How Is NordVPN Unblocking Disney+?

https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30

by dagurp • 7 years ago

374 243 7 years ago

streb-lo• 7 years ago

All the most common US ISPs are there… AT&T, Comcast, Verizon, CenturyLink. IPs from Charter Communications in their Midwest, Texas, Pacwest and Northeast regions. ISPs I’ve never heard of before… who the heck is Delcom? Turns out they are serving some rural communities in Texas. Did NordVPN buy servers or connectivity from them?

I've been seeing a ton of these guys' advertising lately. If it turns out they're also reselling your bandwidth?

Still, I'd like to see someone take a peek at their local client traffic for any suspicious activity before coming to any conclusion.

Edit: I guess allegedly the 'botnet' aspect is provided not by other NordVPN users but by malware provided by companies associated with NordVPN.

dewey3• 7 years ago

If it turns out they're also reselling your bandwidth?

Monetizing your free app through selling traffic is nothing new and there's a bunch of companies doing just that. You drop their SDK into your mobile app, they give you money and in return they get their very own "botnet".

smolder3• 7 years ago

Users should be upset that such trash is allowed on whatever stores they're hosted on.

mikl8• 7 years ago

Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement.

It’s just using a different middleman. One middleman might be better than another, but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home.

It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic. DNS is still not encrypted in most browsers, so this traffic is still a goldmine of marketable info. Sure, they can’t see what you post on snapstagram.com or what pages you visit on news.ycombinator.com, but they can infer a lot about your browsing habits from DNS queries.

derefr4• 7 years ago

A VPN provider is basically a choice to trade one country’s passive adversary for another. I.e., if you’re in the US and using a VPN with German corporate headquarters, then your Internet transactions are able to be wiretapped by the German government, but not by the US government. Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market—but not usually in a form that will result in legal problems for you, since ad-targeting data tends to be semi-anonymized (in the sense that it isn’t in a form where a court would accept it as evidence of who you are; not in the sense that it couldn’t be used to deanonymize you by a sufficiently-motivated private researcher.)

toyg• 7 years ago

Actually, legally speaking, by using a German VPN you are effectively allowing the NSA to spy on you, since the traffic is now “overseas” — which is always fair game for any US agency. Conversely, you might be protected from German surveillance (depending on German law).

(This said, obviously no agency is going to come after you for the occasional lootin’ of moving pictures, and if you are doing anything more serious, then you should have your own VPN infrastructure.)

q3k• 7 years ago

A VPN provider is basically a choice to trade one country’s passive adversary for another.

Plus, whatever VPN provider you're using. Unsurprisingly, most seem to be based in countries with very lax telecommunication laws and that make it very easy to start shell companies.

daxorid• 7 years ago

Yes, pretty much this.

The Lithuanian government has no interest in me, and even if they did, they have no jurisdiction here. One should always be more interested in privacy from the government that has authority to no-knock raid your home than the one that does not.

lsofzz4• 7 years ago

Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market [ ... ]

Woah. Hold your bong son! ;)

Any reference to documentation or any information of what you mean by `sold' on the open market?

If you wanted to prove a point by saying that internet is an insecure medium then yes I agree but `tapped' and `sold' is a whole different ball game that I am not aware of. At least in the internet I know of.

Mirioron2• 7 years ago

The VPN providers pay the bills for them. Why would they not shill them?

mikl8• 7 years ago

Yeah, why would someone ever consider their moral responsibilities and credibility before endorsing a product they do not understand the technical details of?

SmellyGeekBoy• 7 years ago

Besides the security implications, if there's no way to legally stream Disney content in my country and I desperately want to watch it for some reason I'll pirate it. Why should I jump through hoops to give them (and an unconnected third party) my money if they don't want me as a customer?

I'm making a genuine effort to keep all my entertainment above board by being a paying customer to Netflix, Amazon, Spotify, Google Play, YouTube Premium, Steam and a few others, but I have to say that my patience is wearing very thin with TV/movie studios and their idiotic licensing shenanigans.

alwayseasy2• 7 years ago

What's worse, is that they can't snap a finger and distribute worldwide. They lobbied themselves into legal corners with all these licensing shenanigans.

felipelemos• 7 years ago

Copyright law should have a way to allow the content be shared for free if the copyright holder block the distribution themselves with no good reason.

lilyball• 7 years ago

Why do you believe you're entitled to content that the content owner doesn't want to offer you?

Practically speaking, yes, people will pirate it if it's not easily available otherwise. But that doesn't make it morally right.

tluyben29• 7 years ago

This. I do what I can but if shows I watch suddenly end in ‘my region’ while it continues in another then I will find a way. It is the internet and it is global; the old way of regions needs to go; it has been gone for a while for but I want to pay for my Netflix to be the same as the US (etc) one. It is not though; I do not watch too much but when ‘they’ get me hooked and then run seasons behind another season, well... I was explained why it is that way, but, like you, that wears thin these days; they had at least a decade to fix it for new content but they keep doing it.

scarface742• 7 years ago

If you’re using “sketchy WiFi”, you’re still more than likely using https so your traffic is encrypted.

throw0101a• 7 years ago

* Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement.*

You may enjoy Tom Scott's video:

I tried to write a more honest VPN commercial. The sponsor wasn't happy about it. • Get ■■■ days of ■■■ VPN free at ■■■■.com/honest

* https://www.youtube.com/watch?v=WVDQEoe6ZWY

mikl8• 7 years ago

I already did ;)

rsync• 7 years ago

"It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic."

I never understand this false dichotomy - especially in a forum which is named ... let me check ... "hacker news".

Just set up your own.

It costs almost nothing to run a EC2 instance in the region of your choice (or at some other provider like GCS or whatever). There are keystroke-by-keystroke instructions everywhere on setting this up.

Extra points for adding the extremely trivial and also very low cost steps of signing up under a corporate name and removing your personal identity from the account altogether.

Some more extra points for multiplying the almost-zero-cost by 3 or 4 or 5 and spinning up extra copies of your endpoint in multiple regions (or even providers) and manually (or automatically) switching between them.

You don't need to trust anyone - adjust your threat model all the way up to "near nation state" (in the case of Amazon or GCS) and assume these actors could already discern all of your Internet traffic even if you weren't doing business with them.

Christ.

Ruthalas• 7 years ago

Could you provide a good reference for the process you describe, or maybe just a good set of search terms?

I'd like to pursue this, but have just little enough experience with ec2 to not be composing effective search terms.

scarface742• 7 years ago

This reminds me of the infamous comment when DropBox was introduced and why geeks don’t get it.

https://news.ycombinator.com/item?id=9224

For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

tobib• 7 years ago

It costs almost nothing to run a EC2 instance in the region of your choice

I might be wrong about EC2 pricing, but at least for me, ~$11 per region is not "almost-zero-cost". Unless we're talking about on demand instances.

I wonder if there is a community run VPN service to utilize instances more efficiently.

[1] https://aws.amazon.com/ec2/pricing/reserved-instances/pricin...

jsjohnst3• 7 years ago

It costs almost nothing to run a EC2 instance in the region of your choice

Sure, the instance doesn’t cost much, but bandwidth does in the case of AWS and GCS. Streaming 4K video chews through bandwidth.

errantspark• 7 years ago

Just set up your own.

This entire thread is about using a VPN to watch Disney+ outside of geo restrictions. Many many people use VPNs for this purpose and no other. You can't trivially do this on your own at all. You're making it seems simple, getting an VPS with an IP that won't automatically be banned by all sorts of services looking to protect themselves against botnets and the exact sort of geofence hopping that people want to do is extremely difficult.

skinnymuch• 7 years ago

Have you checked to see if ec2 isn’t blocked by Disney+? I would expect that to be blocked. I think Google blocks most ec2 IPs. Going thru 10 GB of data per day would have the total cost above $1/day. Not as cheap as the post makes it seem.

miki123211• 7 years ago

Be aware that a lot of streaming services block traffic that doesn't originate from residential IPs, AKA Digital Ocean, AWS, Azure, Google Cloud, Linode etc. Apparently BBC even uses a whitelist instead of a blacklist. ISPs give them the list of ip addresses they use for individual customers, and those are the only ones permitted. No VPS will help you in this case, trust me, I've tried.

manigandham• 7 years ago

Using a cloud provider means high bandwidth bills, being blocked by most sites with IP blacklists, and potentially kicked off and banned by the cloud provider for violation of TOS.

You also won't have any anonymity since you're billing details and instances are all logged permanently. It's not really a viable alternative.

dexterdog• 7 years ago

I do 1 to 4 TB if traffic in my house each month. That would cost $100-400 each month if I ran it through EC2.

altShiftDev• 7 years ago

Extra points for adding the extremely trivial and also very low cost steps of signing up under a corporate name and removing your personal identity from the account altogether.

Unless you're paying Amazon in bitcoin you're not removing your personal identity from the account.

tluyben29• 7 years ago

EC2 is one of the more expensive options when you add up the bandwidth required. There are tons of small vps and bare metal providers which are cheaper (people named Hetzner, there is OVH and tons of other smaller ones). There is also less chance these are blocked as the streaming providers might not know about them.

jdormit2• 7 years ago

Why can't your VPN see what pages you visit on sites? They can see every URL you request, can't they?

berbec4• 7 years ago

For https, the only thing sent in plaintext (and this is only if you don't use DoH or similar), is your DNS query (google.com). The rest of the page (search.php?=goat+snuff+videos) is encrypted.

gambiting• 7 years ago

Friendly reminder that in the UK all ISPs are required by law to keep your entire browsing history for a year, and that history can be accessed by few dozen agencies, warrant free. That's why I use a VPN personally.

stjohnswarts2• 7 years ago

Exactly, they're generally more trustworthy than most governments. Security is about probability and is never 100%.

ludjer2• 7 years ago

If you only use HTTPS they can track your DNS queries but they cant track anything other then that. When you do a google for something so let us say google.com?search=searchTerm they see a dns lookup for google.com. They will not see ?search=searchTerm or anything else. They will see a connection open between your computer and another IP after that. In the future that will stop becoming a problem because there will be DNS over TLS or DNS over HTTPS which will even hide your DNS lookups. Which means all the ISP will see is you made a TCP connection to X. Theoretically they could just do a reverse lookup for that IP but that is not always easy.

My1• 7 years ago

Except that they cant really get your browsing history. Just the domains you used. At least on the 90% of https sites most ppl visit

StanislavPetrov• 7 years ago

One middleman might be better than another, but 10 middleman are better than 1 if you are truly interested in mitigating the invasion of your privacy. There's nothing preventing you from using multiple VPNs to make it harder for any one middleman to build a profile of your internet activity.

obenn• 7 years ago

Which is basically TOR

hawaiian2• 7 years ago

if you have a good ISP already

That's a big IF. Not all of us share the luxury of being able to get internet service from companies like Sonic.net.

foopdoopfoop• 7 years ago

but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home.

This is just not true. You cannot sign up for an ISP without disclosing at least your name and address. Many VPNs support complete anonymity.

It's a different middle man that--if you choose the right one--will absolutely know less about you.

jachee• 7 years ago

How are you going to access a completely anonymous VPN provider without a non-anonymous internet connection?

If your traffic is interesting enough, the money trail will eventually lead back to you.

secfirstmd• 7 years ago

I disagree. The comments here are based on a specific threat model. There are many other threat models where a good VPN dramatically increases a users security.

alasdair_• 7 years ago

But remember that you’re trusting the VPN provider with all your traffic.

May I suggest hosting youe own VPN using Streisand (https://github.com/StreisandEffect/streisand)? It's an absolutely fantastic VPN that runs on just about any cloud system out of the box (or your own hardware of course).

Right now I use Linode for hosting ($5/month) but there are lots and lots of other ways to set it up.

Importantly, setup is easy for all kinds of clients, including mobile devices.

Spy5204• 7 years ago

Making your own VPN sure seems like the safest option but something as popular as Linode won’t be of a use to someone who wants to stream geoblocked services as they most likely are already blacklisted from many.

raxxorrax2• 7 years ago

There is currently a difference in business interest for VPNs and ISPs. ISPs sell your data, since people mostly don't have much choice here anyway. A VPN service who becomes known to share data can probably close their business soon, new ones will quickly fill the void. They have less infrastructure requirements than ISPs and a subset of users with different expectations to privacy.

So yes, I do think there is quite a difference, although you should still be critical of your VPN provider.

morpheuskafka2• 7 years ago

Also worth noting that while VPN providers don't care what DNS servers you use, the geo-blocking protection features usually require that you use their DNS servers.

trymas• 7 years ago

Ring ding ding ding. Jackpot.

I had on my backlog to do something similar, I guess I do not have to. NordVPN is just a front for Tesonet to gather data and sell your bandwith for bots, scrapers etc. through OxyLabs and other companies.

NeaterPeter• 7 years ago

This article doesn't really make a lot of sense as there's no hard proof, just speculations of the author

mikl8• 7 years ago

No smoking gun, sure, but some very suspicious traffic patterns. How is NordVPN getting traffic routed through so many different ISPs who generally only serve residential customers?

Hard to imagine that so many ISPs are agreeing to help NordVPN bypass geo-blocking. Pretty certain that there’s some kind of shenanigans going on.

c2564• 7 years ago

I don’t have any experience with NordVPN, but off the top of my head, it’s not hard to imagine someone looking at an internet backbone map, doing some math, and just paying for a couple hundred residential broadband packages. (Napkin speculation: maybe 30 major markets, round up to 50. Most markets have only a couple serious residential broadband providers (sadly, in the U.S. the average is below 2), so multiply that by 3 (a big over-estimate, but in some places it’s probably worthwhile to double coverage). Sprinkle the remaining 50 around the smaller markets to make sure you have decent access into all of the major backbone loops. Ballpark it at $50/each and you could blanket the U.S. major population centers for $1k/month.)

ortekk• 7 years ago

Well, I just verified this article's claims with this curl request: curl --head -H "Pragma: akamai-x-get-client-ip" "https://www.disneyplus.com"

It returns different IPs for every request, and these IPs do look like residential ones.

mirages• 7 years ago

Does it still works if you use DNS over HTTPS ? I'm curious to see if the traffic is redirected because they dectected disneyplus.com DNS request or if it's destination IP based

kyledrake3• 7 years ago

If it uses a new IP for each new request, that's a way to block this, is it not? Normal traffic will mostly keep the session on the same IP, not have a new one for each new request.

banana_giraffe• 7 years ago

Interesting. I tried the same thing and it always returns the same IP while I'm connected.

I wonder if this is the client doing something? I've never installed the NordVPN client, I only use their OpenVPN config files.

bscphil2• 7 years ago

It returns different IPs for every request,

That's the really bizarre thing... I came here to ask about it after getting confused when the article implied this (30 tests, 30 different residential IPs). It seems like this shouldn't work at all if connections to the Disney plus site involve any kind of state.

Is this a content-unblocking exception, and normally everything is routed through the same NordVPN edge server? Assuming that's the case, this seems like a great way to get your account banned at Disney plus the moment they decide to crack down on this. Assuming you have a session ID cookie with the site, no legitimate user is going to be sending that cookie from a different IP address on every page load. This should be very easy for them to catch.

EternalAugust4• 7 years ago

Do an nmap scan on the IP and check for open ports. If there are open ports it's very likely not actually a residence but a business.

IdontRememberIt• 7 years ago

We block vpns/open proxies. 99% of the time a user is complaining, their main argument is so they can have "a secure Internet connection" to our site.

pteraspidomorph• 7 years ago

I don't know what your business is, but I run my own VPN (closed). I will complain if you block it for no apparent reason, because you are forcing me to interrupt a dozen connections and ongoing workflows if I want to use your service (usually I just won't).

t0astbread• 7 years ago

How does your company handle these complaints?

derefr4• 7 years ago

Does [Oxylabs.io’s distribution] mean your device can be used by a third party to access child porn or hack into a bank? Absolutely!

I mean, isn’t the existence of Oxylabs a boon for everyone’s privacy—in the sense of making everyone’s actions deniable/repudiable? Oxylabs introduces reasonable doubt for every possible allegation of cybercrime! “It wasn’t me; it was this botnet malware routing through my computer without my knowledge!” It’s like having a Tor exit node on your computer, without the associated mens rea that would come from the explicit choice to install one!

rtempaccount13• 7 years ago

In theory sure. In practice (especially if you don't know your connection is being used like this, as the article suggests), if law enforcement turn up at your door to take all your kit as evidence in a crime, they'll likely take all your kit for an extended period of time (and possibly charge you) until/unless you can prove that it wasn't you that sent the traffic.

There have been cases of this happening to ToR exit nodes and that was ones the operators could point to...

o-__-o4• 7 years ago

No you can easily prove it wasn't you that sent the traffic, simply look at case law for all of the torrenters absolved from having open wifi access points. The problem is your hardware is locked up in a criminal trial, which realistically means you ain't getting it back. And they're not just going for that device you used with a VPN, they're taking any possible device that connected to the VPN including routers, laptops, iphones, tablets, connected hard drives, etc.

THAT is the reason why a rational actor won't use such a service.

mindfulhack• 7 years ago

I'm not a legal professional, but doesn't the 'innocent until proven guilty' principle apply in that scenario? See here: https://en.wikipedia.org/wiki/Presumption_of_innocence

dewey3• 7 years ago

Think of “residential proxies” this way: 1.) Oxylabs installs some malware on to a user’s device, unknown to the user, by bundling it with other software that the user downloads. 2.)This malware enables Oxylabs to sell off your bandwidth, your computing power, and your IP address to third parties, who will route their internet traffic through your device.

There's so many providers doing something similar, it really isn't a Oxylabs / NordVPN exclusive issue.

- https://luminati.io/residential_ips

- https://www.geosurf.com/blog/what-are-residential-proxies/

- http://stormproxies.com/residential_proxy.html

- https://krebsonsecurity.com/tag/residential-proxies/

- https://multilogin.com/proxy/

- https://smartproxy.com/blog/what-is-a-residential-proxies-ne...

Based on my understanding it's people having free apps they want to monetize. They then implement a proxy company's SDK which enables this traffic sharing and get paid by them.

dathinab• 7 years ago

Did they consider that maybe all the clients are NordVPN customers, i.e your data will come from a different users internet connection but another users data comes from you.

With that there world be no reason to have any hidden malware practice or similar, it _could_ even be in the terms of service if some of their products...

I mean it's true that there is a lot of bs going one but before claiming them for having hidden malware you should make sure they do, instead of just saying "that's the only way it's possible' even if it isn't the only way.

the_gipsy• 7 years ago

That's possible. The author jumped from residential IPs to malware without further checks.

rtempaccount13• 7 years ago

I don't believe that NordVPN make it clear that user's connections could be treated like that (e.g. as bandwidth for other customers)

Unless they make that clear, it's not a great look.

c2564• 7 years ago

Nobody claims that NordVPN customer connections are being used for this; the claim is that they are probably using Oxylab, which is probably using Oxylab customer’s connections, which they are probably using via malware of some unspecified type, so the Oxylab users probably don’t know how their connection is being used.

While some of those leaps of logic are plausible, it’s a lot of guessing.

jesuisuncaillou• 7 years ago

I thought the same thing. They could be using their legitimate user's connections.

But even if they're rerouting traffic through their users, and if they wrote that in the terms of service, I doubt any of their users know they signed up for this.

Which is not illegal, but still kind of sketchy.

If it's hidden in their terms of service, but not explicitly written on the content the user actually reads while subscribing, I consider this very unethical.

mthoms• 7 years ago

It would probably violate your ISP's terms of service as well. Not that I have any love or respect for ISP's but still.

ikeboy2• 7 years ago

They explicitly deny this in the linked blog post.

Havoc4• 7 years ago

I'm on the lookout for a black friday VPS deal.

Between this a PIA's shady stuff I'm just gonna have to host my own. The commercial VPN scene is a cesspool.

mikl8• 7 years ago

Tooting my own horn a little, I recently wrote a short guide on setting up a home VPN, it’s working great for my needs: https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar... :)

gruez• 7 years ago

home/vps hosted VPNs are only really helpful to mitigate malicious ISP (or hotspot operator). If need a VPN for identity hiding purposes (eg. torrenting, evading IP tracking), you still need a commercial VPN provider.

stjohnswarts2• 7 years ago

Those are only good for VPN netflix or being more secure at coffee shops.

EpicEng• 7 years ago

What happened with PIA? I haven't heard anything.

dewey3• 7 years ago

https://news.ycombinator.com/item?id=21612488

Havoc4• 7 years ago

New corporate overloads with a ahem checkered past

Multicomp• 7 years ago

Most of their customers moved to Mullvad after they got bought by people who have a severely suspect past from a privacy perspective.

alecco• 7 years ago

Beware, I used to do this but VPS subnets are blocked in many places. And also attract a lot of attacks.

Havoc4• 7 years ago

hmm. Good point. I'll see how it goes. I mostly need it for tablet while traveling so nothing missing critical CAPTCHAs could be annoying though

johnpowell3• 7 years ago

I'm somewhat shocked that residential connections have enough bandwidth to upload a streaming video as a proxy. But maybe people using a VPN for Disney+ are just glad it works at all.

I have Comcast and my upload on a good day is 500KB/s and that cripples everything else on the network.

phiresky• 7 years ago

I'd guess they only proxy the main domains (which have the session cookies and probably the geoblocking criteria), but let the video serving domains (which at least in netflix are separate and "stupid") go through their normal network.

johnpowell3• 7 years ago

This makes sense. Thanks.

Bombthecat• 7 years ago

Yeah, was wondering the same..

driverdan2• 7 years ago

Why is your uplink so bad? Do you have a low tier plan? If not, why haven't you had Comcast fix it?

johnpowell3• 7 years ago

I have Comcast Business. I pay them 100 dollars a month. Even if I paid them way more they just don't offer much more upload where I live. They will give me tons of download but all their plans have anemic upload. My only other option is Centurylink and they will give me a symmetric line. But that tops out at 12Mbp/s. At least with Comcast I get a reasonable download. I live in a major metropolitan area. Five miles from where a NBA team plays home games.

SlowRobotAhead2• 7 years ago

You should try rural USA. I’m currently sitting in an area 1 hour from $65/gigabit but the best they can get here is 1.5 down .3 up.

shubb• 7 years ago

This article is probably wrong. You can buy IP address blocks or parts of IP address ranges assigned to other people. There is a market in residential IP address blocks, particularly for VPNs, scraping services, DOS.

These will be servers running in a data centre that have been assigned an IP address that used to be owned by comcast and is still marked as residential. And the VPN provider will have paid a premium for it.

For disney, it'll be whack a mole with these ranges, and I'm sure the VPN are doing clever things to make the ranges look innocent.

lucb1e2• 7 years ago

Then I decided to give NordVPN a try, and poof, it worked like a charm. How was this possible? Residential IPs was my guess.

"Guess"? Do they route packets differently depending on the destination, i.e. if you go to one of the whatsmyip websites you'll see a nordvpn-owned IP but to a Disney server the use someone's home connection? Is that what the author says is happening here? I don't know if this is common but, while technically possible, it seems a little weird. I assume the author could just have checked what IP they were exiting from.

Edit: someone else verified it, yes indeed they use residential IP addresses: https://news.ycombinator.com/item?id=21665084

7777fps• 7 years ago

The author also verified it, if you had the decency of actually reading the article rather than exiting as soon as you found some way to state that you know better.

lucb1e2• 7 years ago

I suppose that's fair.

dd6d658• 7 years ago

Hadn't heard of akamai pragma headers before. Used the ones from https://support.globaldots.com/hc/en-us/articles/11500399670... and it dumped a bunch of other debug info https://pastebin.com/hteaGG6N

wtf?

c2564• 7 years ago

(This part of) Akamaiks value prop rests on two things: they have servers all over the world, and they can figure out which of those are both functioning well and (network-wise) close to you. The former comes from infrastructure investment and management. The latter comes from collecting and processing data from all over the (network-wise) world, quickly. That last part involves building and updating a map of actual and potential internet traffic — not quite all of it, but for everywhere that your (prospective Akamai customer ‘you’) customers might be. Doing _that_ without owning ~all of the BGP routers in the world plus ~all of the local ISPs in the world involves a fair bit of probing, data gathering, and a bunch of math.

It’s likely that those headers don’t all get added all the time, for all the Akamai traffic, but instead are added selectively for key parts of the mapping process.

(Disclosure: I worked for Akamai Way Back When, but left the company many years ago.)

harrylucas• 7 years ago

Interesting, I'm assuming that this wouldn't be possible on iOS devices? E.g. would installing a calculator app on iOS allow someone to route traffic through my phone? (obviously without me granting vpn access to said app).

willstrafach• 7 years ago

This would indeed be possible, although slow, and only when the affected app is open.

c2564• 7 years ago

Technically possible, practically unlikely (you iOS phone would be a terrible router, giving the people who made the calculator app a slow, unreliable output node that would identify to the desired source as a lower-quality (mobile) client. In other words, it would be a bunch of extra work and risk for a worse result.

The theoretical model here is using people’s fast, stable (-ish) broadband connections to relay the connection. Even then, it’s only for the initial setup steps; once you get to the actual streaming data, nobody in this model wants to ferry those packets around.

smolder3• 7 years ago

Getting around geoblocking probably doesn't require the main video streaming connection to be through one of these IPs.

kitcar• 7 years ago

Wouldn't this be pretty easy to confirm by monitoring bandwidth consumption on a dormant computer running NordVPN? If bandwidth consumption is exponentially higher when their VPN client is enabled, then clearly they are passing traffic through your machine...

dna_polymerase• 7 years ago

That is not how this supposedly works. The Oxylabs people (according to the author) put software out there (like Apps, or Installers whatever) and those are infected. That's why it's hard to proof this, first link those gnarly apps to oxylabs, next link oxylabs to NordVPN.

This is how it could be done:

Rent Oxylabs Residential IP's (600$ minimum commitment, according to [0]). Check out IPs, stop using them, hope they get rotated to NordVPN, where you'd have to monitor the ips used. At Oxylabs pricing the only possible conclusion if a match was found would be that the services are intertwined.

[0] https://oxylabs.io/pricing/residential-proxy-pool

mmd45• 7 years ago

i let my kids download apps on ios and chromeos (no android). is it technically possible for these apps to be proxying data for someone like nord?

if so, would it only be while the apps are in the foreground or can they do it in the background?

smolder3• 7 years ago

Yes. As stated elsewhere this is Oxylabs' business model and it's how a decent number of free apps monetize. I don't know how relevant background/foreground are.

oefrha3• 7 years ago

Having used one of these shady proxy pool services once in the past for some (pretty harmless) scraping (not especially proud of it), I seriously doubt a service like that is good enough for video streaming. Usually half of the proxies in the pool are high ping or unreachable, and the other half are only valid for at most a few minutes. Maybe I just didn’t pay enough for the gold tier or something.

Edit: Another comment pointed out that maybe only the front domain is geoblocked, but not the video CDN domains. That would make sense. Now that I think about it, youtube-dl also has a --geo-verification-proxy option that works in the same way.

stordoff• 7 years ago

Assuming a direct business relationship, there's no reason they couldn't hand-pick or filter out the good hosts, and then put the rest in the general pool.

brianpgordon2• 7 years ago

It works perfectly for me.

https://i.imgur.com/PFITtZT.png

Spy5204• 7 years ago

He wasn’t talking about NordVPN speeds. He was talking about the sort of services offered by Oxylabs, Honeygain, PacketStream and other similar proxy services.

oefrha3• 7 years ago

198.8.81.74 belongs to AS46562 Total Server Solutions L.L.C. Not a residential IP, so it has nothing to do with the practice suggested by TFA.

bigfuz• 7 years ago

Any open-source OpenVPN client works just fine with NordVPN

NelsonMinar• 7 years ago

No one's said this clearly so I will. oxylabs.io as described in this article is an awful unethical company and should be investigated for criminal activity. If NordVPN is using them to bypass DRM controls, that's pretty ugly.

The central concern is how they get their 32M "residential proxies". I spent a few minutes trying to get an answer and could not find one. The article straight up assumes it's coming from malware, which certainly seems possible. I could also imagine them buying legitimate access from ISPs but given the various legal and technical issues involved it seems less likely.

Is there anything directly connecting Oxylabs to malware? Again I looked for a few minutes and didn't find anything clear. I did find a couple of troubling posts on Reddit from Android Devs saying Oxylabs approached them offering to "monetize your users with our SDK", which sounds like the slippery slope to malware. Or at least bundleware without meaningful consent.

https://www.reddit.com/r/androiddev/comments/ajfc7w/question... https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w...

BTW, Oxynet has a list of the ASNs they have proxies on: https://intro.oxylabs.io/hc/en-us/articles/360003444780-Supp...

berbec4• 7 years ago

Isn't it likely a non-zero percent of those residential IPs are from other NordVPN clients? Or anyone who installed their app on their device?

bootloop• 7 years ago

I would guess it's from services like the Hola VPN browser extension provides. It was always clear that these services need to make money somehow. Next to providing tunnels to their own users they will sell them to others. Not sure if this is really unethical.

spyder• 7 years ago

From the patent infringement document:

"... Upon information and belief, the above OxyLabs embedded code has been integrated in at least the following software applications that may be downloaded by any user located anywhere having Internet access: AppAspect Technologies’ “EMI Calculator” and “Automatic Call Recorder”; Birrastorming Ideas, S.L’s “IPTV Manager for VL;” CC Soft’s “Followers Tool for Instagram;” Glidesoft Technologies’ “Route Finder;” ImaTechInnovations’ “3D Wallpaper Parallax 2018;” and Softmate a/k/a Toolbarstudio Inc.’s “AppGeyser” and “Toolbarstudio.”"

https://cdn-resprivacy.pressidium.com/wp-content/uploads/201...

Looking at few of these app's descriptions and privacy policy, doesn't mention anything about oxylabs or proxies, so I'm not sure it's true, but somebody should check the apps with decompiler or monitoring the connections it makes.

gitgud• 7 years ago

Sound similar to the proxy network [1] Luminati, which use an SDK which developers get paid to embed in their Apps, in order to route proxy traffic through... Kind of like a Tor network...

[1] https://luminati.io/proxy-networks/mobile-ips

ikeboy2• 7 years ago

They promised they had nothing to do with Oxylabs, but now that assertion seems to be false.

Only if you deliberately misread the post, which is clearly saying that NordVPN doesn't use its users' devices to route traffic, unlike HolaVPN. It doesn't say they don't use Tesonet services to route traffic. They're denying being a supplier to Tesonet, they're not denying being on the demand side.

berbec4• 7 years ago

Not defending PIA, as they've been purchase by satan.net, but remember the HN posts where NordVPN was asked some very unfriendly questions by Private Internet Access? Remember everyone dismissing it as a astroturf marketing ploy?

I've been a PIA customer, and am canceling to switch to Mullvad, but PIA selling out seems not to prove they weren't right before.

Exuma5• 7 years ago

Can you tell me more about Mullvad, does it have a good reputation with HN/elsewhere? Does it have common VPN problems like leaking etc? I'm looking to switch away from Nord now.

Exuma5• 7 years ago

Ok, well fuck NordVPN. Can someone recommend something good that doesn't log, without setting up my own entire VPN (yes I get its the only way to be sure blah blah blah. I definitely care, but not enough to waste a week doing all that)

ozzmotik2• 7 years ago

if you're wasting a week doing it, I'm fairly confident that you are doing something wrong. I set up an internal VPN on my home network for ad blocking purposes (cf. Pi-hole) and it literally took less than an hour, despite that being the first time I had ever really done such a thing.

I think maybe you just need the right guide, or even something like the ansible playbook someone mentioned in a different comment that can just automate the process for you

Exuma5• 7 years ago

I'm being super dramatic, even if it takes 1 hour the last thing I want is yet another server login floating around. If I were doing some serious stuff, I would do it, but I really use a VPN only when I'm at coffee shops and stuff to prevent random nonsense. I use a VPN to completely hide my tracks etc. With that said, I don't want my data to be sold to tensornet or whatever that crap company is called

ignoramous• 7 years ago

Mullvad, ProtonVPN, and iVPN tends to get recommended often.

If geoblocking isn't a concern, you could use Cloudflare's Warp, which is free. Not sure abt no-logs policy.

You could consider using Orbot, too, a tor as a porxy service for Android, if annoying captchas and broken P2P apps is acceptable.

hawaiian2• 7 years ago

ProtonVPN seems to be involved with Tesonet as well. I'd do some more research on them.

EternalAugust4• 7 years ago

Tutorial showing how easy setting up a personal vpn is: https://www.youtube.com/watch?v=7SSXpfd1JLw

morpheuskafka2• 7 years ago

You might look into AirVPN, they have a strong no-log policy, independent ownership, transparent list of all servers/load, guaranteed minimum bandwidth, up 10 (iirc) port forwards with optional dynamicDNS, p2p welcome. Current Black Friday price is 64 EUR for 3yr which is much less than Nord's "deal" which looks like their usual price to me--and crypto is accepted. They also financially support various projects such as Tor, EFF, and host some open-source mirrors.

kyledrake3• 7 years ago

It seems that the author is getting a different IP from NordVPN each time they make a request. Does that mean Disney could block this by preventing the request from coming from another IP each time a request is made?

Exuma5• 7 years ago

That would block all "first requests" which wouldn't work

kyledrake3• 7 years ago

After a logged in session, you could count the number of times an IP address changes, and if it changes more than 3 or something in the last 10 minutes, it's a good sign that they're using some sort of malware VPN.

dalemyers• 7 years ago

What am I missing here? Surely if this were true, Nord would be able to unblock basically every service. Netflix, prime video, etc. Would all work. That's not the case though?

ilaksh• 7 years ago

I live in Mexico and use Nord VPN (or I did at least, seems like maybe I can't anymore unless I want my computer to be a proxy for arbitrary and potentially nefarious traffic). I have Amazon Prime Video, Disney+, HBO Now, Hulu, and Netflix. All work with Nord VPN running.

eximius3• 7 years ago

If anyone here knows enough about ASNs and the RIRs to set up a company whose sole purpose was for individuals to buy/lease IPs, I would gladly help set up and run such a company. The RIRs generally don't allow individuals to have ASNs, so I assume an intermediary like this would be necessary.

But between uses like setting up a personal VPN with a clean IP or just the cool idea of having a personal IPv4 address or IPv6 block... I think it would be a viable, if rather small and niche, business.

techdevangelist• 7 years ago

I think the main catch would be this new ASN would become known by the very companies/services trying to ban non-consumer IP blocks. Providers like DigitalOcean, AWS, and Azure are non-eyeball networks, so you see more bots and geo-shifting users (nonUS users trying to avoid a geo block by Disney for example). Any IP announced by the ASN would be known by looking at the bgp announcement and listed/blocked.

Hiding bots and other users among the huge Comcast & Spectrum IP blocks makes it harder for media companies to block them. It’s just how do you legitimately buy a bunch of consumer connections, or get users to install software to share their consumer connection, hence the NordVPN clients I assume.

eximius3• 7 years ago

Why would this ASN be classified as bots if it's meant to be for individuals?

Granted, abuse can occur. But assume US-based with basic KYC or something so that most IPs might genuinely be nerds like me using it as their IP.

U8dcN7vx2• 7 years ago

You don't need a company to get an ASN, but you do need to show that you intend to get network connections from at least two providers and generally that mean planning which plans are generally required as proof.

There are effectively no more clean IPv4 addresses, you'd have to buy addresses that had previously been used.

Anyone can get IPv6 addresses even those whose ISP sucks via tunnelbroker.net (aka Hurricane Electric) which will provide a single address, also a /64 and/or a /48. Of course they are generally blocked by streaming services since they are a form of VPN and thus the endpoint might be anywhere.

eximius3• 7 years ago

If I didn't plan on having a physical location (i.e., AWS or Colo as opposed to trying to get Comcast or any other connection to my house), what would constitute a network connection?

What are the terms of assignment via Hurricane Electric? Can they take it away? Do they only allow BGP advertisement to their sites or can I still bring the IP elsewhere?

I still think there is an opportunity for niche needs here.

Nas808• 7 years ago

All of these commercial VPN providers seem a bit sketchy to me. Roll your own on a VPS with Algo.

mathgenius• 7 years ago

I don't know what this guy is doing with all this pragma stuff... Once you hook up to a NordVPN server the IP doesn't change... NordVPN has thousands of servers, I assumed that is why the content providers don't block them, because they can't keep up. Except amazon, which seems to be better at blocking than the others.

Is this guy saying that these thousands of servers are not in some data center somewhere, but actually residential malware?I'm doing some tracepath'ing (not a network guy...) and I don't see what this guy is claiming. I'm calling bs.

mirimir12• 7 years ago

I think that he's saying that the connection from the NordVPN server to Disney+ is getting proxied through residential IPs.

But hey, I'm testing that now.

Edit: Using IVPN's Germany exit ...

    $ curl -LIX GET https://www.disneyplus.com -H 'Pragma: akamai-x-get-client-ip'
    ...
    X-Akamai-Pragma-Client-IP: 178.162.222.41, 178.162.222.41

... and ...

    $ w3m -dump https://ipchicken.com
    ...
    178.162.222.41

limond3• 7 years ago

I was testing this earlier with a NordVPN US server. Akamai sees a changing IP (different from the public IP of the server) that seems to be in residential ISP IP blocks when retrieving www.disneyplus.com. For other sites on the Akamai CDN this was not true. On other sites header and public IP matched like in your example.

Scoundreller2• 7 years ago

Ah, I think Oxydata is behind the recently defunct Oxyleads.com which seemed to publish historical scraped LinkedIn data.

They had a browser extension, maybe somebody can get a copy and see what's in common with other extensions?

https://support.oxyleads.com/hc/en-us/articles/360015036112-...

EternalAugust4• 7 years ago

They may be "residential IPs" but you can do an nmap scan on the IPs to see if there are any open ports. If there are no open ports then it's likely a residential IP because stateful firewalls on home routers. If there are open ports it's likely not a residential IP since some kind of port forwarding would have to be enabled, which most people don't do, or a DMZ would have to be set up (even less likely). I scanned a few of the IPs returned from the curl test. Granted a small sample size, but they all have open ports. Beyond the scan I didn't try to connect to any of them via browser or otherwise. Here is what I found for the "Delcom" IP he's so worked up about:

``` $ sudo nmap 76.77.25.75 Starting Nmap 7.70 ( https://nmap.org ) at 2019-11-29 19:21 EST Nmap scan report for static-76-77-25-75.networklubbock.net (76.77.25.75) Host is up (0.097s latency). Not shown: 992 closed ports PORT STATE SERVICE 22/tcp filtered ssh 23/tcp filtered telnet 25/tcp filtered smtp 53/tcp filtered domain 80/tcp open http 443/tcp open https 5060/tcp open sip 8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 331.02 seconds ```

Maybe I'm missing something here. Of course it could still be malware, but that's far from the first conclusion I'd jump to. This article is just speculation to me and the methodology seems ... bad

edit: sorry if the markdown is broken. Noob here. ;)

ludjer2• 7 years ago

IF you are going to try look for open ports they certainly wont be using the standard ports. You will need to do a full scan "nmap -p". But doing that is considered malicious and you can be sued. So I would advise against scanning random hosts that you do not have permission to scan.

Spy5204• 7 years ago

Won’t services like this take advantage of UPnP to open ports?

I know FluidStack which is a similar service uses UPnP to open ports that it requires. FluidStack is a service you earn money through by willingly selling your internet bandwidth though, not like Oxylabs but same idea.

EternalAugust4• 7 years ago

First, sorry for the late reply. I don't log in often. I didn't consider malware using UPnP. But it seems to me that the probability of malware using it to make a residential IP look like a business IP (e.g. opening up ports for VoIP) is pretty low. But always possible.

I didn't know about FluidStack. Looks interesting. If you have numbers on how many people actually use such a service I would be really interested to know :)

asimpletune• 7 years ago

Does anyone know if they’ve provided any response on this?

hombre_fatal• 7 years ago

It’s often the case that VPN users will find that services like Disney+ are blocked on many servers, presumably because the content provider is able to discover the VPN’s IP addresses and restrict access to those IPs.

Something that keeps bothering me about the title and content is that the VPN isn't blocking or unblocking Disney+. It's Disney+ that's doing the blocking. It's blocking the VPN's IP addresses.

If I block you from entering the building but you find a secret entrance through the air vents, you didn't unblock me, you evaded my block.

Their title and usage of blocking should be something more like: "How is NordVPN evading Disney+'s VPN-blocking?"

Great article though. This kind of stuff really needs to be more well known.

That it's possible to unknowingly be part of a botnet is a major flaw in the internet and ISP billing model. I think the only solution that has a shot is for unexpected bandwidth to lead to an unexpectedly high bill.

mirimir12• 7 years ago

As much as I love VPN services, this is indeed creepy.

I mean, why stop at using whatever app installs as exits?

Why not route a VPN service through an actual botnet?

sas41• 7 years ago

I have to say, the use of residential IPs as proxy for your traffic is essentially digital money laundering for data, or Data Laundering if you will. (IP laundering?)

It's one thing to use a VPN, another to use some unaware person's computer for your mischief (think about someone doing illegal stuff using this method).

Knowing how the law works in some places, and how ill-informed some law people are, I can totally see an innocent man getting locked up for illegal stuff, like hacking or other stuff that I dare not say.

mirimir12• 7 years ago

Hey, this is an ~old thread. But I'd like to contact the author, Derek Johnson. And, having no Facebook or Google account, I can't even create a Medium account to post a comment.

So do any y'all perchance know his address? If so, please email me at the address in my profile.

How Is NordVPN Unblocking Disney+?

Related Stories