7 ms·

DNS results now being manipulated in Turkey

• roeme 13y ago
  Please correct your second query, asking for the A RR of "youtube.com\@4.2.2.2." is needlessy wrong
  • makmanalp 13y ago
    Ooops, missed a space there. Fixed, thanks!
• STSW 13y ago
  Hide my ass will do a good job here..
  • Jugurtha 13y ago
    Yeah, tried that. It's really slow most of the time, plus many websites will warn you or delay you (Google will display a message). Plus I wouldn't trust my data going through those machines. As I said, I much rather get my own hosting (even shared hosting) for as cheap as 4 bucks a month, and tunnel my traffic through that machine. But HMA is a valid solution for someone who's not willing to pay.
• mrtksn 13y ago
  I can confirm NS lookup to Google DNS, when done using the national cable ISP network, returns spoofed results. here: http://i.imgur.com/jfZS31C.png http://i.imgur.com/jfZS31C.png
• Jugurtha 13y ago
  SSH tunneling also works. It's cheap and easy to set up.
  • michh 13y ago
    By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, setting up an actual tunnel (i.e. on a lower network layer) would be better but that's a bit more complicated to do.
    • Jugurtha 13y ago
      What happens when you change the default DNS on the router level to OpenDNS or Google. (i.e: Telnet to the router, and change DNS there).
      • michh 13y ago
        That's the whole point: they seem to be using deep packet inspection to mess with all DNS traffic regardless of the DNS server being used.
        • Jugurtha 13y ago
          Aha, I see. I'll look this up in addition to what kijin said (sshuttle). It's not like our government is blocking anything (there were rumors it was blocking Facebook in 2011, but it wasn't true as I was able to log in without any issue. It was just slow, but it's not like we have the fastest internet here). But it's nice to know. Thanks for the clarification.
          • stayparanoid 13y ago
            Were you logging in on the actual facebook? how can you tell? Logging in isn't a proof that that is the real facebook, dude. And doesn't "It was just slow" ring any bell?
• alex1 13y ago
  Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control. If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. Of course, this wouldn't work if they got some Turkish (or other) CA to sign a bogus www.youtube.com certificate. EDIT: As lawl points out, trying to require SSL on www.youtube.com won't work either, since they could just do an sslstrip type attack. EDIT 2: Proof that they are in fact messing with routes to Google Public DNS anycast addresses (they're doing to same to OpenDNS): https://twitter.com/esesci/status/449902883933126659 https://twitter.com/esesci/status/449902883933126659
  • lawl 13y ago
    > another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. What? NO! They are messing with the DNS results from 8.8.4.4 (Google DNS) Too early for TLS to do anything. Maybe with HSTS, but I still doubt that HSTS is any effective against state level MITM.
    • alex1 13y ago
      You're right. Maybe if they turned on and required SSL for everyone visiting www.youtube.com and added www.youtube.com to Chrome's preloaded HSTS list and somehow got everyone to use Chrome. Sadly, this probably won't happen, but DNSSEC adoption probably won't happen either. Even with DNSSEC, they could still do deep packet inspection on HTTP traffic going to YouTube IPs and initiate MITM attacks that way.
      • psykovsky 13y ago
        Why not ditch the current DNS system and use Namecoin? If you have to force some piece of software into users computers, let's do it right at least...
        • deleted 13y ago
• vijayp 13y ago
  Too bad DNSSEC isn't widely used; signing the records would prevent this from working. The government could still block the DNS requests, though.
  • alex1 13y ago
    Sure, they wouldn't be able to proxy all HTTP requests through their own servers like they're doing now, but they'd still be able to do MITM attacks at the IP level. They're already messing with routes to Google Public DNS IPs so they could just as easily mess with routes to YouTube's IPs. I don't think DNSSEC is the solution in cases like this. Somehow getting everyone to use SSL for everything is a much better solution in my opinion.
  • davidu 13y ago
    As I pointed out above, DNSSEC doesn't stop this. I am not just a DNSSEC hater, but the level of misunderstanding on DNSSEC is quite large. When victim issues a query for youtube.com, I can intercept that query and hand back whatever response I want. Unless the victim KNOWS IN ADVANCE (which DNSSEC doesn't offer) that the response should be DNSSEC signed, they will accept my forged response. DNSSEC solves problems we don't really have, and ignores the ones we do.
    • wtallis 13y ago
      Can't you say the same thing about users who don't know to expect their connection to use TLS? What you're claiming as the problem isn't a problem with DNSSEC, but with the absence of DNSSEC. If DNSSEC were the default, then this attack couldn't happen.
• bayesianhorse 13y ago
  Seems like Erdogan is hell-bent on restricting free speech in Turkey. Somehow it is comforting how abysmally bad he is at doing that though...
  • mrtksn 13y ago
    The elections are tomorrow and it's prohibited by law to broadcast political rallies on the last day. The pro-government TV channels are broadcasting Erdogan's rallies while other TV channels respect the law(and they are afraid of disproportional penalties if they do the same). So today only Erdogan is on national TV.
    • bayesianhorse 13y ago
      So every voter in Turkey essentially knows what Erdogan is doing. So nobody who understands democracy should vote for Erdogan. If however not enough people understand democracy ...
      • mrtksn 13y ago
        Erdogan claims that there is a "global conspiracy to stop the rise of Turkey" and people who believe him don't care much about the unlawful things he is doing because you know, Turkey is under attack and extraordinary measures should be taken to protect the country. Polls show that %77 of the population believe the corruption case against the government is real. However the situation is really complicated. Without going into details, I have to say that probably there is a real conspiracy orchestrated by the Gulen(islamic cleric allegedly with big influence on the judiciary & law enforcement) movement because some of the leaked tapes seems to be collected illegally. The Gulen movement was close ally with the government till recently. They probably collected evidence about the corruption in the government since years and waited until the right moment comes to start the criminal case. The PM responded by demonizing the whole movement and suspending the rule of law. The allegations against the Gulen movement are not proven at all but few years ago the same prosecutors started a case against the military and lot's of unlawful things took place during the whole trail process. That time the PM Erdogan strongly supported the case but today he claims that this was a conspiracy against the Turkish army. Many lawyers agree that lots of the evidence against the military was fabricated and many people were imprisoned for political reasons. Back then a sex tape of the main opposition party leader was leaked and PM Erdogan used it as a political tool. Today the same PM claims that these leaks about corruption are invasion of his privacy. Another leak shows that the PM was involved in the filming and distribution of the sex tape of the opposition party. It's just huge mess here.
• lemonade 13y ago
  There are many more public DNS servers out there, too many to block.There is a nice comprehensive list here: http://public-dns.tk/ http://public-dns.tk/ You might also be interested in https://dnscrypt.eu https://dnscrypt.eu.
  • est 13y ago
    They mangle all udp port 53 data.
    • leath 13y ago
      Actually not all port 53 as there are some DNS servers still accessible and actually resolves stuff fine.
    • aib 13y ago
      No, there's no mangling of data (apart from HTTP which gets injected with a RST flagged packet once in a while)
• wila 13y ago
  Google also offers IPv6 public DNS servers, maybe that helps? (probably not though as they might not yet have turned on ipv6) 2001:4860:4860::8888 and 2001:4860:4860::8844 Also look at the other links that user lemonade posted here.
• davidu 13y ago
  DNSSEC wouldn't stop this... unless the resolver knew to require DNSSEC and ignored unsigned responses (which is unlikely). DNSCrypt could help here... but chances are their middleware would just barf on it. You need something more evasive.
  • axaxs 13y ago
    It wouldn't prevent getting the wrong answer, sure. But a smart resolver would see DS records at the parent and recognize it as an unsigned, thereby invalid, response.
    • nahlio 13y ago
      Thus, DNSSEC doesn't protect against censorship. It's hilarious that people are saying DNSSEC can be used in Turkey (or anywhere else) to defend against censorship. Either they don't know what they're talking about or don't care about having an honest discussion. Or both.
• bohm 13y ago
  namecoin would fix this: https://www.namecoin.org/ https://www.namecoin.org/
• M4v3R 13y ago
  Excuse my ignorance, but does anybody knows why they are doing it? Is there any piece of news I missed?
  • higherpurpose 13y ago
    Yes, you missed quite a bit. They tried to block Twitter and Youtube, and then people started using Google DNS, OpenDNS or others to circumvent the block. Some leaks about Erdogan's corruption and false flag attack in Turkey to blame Syria and go to war with it came out in those channels, and he wanted people to stop talking about it or see the leaks. I think some elections are in Turkey soon, too.
  • deleted 13y ago
    [deleted]
  • ckaygusu 13y ago
    There have been some sound recording leaks in Turkey, exposing high ranking government officials' and Erdogan's private conversations, which is absolutely scandalous. This sunday, there will be an election, and the ruling party doesn't want people to listen to these records prior to the election. As you can guess, this material was primarily published through YouTube, hence the blockage.
• cryptologics 13y ago
  this is what I get with VPN and without VPN http://i.imgur.com/XNtDGYq.png http://i.imgur.com/XNtDGYq.png
• hadoukenio 13y ago
  The NSA and GCHQ have been doing this for years, so why complain about Turkey doing this? The only difference I can see is targeting individuals vs targeting the general population.
  • linuxhansl 13y ago
    Maybe because it's the wrong thing to do regardless of who's doing it?
  • javajosh 13y ago
    Your tacit assertion is that if something wrong is done for years, and you find out it's done one more time, you shouldn't bother complaining about it. People like you have existed for all time, and will always exist, but your views truly don't matter: change comes because people continue to fight for what is right, despite the balance of years. Slavery on US soil had been legal and "normal" for hundreds of years, but that didn't stop people from "complaining" about it, and eventually changing it. Women's suffrage, same story. Wanton violation of our 4th Amendment rights in the digital age will proceed accordingly.
    • hadoukenio 13y ago
      See my reply to the other comment.
  • ryanobjc 13y ago
    When I see messages like this, I start to think... who is this person. What are their agenda? What's the chance they are turkish? After all, if you cannot see the difference between the alleged single person targeting and the blanket targeting of an entire population, I'm not really sure you deserve to be here. I guess I'll leave you with that Stalin quote "Death of one man is a tragedy. Death of a million is a statistic".
    • hadoukenio 13y ago
      Wow, a bit harsh. What I was trying to say was that Governments do shit like this, regardless of if they are China, North Korea, Turkey or America. In terms of doing things against their citizens, every country is in the Axis of Evil, so STOP complaining and instead get behind projects that will fix this shit by making the internet bulletproof.
• sanqui 13y ago
  I didn't see this posted on HN yet - Turekey is also blocking the Tor Project's website: https://www.eff.org/deeplinks/2014/03/when-tor-block-not-tor-block https://www.eff.org/deeplinks/2014/03/when-tor-block-not-tor...
• ttflee 13y ago
  [sarcasm] Having been enduring this kind of shit for years in mainland China, I am glad to see that it migrated to the (sort of) 'free' world, eventually! [/sarcasm] BTW, I have to manoeuvre some IP addresses of the CDNs in /etc/hosts in order to get access to github.com today, and some others for stack overflow.com last week. Interference from those who have power really sucks! CDNs nowadays are so vulnerable to political issues, and some CDNs seems to be hurt by extended non-specific attacks/blocks to some other sites sharing the same IP addresses, due to some unrelated reasons, which makes me feel nostalgic to the web before CDNs.
• acd 13y ago
  Wont stop tor or onion addresses You can do the same setup as http://piratebrowser.com/ http://piratebrowser.com/
• Fasebook 13y ago
  It's about time Turkey took a step towards US in controlling the flow of information. I mean, how long has this been going on here, undetected? The obvious solution, Turkey, is to target specific individuals after digging into their background, confirming that they are not computer experts before attacking them via their computer.
• gaoshan 13y ago
  "Using VPNs seems like the only valid solution" But a government like China interferes with even VPNs (more so outside of the greater Shanghai and Beijing metro areas, in case anyone is sitting in those areas saying "My VPN works great"... they permit it and can block or interfere with it anytime they like) so I don't think they are really a solution. In China, nothing really works if the authorities don't want it to. VPNs are degraded to the point of being unusable, SOCKs proxy over SSH is the same, TOR is unusably slow, etc. Unfortunately, I don't think there really IS a solution in the face of determined governmental interference.
  • rahimnathwani 13y ago
    Yes, the Chinese government can interfere with or block VPNs whenever they want. However, don't discount the impact of bandwidth/peering issues on VPN performance. In most cases, I've found that VPN throughput over TCP (either PPTP or OpenVPN) is similar to HTTP throughput to the same host. You can test this yourself. Put a file on your VPN server, and try to retrieve it over HTTP. If you're worried that the latency is limiting the throughput, use wget to make several connections at the same time, and sum up the transfer speeds. Finally, you're right - there is no (technical) solution in the face of determined governmental interference.
  • ttflee 13y ago
    Choose an expensive VPN. Those free ones are the ones got quickly blocked as more people would be using them which in turn results in the blockage.