shut down encrypted connections. where should we start? it it even feasible to do a secured tunnel hidden in normal traffic undetected?
- jcromartie 15y ago
  You can tunnel anything over anything. You'd just start with a generic URI to negotiate the secure connection before sending the real requests/responses.
  - forcer 15y ago
    Yes - Already looking at this HTTP tunnel (http://www.nocrew.org/software/httptunnel.html http://www.nocrew.org/software/httptunnel.html) that someone else posted here. I am wondering whether this approach is better than the one someone else suggested - connecting to a streaming server (like OnLive) - I guess streaming server could be made more undetectable, but more expensive to run
- j_s 15y ago
  Undetected is the hard part; I'm not sure anyone currently has the cpu horsepower to analyze all traffic, but encrypted information has a high degree of entropy that is hard to hide even steganographically. http://en.wikipedia.org/wiki/Steganography_tools#Cryptography http://en.wikipedia.org/wiki/Steganography_tools#Cryptograph...
ck2 15y ago
Maybe http://m.gmail.com http://m.gmail.com ? What about ssh tunneling over an alternate port? Gosh I cannot believe governments that do this to their people. I wonder if they are ironically using American engineered equipment and software to do the block too.
- emilsedgh 15y ago
  They drop ALL encrypted connections. You cannot even make a normal ssh connection, since they drop the connection during handshake. (SSH has been disabled for a few months)
  - dasil003 15y ago
    What about ssh over port 80? I realize that would have to be set up in advance from outside the country, but the question is are they using port numbers to aid in their filtering or deep packet inspection?
    - gsa 15y ago
      If they are dropping all encrypted connections, it doesn't matter what port you use for ssh, it'll be dropped.
      - nkassis 15y ago
        How do they know it's encrypted? I mean would they block something that looks like gibberish but was plain text over port 80?
        Luyt 15y ago
        I like that idea. You could encode a block of octets with plain words. "\xC3\x08\x00\x23\xFA" would then actually travel on the wire as "Was named prefer to use the other especially in, every cast a chuckle on neithout getting. Into useful informash speech makes removing a featuring a move or usage actual considered!", and be decoded back at the other end. You'd have to use common words so it looks as innocuous as possible.
lorddfg 15y ago
That sucks, in Pakistan they're banning websites left and right, most of the websites can be accessed with Proxy but I have to use VPN just to upload files now. It's not only the porn websites they're banning, websites like pastebin etc. are getting axed as well. In short, if any website goes against their stupid and yes effed up ideals they will ban it. The ISP's can't do anything because they're forced to comply. Forget ACTA or SOPA, these idiots just do whatever they wish.
humanfromearth 15y ago
They control the physical network. As long as they have that control they will be able to do what they want. The only way to deal with these fuckers (not just Iran) is to start using collectively Ipsec or something similar. All SSL movement is just the beginning. I'm sure every big service will try to encrypt it's traffic more and more to protect itself from governments that try to criminalize their users. Forcing countries like China, Iran and US to go into dark ages if they don't use the new all encrypted networks. It's a shame that we are so paranoid as a species that we need to do that, but I don't see any other way. I know this is extreme, but I don't want to see the freedom I enjoy right now taken away by these obsolete power hungry entities.
- kiloaper 15y ago
  >Forcing countries like China, Iran and US to go into dark ages if they don't use the new all encrypted networks. The problem is some governments would be perfectly happy with that. In fact for the most repressive ones it's long term goal. China wants to create a separate internet for Chinese users and they're half way there. They have their own local censored versions of Google, Twitter and Facebook. Soon most internet users in China won't care if the rest of the internet disappears. Likewise for Iran, except they have been more open about it [1]. [1] http://online.wsj.com/article/SB10001424052748704889404576277391449002016.html http://online.wsj.com/article/SB1000142405274870488940457627...
  - chernevik 15y ago
    Maybe but they'll lose the productivity gains from networked organizations and communities. China can grow a long way without those gains, but they'll eventually hit a wall.
    - kiloaper 15y ago
      >Maybe but they'll lose the productivity gains from networked organizations and communities Absolutely but the effect will be not be huge in my opinion because of the language differences. All my Chinese friends here in the EU still use mainly Chinese language website, most of which are based in China, especially the social networking ones.
soult 15y ago
FYI, Jacob Applebaum just asked[1] people to set up TOR bridges using a new protocol called obfsproxy[2]. 1: https://twitter.com/#!/ioerror/status/167922546807812096 https://twitter.com/#!/ioerror/status/167922546807812096 2: https://www.torproject.org/projects/obfsproxy-instructions.html.en https://www.torproject.org/projects/obfsproxy-instructions.h...
- oneofthose 15y ago
  I would be willing to set up a bridge but how can we get the bridge IPs to those who need them?
  - tshtf 15y ago
    See https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html https://lists.torproject.org/pipermail/tor-talk/2012-Februar... Currently if you run such a bridge, you'll either need to manually tell us (via email to tor-assistants at torproject.org ) about it or you'll need to share these bridges with people you want to help directly. It's a pain and we're working on it.
- Monotoko 15y ago
  Would a TOR exit relay be better than a bridge?
  - nfriedly 15y ago
    In general, yes. In this specific scenario, without the obfsproxy bridges, people in Iran may not be able to connect to TOR at all, in which case an exit node won't help them very much.
teopeurt 15y ago
Realise ALL encryption handshake are blocked but Maybe this might work. https://github.com/stealth/sshttp https://github.com/stealth/sshttp You do need a server on the 'outside' though. (oh bugger, github uses https)
csomar 15y ago
I'm grateful for the Tunisian revolution. Internet Censorship (including ports disable) is at 0. The court justice has ordered to censor a few pages (because of some reasons) but the Global Internet provider in the country did not accept. The head of this agency is also working that the law prohibits any kind of censorship for any reasons. He was responsible for censoring content in the Ben Ali era, but he now thinks that it just doesn't make sense. The problem is, with the people (in the court or the gov.) who don't understand how the Internet works.
- kokey 15y ago
  I'm not seeing much bad news coming out of Tunisia post revolution. I'm tempted to visit it.
  - AndyJPartridge 15y ago
    I did last October, from the UK. Cracking price. The one main memory I have is leaving my iPhone, with my hotel room key-card inside the case, in a Taxi. The driver searched for me for 30 minutes to return it. Great people, and I love the barter culture.
  - csomar 15y ago
    It's relatively stable. Politically, it's fine. Economically it is struggling, but not much. Prices for tourists should be reduced as Andy mentioned since it's the recession for hotels and agencies. Internet is pretty slow (I use a 3G which runs on around 1Mb/sec and costs around $20/month), the infrastructure is poor, the people are either struggling or confused how all these structural problems could get solved. Not a great place to be in, honestly. If you are in Europe and looking for some Sun, then may be it's a deal for you considering the cost. If you happen to make a travel, I added my phone number. I'm moving to the capital this summer, and if I happened to purchase a car, I'll take you in a free drive around the capital and Hammamet.
sycren 15y ago
Are there any solutions for web browsing like Onlive (http://www.onlive.co.uk/ http://www.onlive.co.uk/) does for video gaming? It would be significantly harder for them to datamine a video stream..
- kristofferR 15y ago
  That is actually how the iOS Flash players like iSwifter and Photon works. It's just a video stream (seen from weird MPEG-compression artifacts) to a Linux VM running Firefox.
  - sycren 15y ago
    So would this not be ideal for getting through government censors?
    - forcer 15y ago
      My impression is that it could be ideal - but it needs much more bandwidth on the client side, as well as server side - making it expensive to run
      - sycren 15y ago
        But perhaps for sites which are static (in animation) and not interactive like gmail and other email systems it may perform well.
bwarp 15y ago
This is why good old analogue amateur or personal radio should still be a powerful force for people who are rebelling against their governments and corporate overlords. The Internet is easy to kill, as are digital cell-based radio networks. Proper amateur radio is not. Jamming is not that effective over a large area before anyone suggests that.
- ajarmoniuk 15y ago
  but it's easy to triangulate the broadcaster and take measures (imprison, torture, kill). I lived through the communist era in Poland. Amateur radio stations were banned and prosecuted (you would go to jail), even possession of a CB radio was a crime. Things may be similar in Iran.
  - VMG 15y ago
    I'd imagine that in principle, any wireless communication with simple technology and therefore little infrastructure is still more robust than complex, wired technology with high infrastructure needs.
  - yread 15y ago
    I would guess that Internet without HTTPS and SSL is much more traceable than a radio. Also if the authorities don't know there is encrypted radio communication going on they would have hard time finding out about it
  - bwarp 15y ago
    It's not that easy and there are simple anti-triangulation countermeasures you can use. It's possible to drop decoy transmitters/relays, which are easy enough to knock up and are cheap. You can also use refraction to "bounce" HF radio waves off the ionosphere to mask the source. You can scramble the signals. You can disguise the signals as legitimate but include carrier data. There are lots of ways of hiding what you are doing. As usual, if you don't take precautions, that will happen. Pirate radio stations were and still are common in the UK, particularly around London. They move around regularly and broadcast for short periods so it's hard to trace or predict a location. The same conditions apply here.
mrud 15y ago
If you can't believe that governments are using deep packet inspection and block access to popular sites have a look at the 28C3 talk How governments have tried to block Tor - http://www.youtube.com/watch?v=DX46Qv_b7F4 http://www.youtube.com/watch?v=DX46Qv_b7F4 it covers different governments and how they tried to block access to the TOR network
tetha 15y ago
So its time to grab our steganography handbooks and build a cute little animal picture channel patch for open ssh.
bbrizzi 15y ago
Pure speculation here, but would it be possible to use some kind of exotic Content-encoding HTTP header to avoid the DPI checks? Of course it would also have to be implemented on the server-side but that's another problem.
ya3r 15y ago
I live in Iran. The fact about the shut down is correct. I would also add that secure connection to servers inside Iran is possible. I've tried some, and they work. But trying to connect to services like Github and PivotalTracker, which we relay on in our starup, results in no response. Also I will note that the ssh protocol is the same. I can ssh into my university machine (inside Iran) but I can't access my rackspace VPS with ssh for example. One thing to add is that `Sara70` creator of this thread, mentions some non-related reason for this (The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.) which is wrong. Here nobody officially said anything about this. But as this shutdown is getting more attention in the media, I suspect this issue to get resolved soon.
- tomjen3 15y ago
  Are you inside Iran right now?
  - ya3r 15y ago
    Yes
- aaronblohowiak 15y ago
  >One thing to add is that `Sara70` creator of this thread, mentions some non-related reason for this (The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.) which is wrong. How do you know this?
  - ya3r 15y ago
    I ask the same. How does she know this? I know this because, this trend (shutting down secure network protocols) started on and off, like 1 year ago.
    - cjbprime 15y ago
      As I understand it, that was slowing down (like 10x) of SSL, not disabling it completely. It could have simply been a live test of the mechanism they're using right now, and they could be deploying the mechanism right now because of the anniversary. (Or because of Kim Jong-Un's death ;-)
alkasir 15y ago
Do SOCKS proxies work at all? One can test if they work. Xroxy.org is a good place to start. Email me at admin(at)alkasir.com to send you free socks proxy servers for testing.
- pooriaazimi 15y ago
  No, they don't. But thanks for the offer.
sepent 15y ago
Moreover, SSH has stopped working, too. But, finally I found a way to circumvent it. A simple twist in the client side, could simply bypass the filtering. I wrote a simple script to do this, and I would like to share it with all of my countrymen: https://launchpad.net/~mohammad-sepent/+archive/ppa/+packages https://launchpad.net/~mohammad-sepent/+archive/ppa/+package... To use it, just replace ssh command with issh like this: issh user@hostname [other-ssh-options]
- j_s 15y ago
  Where is the link to the required changes? Binaries = scary. Also, an SSL link doesn't seem useful?
  - kiloaper 15y ago
    I took a look at it. It's not a binary. It's a python file (easily readable) that acts as a wrapper for ssh. Extract the contents of the tar.gz[1] for example to see it. It's great if it works because it apparently doesn't need changes to the remote ssh server. [1] https://launchpad.net/~mohammad-sepent/+archive/ppa/+files/issh_0.0.1.tar.gz https://launchpad.net/~mohammad-sepent/+archive/ppa/+files/i... Edit: Non SSL link: http://ppa.launchpad.net/mohammad-sepent/ppa/ubuntu/pool/main/i/issh/ http://ppa.launchpad.net/mohammad-sepent/ppa/ubuntu/pool/mai...
    - j_s 15y ago
      Thanks for digging into this.
  - sepent 15y ago
    To install it under ubuntu: sudo add-apt-repository ppa:mohammad-sepent/ppa sudo apt-get update sudo apt-get install issh For other distros you can grab the .deb or the source package from the given link.
- pooriaazimi 15y ago
  Ironically, I can't access your script (it's https!). I'd be thankful if you could just copy/paste it here.
deno 15y ago
Is it possible to bypass their physical network altogether? For example, is satellite Internet available/legal over Iran?
- Strom 15y ago
  Satellite dishes are illegal in Iran.
jcr 15y ago
As it so happens, I've spent the last day trying to break in through the technical restrictions of a regime from the outside. There is a country with a very oppressive government that prevents outsiders from observing them. It's a tiny island monarchy that doesn't matter much in the grand scheme of things, but you may have heard of them; it's called the "United Kingdom" or "Great Britain" or whatever. If you don't live within their control, they don't want you to see the propaganda they put out on their "British Broadcasting Corporation" (BBC) television stations and web site. Needless to say, there are ways around their entirely pointless technical restrictions. (Note_To_Self: As somewhat dyslectic person, I'll never forgive patio11 for nick-naming his product "BCC"). I would like to say that by-passing government sanctioned Internet restrictions is simple and easy, but it's not true. Doing it safely can be impossible at times, and considering the rather severe punishments for getting caught (i.e. death), it may not be the smartest choice you could make. If you want to take your chances, there are often technically possible ways to by-pass the restrictions. It's not easy, and it may not be entirely safe, but usually, it is technically possible. There are free solutions out there like Tor ("The Onion Router" https://www.torproject.org/ https://www.torproject.org/), but they mostly suck. If you don't believe me, then just try using them. The other problem with the free solutions is a lot of government filtering knows about them and adjusts accordingly (when possible). There is also a lot of monitoring an profiling done on the traffic on the free solutions like Tor since the traffic is interesting. If you need a solution that sucks less, you'll need to pay for it. As much as many would like to believe otherwise, bandwidth and servers are not free, so when a service is unable to support itself through advertising, then you'll need to pay for it. The commercial VPN vendors are more reliable and have far better security, privacy and performance than the free alternatives. I've been a paying customer of https://www.tunnelr.com https://www.tunnelr.com for over a year, and really enjoy their service. I'm on friendly terms through email with the two founders, Daniel and Jared, so I'm probably guilty of some sock puppetry or fanboyism. They also run the "devio.us" free shell provider service which is very impressive. The thing to realize is the people responsible for controlling the network you are on and enforcing the restrictions probably have a way out of their own. It could be that their "day job" gives them access to the "other" side of their censorship filters, or possibly they've left a few holes here and there that they can use to by-pass their own filtering system. If the latter, it's probably done with a VPN of some sort. In the case of a good commercial service like tunnelr.com, you don't need to worry too much about figuring out where things were left open. Typically, if UDP traffic is found going to port 53, most people expect it to be DNS lookups from client systems. Again typically, if TCP traffic is going to port 53, most people expect it to be DNS lookups done by DNS servers. Of course, if you see TCP traffic going to port 80, you'd expect it to be going to a web server... The common expectations are not "wrong" in most situations, but these expectations can be wrong if things are configured differently. In the case of good VPN services, things are configured differently! For example, I can use TCP and connect to port 80 but establish a SSH connection, or use UDP and connect to port 53 but establish an OpenVPN connection. This kind of trickery will not fool filters with the capacity to do "Deep Packet Inspection" ("DPI" e.g. protocol profiling), but the vast majority of filtering tech out there can't do deep packet inspection all of the time. It requires too much computation to be effective on fully saturated links, so it slows things down terribly. There are a few products out there that can do DPI at "wire-line" speeds, but they are hellishly expensive and fairly difficult to manage properly. BTW, if you go the SSH route, check out dsocks by Dug Song. It runs on most UNIX systems, on MacOS, and on MS-Windows through cygwin. EDIT: I totally forgot about countless the payment options you have available in Iran (i.e. none). If that's an issue for you, contact me privately (email address is in my HN profile).
peterwwillis 15y ago
I haven't checked yet whether they're using layer 7 filtering or just blocking ports, but assuming it was a lame combination of the two, you can try tunneling through HTTP on port 80. Download proxytunnel and follow this guide to set up Apache (or whatever server you prefer) to http proxy ssh connections to port 22: http://dag.wieers.com/howto/ssh-http-tunneling/ http://dag.wieers.com/howto/ssh-http-tunneling/ Then run ssh with proxytunnel as the ProxyCommand (as shown in the guide). It will make a plaintext HTTP connection, request a CONNECT yoursite.com:22, and if they aren't inspecting "too deep" you should be able to get an ssh connection. If that doesn't work there's always icmp tunneling (hans), dns tunneling (iodine), and various other options. See if you can make a udp connection over port 53 to a remote host and transmit non-DNS packets; if they aren't intercepting DNS traffic, just make an openvpn udp connection over port 53 for your tunnel. I actually have a whole paper on circumventing captive portals and firewalls and a crappy tool to probe them if anyone wants it.
- prinny 15y ago
  I would love to read that paper.
- imajes 15y ago
  Link? :)
  - peterwwillis 15y ago
    Here you go: http://opensourceandhackystuff.blogspot.com/2012/02/captive-portal-security-part-1.html http://opensourceandhackystuff.blogspot.com/2012/02/captive-...
- peterwwillis 15y ago
  Oh yeah, and if anyone in Iran wants to test it you can use my vps to test. 'ssh -o ProxyCommand="proxytunnel -p syw4e.info:80 -d syw4e.info:22" -v'. See if it does an SSH handshake. If it does, you can use this tunneling method. Also try the icmp/dns/openvpn, though. To see if DNS is not being intercepted, run 'dig +short www.google.com @syw4e.info' (or 'nslookup www.google.com syw4e.info' from windows). If it returns "127.0.0.1", you were communicating directly with my nameserver and you should be able to tunnel openvpn to a remote box on port 53. I'll have to find the paper and clean it up a bit, but e-mail me and i'll send it when I find it and i'll post it on here. It's not amazing or anything, mostly just a talk with references to tools and articles and common flaws in captive portals.
pooriaazimi 15y ago
Almost all websites that worth visiting are either blocked by Iranian government or by US export laws (SourceForge, Google Code, ...) so people rely heavily on VPNs and proxies. One of the most used proxies is YourFreedom[1] that offers a special service for Iranian people (a free 512 kbps socks proxy). It sounds great, but unfortunately they have been compromised. About 10 months ago, I contacted them (they didn't respond, which makes me a little worried). It looks like Iranian government uses a transparent proxy, so all connections to ems01.your-freedom.de (ems01 through ems24) first redirect to iran.ir and then go to YF's servers! (YF is blocked right now, so I can't re-do this test right now. These images are from my email to YF 10 months ago) http://www.imeezo.com/v/images/49229825994939115647.png http://www.imeezo.com/v/images/49229825994939115647.png http://www.imeezo.com/v/images/46490363986030440278.png http://www.imeezo.com/v/images/46490363986030440278.png A page accessed without a VPN/proxy: http://www.imeezo.com/v/images/98155525346546936123.png http://www.imeezo.com/v/images/98155525346546936123.png The same page, but with a VPN: http://www.imeezo.com/v/images/30239946359511647325.png http://www.imeezo.com/v/images/30239946359511647325.png In the third image, the response is from iran.ir's transparent proxy, not YF servers... [1] your-freedom.de
l0nk 15y ago
Hi, Just let you know that I used that when I'm in "not-really-freedom-friendly-country" =) http://nihilex.com/obfuscated-openssh http://nihilex.com/obfuscated-openssh Slow but works =)
jetpackjello 15y ago
Hello! You can use encrypted Secure SMS for Android. The app is free, and available at: https://market.android.com/details?id=com.atomcloud.metrobuddy https://market.android.com/details?id=com.atomcloud.metrobud... The instruction manual is at: http://web.atomcloud.com/apps/metrobuddy-secure-sms http://web.atomcloud.com/apps/metrobuddy-secure-sms the app needs no licensing, so can be passed from phone to phone via SD card. Good Luck!
wyck 15y ago
Most posts here are about tunneling, which is akin to whacking a mole and not a solution. The only solution is in space, or a mesh net run by citizens, http://www.reddit.com/r/darknetplan/ http://www.reddit.com/r/darknetplan/
charlieok 15y ago
TOR has a blog post up about exactly what they've been able to determine about what Iran is doing: https://blog.torproject.org/blog/iran-partially-blocks-encrypted-network-traffic https://blog.torproject.org/blog/iran-partially-blocks-encry... Regarding HTTPS, it appears they detect and disrupt the SSL handshake. For those who can't access TOR's site, it may be useful to quote their post in full: “Over the past two days we've been hearing from, and working with, a number of Iranians having difficulty using Tor from inside Iran. It seems the Iranian government has ramped up censorship in three ways: deep packet inspection (dpi) of SSL traffic, selective blocking of IP Address and TCP port combinations, and some keyword filtering. For instance, they have partially blocked access to Tor's website, torproject.org, via IP address (such as 86.59.30.36) and port 443 (which is the HTTPS port). The third level of blocking is by keywords, such as searching for the word 'tor' via regular, non-encrypted search engine websites. The blocks on SSL are not complete and not nationwide. Where blocking is in place, initial investigations show they are identifying the beginning of the SSL handshake and simply interrupting the handshake. We continue to research and investigate solutions with the assumption that SSL will eventually be blocked nationwide inside Iran. Our goal is to defeat their dpi signatures and allow tor to work by default. The Iran Media Program has posted their thoughts on what is happening from a journalist's perspective. So far, it seems the majority of Tor users are not affected by these blocks. Iran is still the #2 country based on direct usage, https://metrics.torproject.org/users.html?graph=direct-users&country=ir#... https://metrics.torproject.org/users.html?graph=direct-users.... This number is on the decline, however. More details to follow as we have them.”
- charlieok 15y ago
  “Update 2011-02-10 18:05 UTC: We are working on making our obfuscating proxy more stable and easier to deploy. If you can compile code, following these directions will help. We're also working on Amazon EC2 instances of obfsproxy for point and click deployment.” “these directions” links to an email from Jacob Appelbaum: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html https://lists.torproject.org/pipermail/tor-talk/2012-Februar... “ [tor-talk] Help users in Iran reach the internet Fri Feb 10 11:41:50 UTC 2012 Hi, In the last 48 hours a major campaign of filtering has started in Iran - it started slow and now appears to be that nearly all SSL/TLS traffic is blocked on a few major Iranian ISPs. Details are rather rough but we're working on some solutions - we've long had an ace up our sleeves for this exact moment in the arms race but it's perhaps come while the User Interface edges are a bit rough still. Here's the deal - we need people to run Tor bridges but a special kind of Tor bridge, one that does a kind of traffic camouflaging - we call it an obfuscated bridge. It's not easy to set up just yet because we were not ready to deploy this for everyone yet; it lacks a lot of analysis and it might even only last for a few days at the rate the arms race is progressing, if you could call it progress. There are highly technical instructions here: https://www.torproject.org/projects/obfsproxy-instructions.html.en https://www.torproject.org/projects/obfsproxy-instructions.h... Currently if you run such a bridge, you'll either need to manually tell us (via email to tor-assistants at torproject.org ) about it or you'll need to share these bridges with people you want to help directly. It's a pain and we're working on it. Here's a bug report where we're working around the clock to get stuff going in a user friendly manner: https://trac.torproject.org/projects/tor/ticket/5009#comment:17 https://trac.torproject.org/projects/tor/ticket/5009#comment... This kind of help is not for the technically faint of heart but it's absolutely needed for people in Iran, right now. It's likely that more than ~50,000 - ~60,000 Tor users may drop offline. Watch this graph for an idea of the censorship impact of directly connecting Tor users: https://metrics.torproject.org/users.html?graph=direct-users&start=2011-11-12&end=2012-05-10&country=ir&events=on&dpi=72#direct-users https://metrics.torproject.org/users.html?graph=direct-users... Here's the same graph but for Tor bridge users in Iran: https://metrics.torproject.org/users.html?graph=bridge-users&start=2011-11-12&end=2012-05-10&country=ir&dpi=72#bridge-users https://metrics.torproject.org/users.html?graph=bridge-users... We're working on easy to use client software and if you're in Iran or need one desperately, please email help at rt.torproject.org. We'll try to get you a working obfsproxy bridge address and working client software. All the best, Jacob ”
antihero 15y ago
Can you get a virtual server with SSH running on port 80?
rorrr 15y ago
So no more online banking, no more credit cards? Whatever businesses they have are fucked, when it comes to secure communication.
siculars 15y ago
Shutting down the borders in advance of military action. They don't want sensitive data getting out.
chrismt 15y ago
All the companies who provide censorship knows hows to Iran should be banned for ever. To download Hotspot Shield, TOR or Ultrasurft Visit http://www.unblocker.co.nr http://www.unblocker.co.nr or http://www.proxysoftwares.co.nr http://www.proxysoftwares.co.nr
jacklei 15y ago
aaawwwww mannn... :(
- deleted 15y ago
  [deleted]
joska 15y ago
All thanks to the Germans, because it was Siemens who gave the mullahs their internet toys...
corford 15y ago
Would running through a socat tunnel (http://freecode.com/projects/socat http://freecode.com/projects/socat) defeat the DPI? If yes, you could setup a tunnel on port 80 and then run openvpn through it. I did this for a friend in China and it worked.
ilaksh 15y ago
The invasion of Iran has been planned for many years. The occupation of the two countries immediately to the west and east of Iran were preliminary steps in the same long term military campaign. I assume that this level of internet censorship will go away because it is playing into the hands of Western imperial propagandists who are working hard to "justify" or motivate the next major invasion.
i_love_rabbits 15y ago
Would it be possible to DDoS the deep-packet-inspecting routers with fake SSL handshake requests, or some partial part of it? Sort of like a TCP-SYN attack at the SSL level, and force them to give up DPI? In other words, if we know that they are cutting off the handshake at the ServerKeyExchange phase, for example, couldn't we generate large amount fake SSL traffic that stops one step before that, cause the router to hang?
- vonmoltke 15y ago
  That would only work if the filter was an endpoint. The filter isn't making SSL connections, so it doesn't care if the other side stops mid-transaction. All it has to do is look at the headers and drop packets with the target SSL handshake header.
saizai 15y ago
I've tested this as of today (2/10) and have technical details of exactly what filtering is going on, and what isn't. tl;dr: Iran gov't is the actor, not ISPs; filtering most but not all SSL in a couple different ways; specific targeting of privacy tools & Google. See here (will be updating it soon w/ more): https://plus.google.com/u/0/103112149634414554669/posts/PT3eEF4u415 https://plus.google.com/u/0/103112149634414554669/posts/PT3e...
jbrodkin 15y ago
Any update from Iranian users on the current situation? Are the blockages still in force? I covered this issue for Ars Technica on Friday: http://arst.ch/sg1 http://arst.ch/sg1 and would like to be able to provide an update. Thanks.

399 points by Sara70 15y ago

cicloid 15y ago

Is Tor still working?

Sara70 15y ago
I used to use Tor with firefox before but with my internet connection it was very slow.
- cicloid 15y ago
  Sadly from what I know, that's because of the lack of nodes. But you can volunteer! https://www.torproject.org/getinvolved/volunteer.html.en https://www.torproject.org/getinvolved/volunteer.html.en

rd108 15y ago

Does anyone know how they "shut down https"?

gsa 15y ago
Probably means port 443 is blocked.
- nathan_f77 15y ago
  Way more sophisticated than that. See http://news.ycombinator.com/item?id=3575269 http://news.ycombinator.com/item?id=3575269
Wilya 15y ago
I guess they block all SSL connections, or all least all those targetting unknown (non governement-approved) hosts.
emilsedgh 15y ago
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
- haakon 15y ago
  Is it just by port, or do they detect SSL traffic at any port, and then block it?
  - emilsedgh 15y ago
    They have packet inspection and detect encrypted traffic on any port.
- Simon_M 15y ago
  Is their filtering on a per TCP port basis? Or more advanced packet inspection?
- Jach 15y ago
  How do they distinguish an encrypted connection from a non-encrypted connection? How do they know those indecipherable bits are an encrypted message vs. a part of an image or video? I suspect they just block domains and IPs and common ports or they sniff for common handshakes and key exchanges and kill those.

zckevin 15y ago

We Chinese use VPN or SSH port forwarding.

emilsedgh 15y ago
They drop all encrypted connections. Which means you cant even make a VPN or SSH connection.
- kokey 15y ago
  Which basically means you need to do encryption in a manner that doesn't look like encryption, inside of something that's unencrypted. For example over DNS, inside of HTTP, or other protocols designed for moving code like RPC.
  - chernevik 15y ago
    Maybe embed the cipher text in files for images, video or music?

deleted 15y ago

[deleted]

dutchbrit 15y ago

And here I was, about to ask HN to force SSL on the login page..

pooriaazimi 15y ago
Please... don't. I have enough trouble with GitHub right now. Those guys enforce SSL not only on login page, but on all pages - yesterday it took me 2 hours to clone a github project (that was only 30k).

forcer 15y ago

I am really passionate about this problem. We are currently working on the VPN solution for consumers and I could dedicate some of our servers for this to develop a VPN that would work when governments shut down encrypted connections. where should we start? it it even feasible to do a secured tunnel hidden in normal traffic undetected?

jcromartie 15y ago
You can tunnel anything over anything. You'd just start with a generic URI to negotiate the secure connection before sending the real requests/responses.
- forcer 15y ago
  Yes - Already looking at this HTTP tunnel (http://www.nocrew.org/software/httptunnel.html http://www.nocrew.org/software/httptunnel.html) that someone else posted here. I am wondering whether this approach is better than the one someone else suggested - connecting to a streaming server (like OnLive) - I guess streaming server could be made more undetectable, but more expensive to run
j_s 15y ago
Undetected is the hard part; I'm not sure anyone currently has the cpu horsepower to analyze all traffic, but encrypted information has a high degree of entropy that is hard to hide even steganographically. http://en.wikipedia.org/wiki/Steganography_tools#Cryptography http://en.wikipedia.org/wiki/Steganography_tools#Cryptograph...

ck2 15y ago

Maybe http://m.gmail.com http://m.gmail.com ? What about ssh tunneling over an alternate port? Gosh I cannot believe governments that do this to their people. I wonder if they are ironically using American engineered equipment and software to do the block too.

emilsedgh 15y ago
They drop ALL encrypted connections. You cannot even make a normal ssh connection, since they drop the connection during handshake. (SSH has been disabled for a few months)
- dasil003 15y ago
  What about ssh over port 80? I realize that would have to be set up in advance from outside the country, but the question is are they using port numbers to aid in their filtering or deep packet inspection?
  - gsa 15y ago
    If they are dropping all encrypted connections, it doesn't matter what port you use for ssh, it'll be dropped.
    - nkassis 15y ago
      How do they know it's encrypted? I mean would they block something that looks like gibberish but was plain text over port 80?
      - Luyt 15y ago
        I like that idea. You could encode a block of octets with plain words. "\xC3\x08\x00\x23\xFA" would then actually travel on the wire as "Was named prefer to use the other especially in, every cast a chuckle on neithout getting. Into useful informash speech makes removing a featuring a move or usage actual considered!", and be decoded back at the other end. You'd have to use common words so it looks as innocuous as possible.

lorddfg 15y ago

That sucks, in Pakistan they're banning websites left and right, most of the websites can be accessed with Proxy but I have to use VPN just to upload files now. It's not only the porn websites they're banning, websites like pastebin etc. are getting axed as well. In short, if any website goes against their stupid and yes effed up ideals they will ban it. The ISP's can't do anything because they're forced to comply. Forget ACTA or SOPA, these idiots just do whatever they wish.

humanfromearth 15y ago

They control the physical network. As long as they have that control they will be able to do what they want. The only way to deal with these fuckers (not just Iran) is to start using collectively Ipsec or something similar. All SSL movement is just the beginning. I'm sure every big service will try to encrypt it's traffic more and more to protect itself from governments that try to criminalize their users. Forcing countries like China, Iran and US to go into dark ages if they don't use the new all encrypted networks. It's a shame that we are so paranoid as a species that we need to do that, but I don't see any other way. I know this is extreme, but I don't want to see the freedom I enjoy right now taken away by these obsolete power hungry entities.

kiloaper 15y ago
>Forcing countries like China, Iran and US to go into dark ages if they don't use the new all encrypted networks. The problem is some governments would be perfectly happy with that. In fact for the most repressive ones it's long term goal. China wants to create a separate internet for Chinese users and they're half way there. They have their own local censored versions of Google, Twitter and Facebook. Soon most internet users in China won't care if the rest of the internet disappears. Likewise for Iran, except they have been more open about it [1]. [1] http://online.wsj.com/article/SB10001424052748704889404576277391449002016.html http://online.wsj.com/article/SB1000142405274870488940457627...
- chernevik 15y ago
  Maybe but they'll lose the productivity gains from networked organizations and communities. China can grow a long way without those gains, but they'll eventually hit a wall.
  - kiloaper 15y ago
    >Maybe but they'll lose the productivity gains from networked organizations and communities Absolutely but the effect will be not be huge in my opinion because of the language differences. All my Chinese friends here in the EU still use mainly Chinese language website, most of which are based in China, especially the social networking ones.

soult 15y ago

FYI, Jacob Applebaum just asked[1] people to set up TOR bridges using a new protocol called obfsproxy[2]. 1: https://twitter.com/#!/ioerror/status/167922546807812096 https://twitter.com/#!/ioerror/status/167922546807812096 2: https://www.torproject.org/projects/obfsproxy-instructions.html.en https://www.torproject.org/projects/obfsproxy-instructions.h...

oneofthose 15y ago
I would be willing to set up a bridge but how can we get the bridge IPs to those who need them?
- tshtf 15y ago
  See https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html https://lists.torproject.org/pipermail/tor-talk/2012-Februar... Currently if you run such a bridge, you'll either need to manually tell us (via email to tor-assistants at torproject.org ) about it or you'll need to share these bridges with people you want to help directly. It's a pain and we're working on it.
Monotoko 15y ago
Would a TOR exit relay be better than a bridge?
- nfriedly 15y ago
  In general, yes. In this specific scenario, without the obfsproxy bridges, people in Iran may not be able to connect to TOR at all, in which case an exit node won't help them very much.

teopeurt 15y ago

Realise ALL encryption handshake are blocked but Maybe this might work. https://github.com/stealth/sshttp https://github.com/stealth/sshttp You do need a server on the 'outside' though. (oh bugger, github uses https)

csomar 15y ago

I'm grateful for the Tunisian revolution. Internet Censorship (including ports disable) is at 0. The court justice has ordered to censor a few pages (because of some reasons) but the Global Internet provider in the country did not accept. The head of this agency is also working that the law prohibits any kind of censorship for any reasons. He was responsible for censoring content in the Ben Ali era, but he now thinks that it just doesn't make sense. The problem is, with the people (in the court or the gov.) who don't understand how the Internet works.

kokey 15y ago
I'm not seeing much bad news coming out of Tunisia post revolution. I'm tempted to visit it.
- AndyJPartridge 15y ago
  I did last October, from the UK. Cracking price. The one main memory I have is leaving my iPhone, with my hotel room key-card inside the case, in a Taxi. The driver searched for me for 30 minutes to return it. Great people, and I love the barter culture.
- csomar 15y ago
  It's relatively stable. Politically, it's fine. Economically it is struggling, but not much. Prices for tourists should be reduced as Andy mentioned since it's the recession for hotels and agencies. Internet is pretty slow (I use a 3G which runs on around 1Mb/sec and costs around $20/month), the infrastructure is poor, the people are either struggling or confused how all these structural problems could get solved. Not a great place to be in, honestly. If you are in Europe and looking for some Sun, then may be it's a deal for you considering the cost. If you happen to make a travel, I added my phone number. I'm moving to the capital this summer, and if I happened to purchase a car, I'll take you in a free drive around the capital and Hammamet.

sycren 15y ago

Are there any solutions for web browsing like Onlive (http://www.onlive.co.uk/ http://www.onlive.co.uk/) does for video gaming? It would be significantly harder for them to datamine a video stream..

kristofferR 15y ago
That is actually how the iOS Flash players like iSwifter and Photon works. It's just a video stream (seen from weird MPEG-compression artifacts) to a Linux VM running Firefox.
- sycren 15y ago
  So would this not be ideal for getting through government censors?
  - forcer 15y ago
    My impression is that it could be ideal - but it needs much more bandwidth on the client side, as well as server side - making it expensive to run
    - sycren 15y ago
      But perhaps for sites which are static (in animation) and not interactive like gmail and other email systems it may perform well.

bwarp 15y ago

This is why good old analogue amateur or personal radio should still be a powerful force for people who are rebelling against their governments and corporate overlords. The Internet is easy to kill, as are digital cell-based radio networks. Proper amateur radio is not. Jamming is not that effective over a large area before anyone suggests that.

ajarmoniuk 15y ago
but it's easy to triangulate the broadcaster and take measures (imprison, torture, kill). I lived through the communist era in Poland. Amateur radio stations were banned and prosecuted (you would go to jail), even possession of a CB radio was a crime. Things may be similar in Iran.
- VMG 15y ago
  I'd imagine that in principle, any wireless communication with simple technology and therefore little infrastructure is still more robust than complex, wired technology with high infrastructure needs.
- yread 15y ago
  I would guess that Internet without HTTPS and SSL is much more traceable than a radio. Also if the authorities don't know there is encrypted radio communication going on they would have hard time finding out about it
- bwarp 15y ago
  It's not that easy and there are simple anti-triangulation countermeasures you can use. It's possible to drop decoy transmitters/relays, which are easy enough to knock up and are cheap. You can also use refraction to "bounce" HF radio waves off the ionosphere to mask the source. You can scramble the signals. You can disguise the signals as legitimate but include carrier data. There are lots of ways of hiding what you are doing. As usual, if you don't take precautions, that will happen. Pirate radio stations were and still are common in the UK, particularly around London. They move around regularly and broadcast for short periods so it's hard to trace or predict a location. The same conditions apply here.

mrud 15y ago

If you can't believe that governments are using deep packet inspection and block access to popular sites have a look at the 28C3 talk How governments have tried to block Tor - http://www.youtube.com/watch?v=DX46Qv_b7F4 http://www.youtube.com/watch?v=DX46Qv_b7F4 it covers different governments and how they tried to block access to the TOR network

tetha 15y ago

So its time to grab our steganography handbooks and build a cute little animal picture channel patch for open ssh.

bbrizzi 15y ago

Pure speculation here, but would it be possible to use some kind of exotic Content-encoding HTTP header to avoid the DPI checks? Of course it would also have to be implemented on the server-side but that's another problem.

ya3r 15y ago

I live in Iran. The fact about the shut down is correct. I would also add that secure connection to servers inside Iran is possible. I've tried some, and they work. But trying to connect to services like Github and PivotalTracker, which we relay on in our starup, results in no response. Also I will note that the ssh protocol is the same. I can ssh into my university machine (inside Iran) but I can't access my rackspace VPS with ssh for example. One thing to add is that `Sara70` creator of this thread, mentions some non-related reason for this (The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.) which is wrong. Here nobody officially said anything about this. But as this shutdown is getting more attention in the media, I suspect this issue to get resolved soon.

tomjen3 15y ago
Are you inside Iran right now?
- ya3r 15y ago
  Yes
aaronblohowiak 15y ago
>One thing to add is that `Sara70` creator of this thread, mentions some non-related reason for this (The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.) which is wrong. How do you know this?
- ya3r 15y ago
  I ask the same. How does she know this? I know this because, this trend (shutting down secure network protocols) started on and off, like 1 year ago.
  - cjbprime 15y ago
    As I understand it, that was slowing down (like 10x) of SSL, not disabling it completely. It could have simply been a live test of the mechanism they're using right now, and they could be deploying the mechanism right now because of the anniversary. (Or because of Kim Jong-Un's death ;-)

alkasir 15y ago

Do SOCKS proxies work at all? One can test if they work. Xroxy.org is a good place to start. Email me at admin(at)alkasir.com to send you free socks proxy servers for testing.

pooriaazimi 15y ago
No, they don't. But thanks for the offer.

sepent 15y ago

Moreover, SSH has stopped working, too. But, finally I found a way to circumvent it. A simple twist in the client side, could simply bypass the filtering. I wrote a simple script to do this, and I would like to share it with all of my countrymen: https://launchpad.net/~mohammad-sepent/+archive/ppa/+packages https://launchpad.net/~mohammad-sepent/+archive/ppa/+package... To use it, just replace ssh command with issh like this: issh user@hostname [other-ssh-options]

j_s 15y ago
Where is the link to the required changes? Binaries = scary. Also, an SSL link doesn't seem useful?
- kiloaper 15y ago
  I took a look at it. It's not a binary. It's a python file (easily readable) that acts as a wrapper for ssh. Extract the contents of the tar.gz[1] for example to see it. It's great if it works because it apparently doesn't need changes to the remote ssh server. [1] https://launchpad.net/~mohammad-sepent/+archive/ppa/+files/issh_0.0.1.tar.gz https://launchpad.net/~mohammad-sepent/+archive/ppa/+files/i... Edit: Non SSL link: http://ppa.launchpad.net/mohammad-sepent/ppa/ubuntu/pool/main/i/issh/ http://ppa.launchpad.net/mohammad-sepent/ppa/ubuntu/pool/mai...
  - j_s 15y ago
    Thanks for digging into this.
- sepent 15y ago
  To install it under ubuntu: sudo add-apt-repository ppa:mohammad-sepent/ppa sudo apt-get update sudo apt-get install issh For other distros you can grab the .deb or the source package from the given link.
pooriaazimi 15y ago
Ironically, I can't access your script (it's https!). I'd be thankful if you could just copy/paste it here.

deno 15y ago

Is it possible to bypass their physical network altogether? For example, is satellite Internet available/legal over Iran?

Strom 15y ago
Satellite dishes are illegal in Iran.

jcr 15y ago

As it so happens, I've spent the last day trying to break in through the technical restrictions of a regime from the outside. There is a country with a very oppressive government that prevents outsiders from observing them. It's a tiny island monarchy that doesn't matter much in the grand scheme of things, but you may have heard of them; it's called the "United Kingdom" or "Great Britain" or whatever. If you don't live within their control, they don't want you to see the propaganda they put out on their "British Broadcasting Corporation" (BBC) television stations and web site. Needless to say, there are ways around their entirely pointless technical restrictions. (Note_To_Self: As somewhat dyslectic person, I'll never forgive patio11 for nick-naming his product "BCC"). I would like to say that by-passing government sanctioned Internet restrictions is simple and easy, but it's not true. Doing it safely can be impossible at times, and considering the rather severe punishments for getting caught (i.e. death), it may not be the smartest choice you could make. If you want to take your chances, there are often technically possible ways to by-pass the restrictions. It's not easy, and it may not be entirely safe, but usually, it is technically possible. There are free solutions out there like Tor ("The Onion Router" https://www.torproject.org/ https://www.torproject.org/), but they mostly suck. If you don't believe me, then just try using them. The other problem with the free solutions is a lot of government filtering knows about them and adjusts accordingly (when possible). There is also a lot of monitoring an profiling done on the traffic on the free solutions like Tor since the traffic is interesting. If you need a solution that sucks less, you'll need to pay for it. As much as many would like to believe otherwise, bandwidth and servers are not free, so when a service is unable to support itself through advertising, then you'll need to pay for it. The commercial VPN vendors are more reliable and have far better security, privacy and performance than the free alternatives. I've been a paying customer of https://www.tunnelr.com https://www.tunnelr.com for over a year, and really enjoy their service. I'm on friendly terms through email with the two founders, Daniel and Jared, so I'm probably guilty of some sock puppetry or fanboyism. They also run the "devio.us" free shell provider service which is very impressive. The thing to realize is the people responsible for controlling the network you are on and enforcing the restrictions probably have a way out of their own. It could be that their "day job" gives them access to the "other" side of their censorship filters, or possibly they've left a few holes here and there that they can use to by-pass their own filtering system. If the latter, it's probably done with a VPN of some sort. In the case of a good commercial service like tunnelr.com, you don't need to worry too much about figuring out where things were left open. Typically, if UDP traffic is found going to port 53, most people expect it to be DNS lookups from client systems. Again typically, if TCP traffic is going to port 53, most people expect it to be DNS lookups done by DNS servers. Of course, if you see TCP traffic going to port 80, you'd expect it to be going to a web server... The common expectations are not "wrong" in most situations, but these expectations can be wrong if things are configured differently. In the case of good VPN services, things are configured differently! For example, I can use TCP and connect to port 80 but establish a SSH connection, or use UDP and connect to port 53 but establish an OpenVPN connection. This kind of trickery will not fool filters with the capacity to do "Deep Packet Inspection" ("DPI" e.g. protocol profiling), but the vast majority of filtering tech out there can't do deep packet inspection all of the time. It requires too much computation to be effective on fully saturated links, so it slows things down terribly. There are a few products out there that can do DPI at "wire-line" speeds, but they are hellishly expensive and fairly difficult to manage properly. BTW, if you go the SSH route, check out dsocks by Dug Song. It runs on most UNIX systems, on MacOS, and on MS-Windows through cygwin. EDIT: I totally forgot about countless the payment options you have available in Iran (i.e. none). If that's an issue for you, contact me privately (email address is in my HN profile).

peterwwillis 15y ago

I haven't checked yet whether they're using layer 7 filtering or just blocking ports, but assuming it was a lame combination of the two, you can try tunneling through HTTP on port 80. Download proxytunnel and follow this guide to set up Apache (or whatever server you prefer) to http proxy ssh connections to port 22: http://dag.wieers.com/howto/ssh-http-tunneling/ http://dag.wieers.com/howto/ssh-http-tunneling/ Then run ssh with proxytunnel as the ProxyCommand (as shown in the guide). It will make a plaintext HTTP connection, request a CONNECT yoursite.com:22, and if they aren't inspecting "too deep" you should be able to get an ssh connection. If that doesn't work there's always icmp tunneling (hans), dns tunneling (iodine), and various other options. See if you can make a udp connection over port 53 to a remote host and transmit non-DNS packets; if they aren't intercepting DNS traffic, just make an openvpn udp connection over port 53 for your tunnel. I actually have a whole paper on circumventing captive portals and firewalls and a crappy tool to probe them if anyone wants it.

prinny 15y ago
I would love to read that paper.
imajes 15y ago
Link? :)
- peterwwillis 15y ago
  Here you go: http://opensourceandhackystuff.blogspot.com/2012/02/captive-portal-security-part-1.html http://opensourceandhackystuff.blogspot.com/2012/02/captive-...
peterwwillis 15y ago
Oh yeah, and if anyone in Iran wants to test it you can use my vps to test. 'ssh -o ProxyCommand="proxytunnel -p syw4e.info:80 -d syw4e.info:22" -v'. See if it does an SSH handshake. If it does, you can use this tunneling method. Also try the icmp/dns/openvpn, though. To see if DNS is not being intercepted, run 'dig +short www.google.com @syw4e.info' (or 'nslookup www.google.com syw4e.info' from windows). If it returns "127.0.0.1", you were communicating directly with my nameserver and you should be able to tunnel openvpn to a remote box on port 53. I'll have to find the paper and clean it up a bit, but e-mail me and i'll send it when I find it and i'll post it on here. It's not amazing or anything, mostly just a talk with references to tools and articles and common flaws in captive portals.

pooriaazimi 15y ago

Almost all websites that worth visiting are either blocked by Iranian government or by US export laws (SourceForge, Google Code, ...) so people rely heavily on VPNs and proxies. One of the most used proxies is YourFreedom[1] that offers a special service for Iranian people (a free 512 kbps socks proxy). It sounds great, but unfortunately they have been compromised. About 10 months ago, I contacted them (they didn't respond, which makes me a little worried). It looks like Iranian government uses a transparent proxy, so all connections to ems01.your-freedom.de (ems01 through ems24) first redirect to iran.ir and then go to YF's servers! (YF is blocked right now, so I can't re-do this test right now. These images are from my email to YF 10 months ago) http://www.imeezo.com/v/images/49229825994939115647.png http://www.imeezo.com/v/images/49229825994939115647.png http://www.imeezo.com/v/images/46490363986030440278.png http://www.imeezo.com/v/images/46490363986030440278.png A page accessed without a VPN/proxy: http://www.imeezo.com/v/images/98155525346546936123.png http://www.imeezo.com/v/images/98155525346546936123.png The same page, but with a VPN: http://www.imeezo.com/v/images/30239946359511647325.png http://www.imeezo.com/v/images/30239946359511647325.png In the third image, the response is from iran.ir's transparent proxy, not YF servers... [1] your-freedom.de

l0nk 15y ago

Hi, Just let you know that I used that when I'm in "not-really-freedom-friendly-country" =) http://nihilex.com/obfuscated-openssh http://nihilex.com/obfuscated-openssh Slow but works =)

jetpackjello 15y ago

Hello! You can use encrypted Secure SMS for Android. The app is free, and available at: https://market.android.com/details?id=com.atomcloud.metrobuddy https://market.android.com/details?id=com.atomcloud.metrobud... The instruction manual is at: http://web.atomcloud.com/apps/metrobuddy-secure-sms http://web.atomcloud.com/apps/metrobuddy-secure-sms the app needs no licensing, so can be passed from phone to phone via SD card. Good Luck!

wyck 15y ago

Most posts here are about tunneling, which is akin to whacking a mole and not a solution. The only solution is in space, or a mesh net run by citizens, http://www.reddit.com/r/darknetplan/ http://www.reddit.com/r/darknetplan/

charlieok 15y ago

TOR has a blog post up about exactly what they've been able to determine about what Iran is doing: https://blog.torproject.org/blog/iran-partially-blocks-encrypted-network-traffic https://blog.torproject.org/blog/iran-partially-blocks-encry... Regarding HTTPS, it appears they detect and disrupt the SSL handshake. For those who can't access TOR's site, it may be useful to quote their post in full: “Over the past two days we've been hearing from, and working with, a number of Iranians having difficulty using Tor from inside Iran. It seems the Iranian government has ramped up censorship in three ways: deep packet inspection (dpi) of SSL traffic, selective blocking of IP Address and TCP port combinations, and some keyword filtering. For instance, they have partially blocked access to Tor's website, torproject.org, via IP address (such as 86.59.30.36) and port 443 (which is the HTTPS port). The third level of blocking is by keywords, such as searching for the word 'tor' via regular, non-encrypted search engine websites. The blocks on SSL are not complete and not nationwide. Where blocking is in place, initial investigations show they are identifying the beginning of the SSL handshake and simply interrupting the handshake. We continue to research and investigate solutions with the assumption that SSL will eventually be blocked nationwide inside Iran. Our goal is to defeat their dpi signatures and allow tor to work by default. The Iran Media Program has posted their thoughts on what is happening from a journalist's perspective. So far, it seems the majority of Tor users are not affected by these blocks. Iran is still the #2 country based on direct usage, https://metrics.torproject.org/users.html?graph=direct-users&country=ir#... https://metrics.torproject.org/users.html?graph=direct-users.... This number is on the decline, however. More details to follow as we have them.”

charlieok 15y ago
“Update 2011-02-10 18:05 UTC: We are working on making our obfuscating proxy more stable and easier to deploy. If you can compile code, following these directions will help. We're also working on Amazon EC2 instances of obfsproxy for point and click deployment.” “these directions” links to an email from Jacob Appelbaum: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html https://lists.torproject.org/pipermail/tor-talk/2012-Februar... “ [tor-talk] Help users in Iran reach the internet Fri Feb 10 11:41:50 UTC 2012 Hi, In the last 48 hours a major campaign of filtering has started in Iran - it started slow and now appears to be that nearly all SSL/TLS traffic is blocked on a few major Iranian ISPs. Details are rather rough but we're working on some solutions - we've long had an ace up our sleeves for this exact moment in the arms race but it's perhaps come while the User Interface edges are a bit rough still. Here's the deal - we need people to run Tor bridges but a special kind of Tor bridge, one that does a kind of traffic camouflaging - we call it an obfuscated bridge. It's not easy to set up just yet because we were not ready to deploy this for everyone yet; it lacks a lot of analysis and it might even only last for a few days at the rate the arms race is progressing, if you could call it progress. There are highly technical instructions here: https://www.torproject.org/projects/obfsproxy-instructions.html.en https://www.torproject.org/projects/obfsproxy-instructions.h... Currently if you run such a bridge, you'll either need to manually tell us (via email to tor-assistants at torproject.org ) about it or you'll need to share these bridges with people you want to help directly. It's a pain and we're working on it. Here's a bug report where we're working around the clock to get stuff going in a user friendly manner: https://trac.torproject.org/projects/tor/ticket/5009#comment:17 https://trac.torproject.org/projects/tor/ticket/5009#comment... This kind of help is not for the technically faint of heart but it's absolutely needed for people in Iran, right now. It's likely that more than ~50,000 - ~60,000 Tor users may drop offline. Watch this graph for an idea of the censorship impact of directly connecting Tor users: https://metrics.torproject.org/users.html?graph=direct-users&start=2011-11-12&end=2012-05-10&country=ir&events=on&dpi=72#direct-users https://metrics.torproject.org/users.html?graph=direct-users... Here's the same graph but for Tor bridge users in Iran: https://metrics.torproject.org/users.html?graph=bridge-users&start=2011-11-12&end=2012-05-10&country=ir&dpi=72#bridge-users https://metrics.torproject.org/users.html?graph=bridge-users... We're working on easy to use client software and if you're in Iran or need one desperately, please email help at rt.torproject.org. We'll try to get you a working obfsproxy bridge address and working client software. All the best, Jacob ”

antihero 15y ago

Can you get a virtual server with SSH running on port 80?

rorrr 15y ago

So no more online banking, no more credit cards? Whatever businesses they have are fucked, when it comes to secure communication.

siculars 15y ago

Shutting down the borders in advance of military action. They don't want sensitive data getting out.

chrismt 15y ago

All the companies who provide censorship knows hows to Iran should be banned for ever. To download Hotspot Shield, TOR or Ultrasurft Visit http://www.unblocker.co.nr http://www.unblocker.co.nr or http://www.proxysoftwares.co.nr http://www.proxysoftwares.co.nr

jacklei 15y ago

aaawwwww mannn... :(

deleted 15y ago
[deleted]

joska 15y ago

All thanks to the Germans, because it was Siemens who gave the mullahs their internet toys...

corford 15y ago

Would running through a socat tunnel (http://freecode.com/projects/socat http://freecode.com/projects/socat) defeat the DPI? If yes, you could setup a tunnel on port 80 and then run openvpn through it. I did this for a friend in China and it worked.

ilaksh 15y ago

The invasion of Iran has been planned for many years. The occupation of the two countries immediately to the west and east of Iran were preliminary steps in the same long term military campaign. I assume that this level of internet censorship will go away because it is playing into the hands of Western imperial propagandists who are working hard to "justify" or motivate the next major invasion.

i_love_rabbits 15y ago

Would it be possible to DDoS the deep-packet-inspecting routers with fake SSL handshake requests, or some partial part of it? Sort of like a TCP-SYN attack at the SSL level, and force them to give up DPI? In other words, if we know that they are cutting off the handshake at the ServerKeyExchange phase, for example, couldn't we generate large amount fake SSL traffic that stops one step before that, cause the router to hang?

vonmoltke 15y ago
That would only work if the filter was an endpoint. The filter isn't making SSL connections, so it doesn't care if the other side stops mid-transaction. All it has to do is look at the headers and drop packets with the target SSL handshake header.

saizai 15y ago

I've tested this as of today (2/10) and have technical details of exactly what filtering is going on, and what isn't. tl;dr: Iran gov't is the actor, not ISPs; filtering most but not all SSL in a couple different ways; specific targeting of privacy tools & Google. See here (will be updating it soon w/ more): https://plus.google.com/u/0/103112149634414554669/posts/PT3eEF4u415 https://plus.google.com/u/0/103112149634414554669/posts/PT3e...

jbrodkin 15y ago

Any update from Iranian users on the current situation? Are the blockages still in force? I covered this issue for Ars Technica on Friday: http://arst.ch/sg1 http://arst.ch/sg1 and would like to be able to provide an update. Thanks.