DNS results now being manipulated in Turkey

https://news.ycombinator.com/item?id=7492000

by makmanalp • 12 years ago

123 70 12 years ago

news.ycombinator.com

Here is a valid reason for adopting DNSSEC or DNSCrypt. It's likely they're using deep packet inspection. Using VPNs seems like the only valid solution here for now.

Result from "dig youtube.com":

  ; <<>> DiG 9.8.3-P1 <<>> youtube.com
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21333
  ;; flags: qr rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
  ;; WARNING: recursion requested but not available
  
  ;; QUESTION SECTION:
  ;youtube.com.           IN  A
  
  ;; ANSWER SECTION:
  youtube.com.        86091   IN  A   195.175.254.2
  
  ;; Query time: 25 msec
  ;; SERVER: 8.8.4.4#53(8.8.4.4)
  ;; WHEN: Sat Mar 29 13:59:52 2014
  ;; MSG SIZE  rcvd: 45

Result from "dig youtube.com @4.2.2.2":

  ; <<>> DiG 9.8.3-P1 <<>> youtube.com @4.2.2.2
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61182
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 0, ADDITIONAL: 0
  
  ;; QUESTION SECTION:
  ;youtube.com.           IN  A
  
  ;; ANSWER SECTION:
  youtube.com.        197 IN  A   173.194.113.38
  youtube.com.        197 IN  A   173.194.113.40
  youtube.com.        197 IN  A   173.194.113.33
  youtube.com.        197 IN  A   173.194.113.35
  youtube.com.        197 IN  A   173.194.113.41
  youtube.com.        197 IN  A   173.194.113.37
  youtube.com.        197 IN  A   173.194.113.39
  youtube.com.        197 IN  A   173.194.113.36
  youtube.com.        197 IN  A   173.194.113.34
  youtube.com.        197 IN  A   173.194.113.32
  youtube.com.        197 IN  A   173.194.113.46
  
  ;; Query time: 78 msec
  ;; SERVER: 4.2.2.2#53(4.2.2.2)
  ;; WHEN: Sat Mar 29 14:33:53 2014
  ;; MSG SIZE  rcvd: 205

Clip from the whois result on 195.175.254.2:

  inetnum:        195.174.0.0 - 195.175.255.255
  netname:        TR-TELEKOM-960902
  descr:          Turk Telekomunikasyon Anonim Sirketi
  country:        TR

roeme• 12 years ago

Please correct your second query, asking for the A RR of "youtube.com\@4.2.2.2." is needlessy wrong

makmanalp2• 12 years ago

Ooops, missed a space there. Fixed, thanks!

STSW• 12 years ago

Hide my ass will do a good job here..

Jugurtha5• 12 years ago

Yeah, tried that. It's really slow most of the time, plus many websites will warn you or delay you (Google will display a message). Plus I wouldn't trust my data going through those machines.

As I said, I much rather get my own hosting (even shared hosting) for as cheap as 4 bucks a month, and tunnel my traffic through that machine.

But HMA is a valid solution for someone who's not willing to pay.

mrtksn4• 12 years ago

I can confirm NS lookup to Google DNS, when done using the national cable ISP network, returns spoofed results.

here: http://i.imgur.com/jfZS31C.png

Jugurtha5• 12 years ago

SSH tunneling also works. It's cheap and easy to set up.

michh4• 12 years ago

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally.

As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config.

Of course, setting up an actual tunnel (i.e. on a lower network layer) would be better but that's a bit more complicated to do.

Jugurtha5• 12 years ago

What happens when you change the default DNS on the router level to OpenDNS or Google.

(i.e: Telnet to the router, and change DNS there).

alyxr• 12 years ago

Why isn't it default behavior to route dns through socks?

kijin• 12 years ago

If you're on *nix, sshuttle is the tool you want. It's ssh tunnel on steroids, and it works with every program even if they're not configured to use a SOCKS proxy (such as Flash). It's also faster because it avoids the TCP-over-TCP problem that the usual SOCKS proxy entails.

    sshuttle --dns -v -r username@servername 0/0

https://github.com/apenwarr/sshuttle

alex14• 12 years ago

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control.

If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. Of course, this wouldn't work if they got some Turkish (or other) CA to sign a bogus www.youtube.com certificate.

EDIT: As lawl points out, trying to require SSL on www.youtube.com won't work either, since they could just do an sslstrip type attack.

EDIT 2: Proof that they are in fact messing with routes to Google Public DNS anycast addresses (they're doing to same to OpenDNS): https://twitter.com/esesci/status/449902883933126659

mrtksn4• 12 years ago

how about this: http://i.imgur.com/2jEais0.png

darkhorn• 12 years ago

What application is this?

makmanalp2• 12 years ago

Actually this seems likely, hmmm:

  traceroute to 8.8.4.4 (8.8.4.4), 64 hops max, 52 byte packets
   1  192.168.1.1 (192.168.1.1)  4.260 ms  0.969 ms  0.865 ms
   2  host-92-44-0-42.reverse.superonline.net (92.44.0.42)  7.465 ms  7.903 ms  7.384 ms
   3  host-82-222-174-177.reverse.superonline.net (82.222.174.177)  8.772 ms  13.703 ms  8.482 ms
   4  host-85-29-17-234.reverse.superonline.net (85.29.17.234)  7.736 ms  7.830 ms
      host-82-222-35-54.reverse.superonline.net (82.222.35.54)  11.449 ms
   5  212.156.45.29.static.turktelekom.com.tr (212.156.45.29)  30.518 ms  17.123 ms  8.674 ms
   6  inkilap-t2-1-kartal-t3-1.turktelekom.com.tr.220.212.81.in-addr.arpa (81.212.220.250)  9.945 ms *  15.140 ms
   7  * * *
   8  ulus-t3-4-ulus-t2-2.turktelekom.com.tr.223.212.81.in-addr.arpa (81.212.223.7)  18.020 ms  17.709 ms  15.444 ms
   9  * * *
  10  * * *
  11  * * *
  12  * * *
  13  * * *

alex14• 12 years ago

Yeah, looks like they're mucking with the routes for Google Public DNS anycast IPs.

EDIT: More evidence that this is what's happening (they're doing to same to OpenDNS's anycast addresses): https://twitter.com/esesci/status/449902883933126659

lawl2• 12 years ago

another solution would be for YouTube to require SSL for all connections coming from Turkish IPs.

What? NO! They are messing with the DNS results from 8.8.4.4 (Google DNS)

Too early for TLS to do anything. Maybe with HSTS, but I still doubt that HSTS is any effective against state level MITM.

alex14• 12 years ago

You're right. Maybe if they turned on and required SSL for everyone visiting www.youtube.com and added www.youtube.com to Chrome's preloaded HSTS list and somehow got everyone to use Chrome. Sadly, this probably won't happen, but DNSSEC adoption probably won't happen either. Even with DNSSEC, they could still do deep packet inspection on HTTP traffic going to YouTube IPs and initiate MITM attacks that way.

GICodeWarrior• 12 years ago

Are you suggesting the government compromised a trusted SSL CA? Or are you just saying they blocked HTTPS?

vijayp• 12 years ago

Too bad DNSSEC isn't widely used; signing the records would prevent this from working. The government could still block the DNS requests, though.

alex14• 12 years ago

Sure, they wouldn't be able to proxy all HTTP requests through their own servers like they're doing now, but they'd still be able to do MITM attacks at the IP level. They're already messing with routes to Google Public DNS IPs so they could just as easily mess with routes to YouTube's IPs. I don't think DNSSEC is the solution in cases like this. Somehow getting everyone to use SSL for everything is a much better solution in my opinion.

davidu2• 12 years ago

As I pointed out above, DNSSEC doesn't stop this.

I am not just a DNSSEC hater, but the level of misunderstanding on DNSSEC is quite large.

When victim issues a query for youtube.com, I can intercept that query and hand back whatever response I want. Unless the victim KNOWS IN ADVANCE (which DNSSEC doesn't offer) that the response should be DNSSEC signed, they will accept my forged response.

DNSSEC solves problems we don't really have, and ignores the ones we do.

wtallis• 12 years ago

Can't you say the same thing about users who don't know to expect their connection to use TLS? What you're claiming as the problem isn't a problem with DNSSEC, but with the absence of DNSSEC. If DNSSEC were the default, then this attack couldn't happen.

bayesianhorse5• 12 years ago

Seems like Erdogan is hell-bent on restricting free speech in Turkey.

Somehow it is comforting how abysmally bad he is at doing that though...

mrtksn4• 12 years ago

The elections are tomorrow and it's prohibited by law to broadcast political rallies on the last day.

The pro-government TV channels are broadcasting Erdogan's rallies while other TV channels respect the law(and they are afraid of disproportional penalties if they do the same).

So today only Erdogan is on national TV.

bayesianhorse5• 12 years ago

So every voter in Turkey essentially knows what Erdogan is doing. So nobody who understands democracy should vote for Erdogan.

If however not enough people understand democracy ...

lawl2• 12 years ago

The best democracy money can buy!

lemonade• 12 years ago

There are many more public DNS servers out there, too many to block.There is a nice comprehensive list here:

http://public-dns.tk/

You might also be interested in https://dnscrypt.eu.

est• 12 years ago

They mangle all udp port 53 data.

leath• 12 years ago

Actually not all port 53 as there are some DNS servers still accessible and actually resolves stuff fine.

aib• 12 years ago

No, there's no mangling of data (apart from HTTP which gets injected with a RST flagged packet once in a while)

wila• 12 years ago

Google also offers IPv6 public DNS servers, maybe that helps? (probably not though as they might not yet have turned on ipv6)

2001:4860:4860::8888 and 2001:4860:4860::8844

Also look at the other links that user lemonade posted here.

davidu2• 12 years ago

DNSSEC wouldn't stop this... unless the resolver knew to require DNSSEC and ignored unsigned responses (which is unlikely).

DNSCrypt could help here... but chances are their middleware would just barf on it.

You need something more evasive.

axaxs• 12 years ago

It wouldn't prevent getting the wrong answer, sure. But a smart resolver would see DS records at the parent and recognize it as an unsigned, thereby invalid, response.

nahlio• 12 years ago

Thus, DNSSEC doesn't protect against censorship.

It's hilarious that people are saying DNSSEC can be used in Turkey (or anywhere else) to defend against censorship. Either they don't know what they're talking about or don't care about having an honest discussion. Or both.

bohm• 12 years ago

namecoin would fix this: https://www.namecoin.org/

M4v3R• 12 years ago

Excuse my ignorance, but does anybody knows why they are doing it? Is there any piece of news I missed?

higherpurpose• 12 years ago

Yes, you missed quite a bit. They tried to block Twitter and Youtube, and then people started using Google DNS, OpenDNS or others to circumvent the block.

Some leaks about Erdogan's corruption and false flag attack in Turkey to blame Syria and go to war with it came out in those channels, and he wanted people to stop talking about it or see the leaks. I think some elections are in Turkey soon, too.

ckaygusu• 12 years ago

There have been some sound recording leaks in Turkey, exposing high ranking government officials' and Erdogan's private conversations, which is absolutely scandalous. This sunday, there will be an election, and the ruling party doesn't want people to listen to these records prior to the election. As you can guess, this material was primarily published through YouTube, hence the blockage.

cryptologics• 12 years ago

this is what I get with VPN and without VPN http://i.imgur.com/XNtDGYq.png

hadoukenio3• 12 years ago

The NSA and GCHQ have been doing this for years, so why complain about Turkey doing this? The only difference I can see is targeting individuals vs targeting the general population.

linuxhansl• 12 years ago

Maybe because it's the wrong thing to do regardless of who's doing it?

javajosh• 12 years ago

Your tacit assertion is that if something wrong is done for years, and you find out it's done one more time, you shouldn't bother complaining about it. People like you have existed for all time, and will always exist, but your views truly don't matter: change comes because people continue to fight for what is right, despite the balance of years. Slavery on US soil had been legal and "normal" for hundreds of years, but that didn't stop people from "complaining" about it, and eventually changing it. Women's suffrage, same story. Wanton violation of our 4th Amendment rights in the digital age will proceed accordingly.

hadoukenio3• 12 years ago

See my reply to the other comment.

ryanobjc• 12 years ago

When I see messages like this, I start to think... who is this person. What are their agenda? What's the chance they are turkish?

After all, if you cannot see the difference between the alleged single person targeting and the blanket targeting of an entire population, I'm not really sure you deserve to be here.

I guess I'll leave you with that Stalin quote "Death of one man is a tragedy. Death of a million is a statistic".

hadoukenio3• 12 years ago

Wow, a bit harsh.

What I was trying to say was that Governments do shit like this, regardless of if they are China, North Korea, Turkey or America. In terms of doing things against their citizens, every country is in the Axis of Evil, so STOP complaining and instead get behind projects that will fix this shit by making the internet bulletproof.

sanqui• 12 years ago

I didn't see this posted on HN yet - Turekey is also blocking the Tor Project's website: https://www.eff.org/deeplinks/2014/03/when-tor-block-not-tor...

ttflee2• 12 years ago

[sarcasm] Having been enduring this kind of shit for years in mainland China, I am glad to see that it migrated to the (sort of) 'free' world, eventually! [/sarcasm]

BTW, I have to manoeuvre some IP addresses of the CDNs in /etc/hosts in order to get access to github.com today, and some others for stack overflow.com last week. Interference from those who have power really sucks!

CDNs nowadays are so vulnerable to political issues, and some CDNs seems to be hurt by extended non-specific attacks/blocks to some other sites sharing the same IP addresses, due to some unrelated reasons, which makes me feel nostalgic to the web before CDNs.

acd• 12 years ago

Wont stop tor or onion addresses

You can do the same setup as http://piratebrowser.com/

Fasebook• 12 years ago

It's about time Turkey took a step towards US in controlling the flow of information. I mean, how long has this been going on here, undetected? The obvious solution, Turkey, is to target specific individuals after digging into their background, confirming that they are not computer experts before attacking them via their computer.

gaoshan• 12 years ago

"Using VPNs seems like the only valid solution"

But a government like China interferes with even VPNs (more so outside of the greater Shanghai and Beijing metro areas, in case anyone is sitting in those areas saying "My VPN works great"... they permit it and can block or interfere with it anytime they like) so I don't think they are really a solution. In China, nothing really works if the authorities don't want it to. VPNs are degraded to the point of being unusable, SOCKs proxy over SSH is the same, TOR is unusably slow, etc. Unfortunately, I don't think there really IS a solution in the face of determined governmental interference.

ttflee2• 12 years ago

Choose an expensive VPN. Those free ones are the ones got quickly blocked as more people would be using them which in turn results in the blockage.

rahimnathwani• 12 years ago

Yes, the Chinese government can interfere with or block VPNs whenever they want.

However, don't discount the impact of bandwidth/peering issues on VPN performance. In most cases, I've found that VPN throughput over TCP (either PPTP or OpenVPN) is similar to HTTP throughput to the same host.

You can test this yourself. Put a file on your VPN server, and try to retrieve it over HTTP. If you're worried that the latency is limiting the throughput, use wget to make several connections at the same time, and sum up the transfer speeds.

Finally, you're right - there is no (technical) solution in the face of determined governmental interference.

DNS results now being manipulated in Turkey

Related Stories