The Pirate Bay – North Korean hosting? No, it’s fake

https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-fake

by dewey • 13 years ago

195 59 13 years ago

tuomasb2• 13 years ago

It's fake but his analysis is wrong. TPB is still somewhere in Europe. Otherwise you couldn't have 50ms RTT to thepiratebay.se TCP port 80 from within Europe. I explained here how they do it http://news.ycombinator.com/item?id=5319720

bradleyjg• 13 years ago

From the discussion there it looks like the real host is

rrbone UG (haftungsbeschraenkt)

Leibnizstr. 8a

44147 Dortmund

GERMANY

https://www.rrbone.net/

darklajid• 13 years ago

For someone that grew up around Dortmund, that went to Dortmund for parties and fun for a dozen years that would make me rather happy.. :)

runn1ng2• 13 years ago

Yes, he added a second part

https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-f...

peterwwillis• 13 years ago

Yes, the speed of light dictates how long it takes data to travel. But that isn't definitive proof that TPB's servers are hosted that close.

The easiest thing to do is to put up caching reverse proxies on big providers that respond immediately and only slow down on "dynamic" content, which we all assume to be slower anyway.

A more non-conventional approach would be to break the embedded OS of an intermediate router or network device (can you count how many transparent filtering network devices there are between you and a random website?) and have it return false data or provide static NAT to establish connections before they actually reach the destination.

The spoofed packets seems the most likely explanation. It's just not the only possibility :-)

youngerdryas4• 13 years ago

This will be disappointing to some of the more confused HNers.

jfb2• 13 years ago

Some of the reasoning skills on display in that other thread beggar the imagination.

solarexplorer• 13 years ago

s/reasoning/trolling/

rikacomet• 13 years ago

hmm? The TPB announcement, didn't say that they have taken up the offer made to them by NK(it clearly says, they are invited), and I'm sure, its not a easy and quick march to NK. They are hosted in perhaps, in Spain & Norway, as they say so.

but yeah, the title of the other thread is wrong.

oellegaard• 13 years ago

This is the reason why I read HN and not some regular news media. Here you can't write bullshit, there will be a repost within a short amount of time, describing what really happened.

oseibonsu• 13 years ago

The LA Times quoted a post from Hacker News: http://www.latimes.com/business/technology/la-fi-tn-pirate-b...

Wilya• 13 years ago

I considered editing my topmost comment to say something along the lines: "Edit: warning, this is not entirely true, read the posts below".

Now I'm just going to tell my mum I'm in the LA Times.

sniuff• 13 years ago

They are know for trolling, it's just another troll

iso-8859-1• 13 years ago

Not surprising if it's Cambodia, since that's where Fredrik Neij went when people dealt him too much shit in Europe. Source: TBP AFK.

hedwall• 13 years ago

Actually, he went to Thailand and settled down in Laos. Gottfrid stayed in Cambodia until he was apprehended.

moxie• 13 years ago

Dude, this was a (really well executed) joke! It should be our responsibility to help keep this shit going.

youngerdryas4• 13 years ago

Yes, let's make internet freedom a joke. But we already have anonymous for that.

Edit: The real tragedy is the people excusing NK so they can have their way. I'm not saying they are dumb, just unlucky at thinking.

Edit2: No defense of hackivists making a mockery of themselves? How much does TPB make?

derleth3• 13 years ago

> The real tragedy is the people excusing NK so they can have their way.

I've read this sentence a few times, left, come back, and re-read it a few times, and I still can't really make heads or tails of it.

Are you saying that people doing this (pretending their website is hosted in North Korea) makes light of the suffering of people who live in North Korea? I don't understand how you can conclude that: The whole point is that, as bad as North Korea is, it still doesn't go after torrent sites. It wouldn't work if North Korea were replaced with a country that actually has a lot of freedoms.

Are you implying that people should be working to end what's going on in North Korea? Well, what can anyone do? Any serious attempt to force change would simply lead to a massive, destructive war, killing most of the people that the outside world wants to help.

StavrosK2• 13 years ago

How is it possible to fake the ip of a server? I don't get it. If the A record resolves to the Korean IP, but the server isn't there, how does it reply?

wmf2• 13 years ago

WHOIS tells you where an IP is supposed to be located, but BGP determines where the IP is actually located. They don't have to agree and both can be hacked/spoofed.

StavrosK2• 13 years ago

Hmm, isn't the Korean subnet allocation fixed? If an IP falls in that range, doesn't it belong to the Korean ISP? How can someone be assigned that IP by someone other than the ISP who owns it?

jlgaddis6• 13 years ago

> WHOIS tells you where an IP is supposed to be located

WHOIS tells you the address of the organization (as they supply it) the IP addresses are allocated to, nothing more.

> BGP determines where the IP is actually located

No, BGP determines the path through the Internet, via various ISPs, that your packets take to get to their destination.

a1a• 13 years ago

I think this comment on the article is worth reading:

blumentopf am 04. March 2013 um 22:06: "Note that 175.45.176.0/22 is visible behind China Unicom in the global routing table (shortest AS path ends with 4837 131279), whereas 194.71.107.0/24 is only visible behind Intelsat (22351 131279 51040). It should therefore not come as a surprise that you see a different route when you’re doing a traceroute directly to 175.45.177.217.

While you could be right it’s also conceivable that there’s a link between Cambodia and North Korea and that the next hop behind 202.72.96.6 is indeed 175.45.177.217 (in North Korea, not just a transit net for BGP handoff). So I don’t see this as conclusive evidence that it’s a fake."

tuomasb2• 13 years ago

Now it seems they have also added fake lag to TCP port 80. hlds@machine:~$ tcptraceroute -f 128 -m 128 thepiratebay.se 80 Selected device venet0, address 5.9.249.8, port 41774 for outgoing packets Tracing the path to thepiratebay.se (194.71.107.15) on TCP port 80 (www), 128 hops max 128 thepiratebay.org (194.71.107.15) [open] 751.198 ms 735.700 ms 767.937 ms

This wasn't the case an hour ago. I was able to get 50ms RTT from TCP port 80 but now they probably added fake lag with tc(linux traffic shaping tool)

jabiko• 13 years ago

I can still get a fast response:

    # tcptraceroute -f 128 -m 128 thepiratebay.se
    traceroute to thepiratebay.se (194.71.107.15), 128 hops max, 60 byte packets
    128  thepiratebay.org (194.71.107.15) <syn,ack>  38.726 ms  39.877 ms  39.333 ms

ag_47• 13 years ago

The link is resulting in a 404 for me

D9u• 13 years ago

That would be the "HN Effect," which is the result of having your site linked to on page one of THN.

deno• 13 years ago

Shouldn’t give 404 if that was the case.

jtchang• 13 years ago

One thing a lot of people don't realize is that a good deal of how the internet routes traffic is simply determined by trust. Yes there are complicated legal agreements between AS's but when ti comes down to it any AS can advertise any route they want. Most edge routes are configured to simply trust routes as they come in. If they didn't we wouldn't have such a redundant infrastructure.

jlgaddis6• 13 years ago

> when ti comes down to it any AS can advertise any route they want

If the provider isn't filtering, sure.

> Most edge routes are configured to simply trust routes as they come in

Actually, edge routers are where your prefix filtering takes place. It's much more difficult to filter at the "core".

windexh8er• 13 years ago

Very true, but where is the core? I've setup many BGP peering sessions, and yes all of those direct edge connections into tier 1 providers is generally filtering prefixes longer than /24. These are where the big propagation problems happen. Whoops, I just advertised my internal network (including a bunch of /31 and /32s) to the Internet either clobbering route tables (capacity problem) or stomping routes.

This is why my comment posted in the recent CloudFlare post mortem talks about good network engineers and the misunderstanding of many 'technical savvy' folks that know enough to do some really dumb things architecturally.

This lends credence to the fact that, this is well understood if you've spun up peering sessions more than once. I find it slightly embarrassing most people don't realize how fragile a framework BGP really is. But it definitely comes to light reading through forums like HN that lean towards the developer side of readership.

nikcub• 13 years ago

It also means the internet is vulnerable to simple sysadmin errors. For eg. the only time Google went down world-wide was a BGP error:

http://tech.slashdot.org/story/12/11/06/2040226/why-google-w...

Syria being taken offline was also via BGP

http://www.cert.at/services/blog/20121129184048-616.html

derleth3• 13 years ago

Remember AS7007!

http://en.wikipedia.org/wiki/AS_7007_incident

http://www.merit.edu/mail.archives/nanog/1997-04/msg00444.ht...

http://lists.ucc.gu.uwa.edu.au/pipermail/lore/2006-August/00...

dewey2• 13 years ago

He just posted a part2 for those interested: https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-f...

"In the end i will also solve the mystery of the REAL hosting location, with proof."

sokrates• 13 years ago

> Do not play with BGP.

Well, okay. Don't touch it. It ain't broken. I don't think there's anything wrong with showing people who are not network experts how easy it is to (believably) route things into nirvana. I guess the effects of fake routes being propagated could have been a lot worse than this. Why not promote some discussion and thought around BGP and friends? Maybe we can come up with something more resistant.

jlgaddis6• 13 years ago

Work is already underway. Feel free to contribute.

nate_martin• 13 years ago

BGPSec

trotsky• 13 years ago

This guy should not go around publicly dissecting fake routes if he does such a shit job of it. Why would you write a blog post about a route without even looking at it from a second location? It's hysterical that he brags about his skills that allowed him to decipher that they were hosting a high traffic website over a sat link in the middle of nowhere.

Quequau• 13 years ago

Spent a solid 30 secounds wondering if that traceroute was somehow live because it happened to be done from the city I live in and the ISP I use.

damian2000• 13 years ago

The misspelling of Phnom Penh several times here was a bit grating.

The Pirate Bay – North Korean hosting? No, it’s fake

Related Stories