Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Airtel is sniffing and censoring CloudFlare’s traffic in India

medium.com

Post reply on HN
Print view View original

11–20 of 68 posts

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#11

Post by spikengineer »

Here is what is happening:

Cloudflare Indian datacentres are hosted on Airtel's networks.

Airtel by default blocks and replaces(with a notice) Piratebay traffic all across it's network due to multiple court orders.

Cloudflare India servers call the piratebay origin servers and ask for a master copy and Airtel instead gives the substitute page on all the http traffic from piratebay to cloudflare servers.

Cloudflare servers display the malformed page they received from Airtel to all clients(all ISP's) asking for piratebay in India.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#12

Post by spikengineer »

fahrradflucht wrote: post #4

Seems like it's not just airtel: https://medium.com/@sushubh/when-you-said-they-do-not-even-k...

It's only airtel blocking the connection between Cloudflare India's servers and the Origin server's for piratebay because Cloudflare uses Airtel as it's ISP for it's datacentres.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#13

Post by ComodoHacker »

spikengineer wrote: post #11

Here is what is happening: Cloudflare Indian datacentres are hosted on Airtel's networks. Airtel by default blocks and replaces(with a notice) Piratebay traffic all across it's network due to multiple court orders. Cloudflare India servers call the piratebay origin servers and ask for a master copy and Airtel instead gives the substitute page on all the http traffic from piratebay to cloudflare servers. Cloudflare se…

>Airtel blocks the http traffic to piratebay

No, Airtel substitutes Piratebay's response to CloudFlare.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#14

Post by jgrahamc »

yoo1I wrote: post #7

All I'm hearing is that Cloudflare allows their customers to configure client facing TLS without enforcing it upstream over the internet, providing a false sense of security. Thanks Cloudflare! ... and I'm pretty sure that their response will be "We are just a proxy, we are not responsible for anything".

We give all our customers free certificates for their origin servers.

http://blog.cloudflare.com/cloudflare-ca-encryption-origin/

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#15

Post by spikengineer »

ComodoHacker wrote: post #13
spikengineer wrote: post #11

Here is what is happening: Cloudflare Indian datacentres are hosted on Airtel's networks. Airtel by default blocks and replaces(with a notice) Piratebay traffic all across it's network due to multiple court orders. Cloudflare India servers call the piratebay origin servers and ask for a master copy and Airtel instead gives the substitute page on all the http traffic from piratebay to cloudflare servers. Cloudflare se…

>Airtel blocks the http traffic to piratebay No, Airtel substitutes Piratebay's response to CloudFlare.

Yeah, What you said is correct. I was not clear and edited the comment.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#16

Post by Manishearth »

hitr wrote: post #8

In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't it ? >curl -H "Host: thepiratebay.org" http://192.30.253.112/ May be I missed something. Technically it is possible block the traffic by looking at SNI[1] or simply block the ipaddress if it belongs to the blocked site.I always thought that every ISPs had to fo…

It can't sniff https traffic, except for basic metadata.

The point is that many sites using cloudflare talk to cloudflare over HTTP (while users get HTTPS), and airtel is sniffing that.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#17

Post by kekub »

hitr wrote: post #8

In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't it ? >curl -H "Host: thepiratebay.org" http://192.30.253.112/ May be I missed something. Technically it is possible block the traffic by looking at SNI[1] or simply block the ipaddress if it belongs to the blocked site.I always thought that every ISPs had to fo…

It is possible for them to block the access to such a site using SNI, however they will not be able to do a man-in-the-middle attack (as it would be possible in this scenario) unless they could obtain a valid certificate for the site.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#18

Post by kekub »

Is there any way for cloudflare to detect wether or not their connection has been modified by a third party besides certificates? I could only think of loading the site from more than one location and comparing the responses. However that might not be a trivial task, as most websites will not be static enough.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#19

Post by voltagex_ »

yoo1I wrote: post #7

All I'm hearing is that Cloudflare allows their customers to configure client facing TLS without enforcing it upstream over the internet, providing a false sense of security. Thanks Cloudflare! ... and I'm pretty sure that their response will be "We are just a proxy, we are not responsible for anything".

The threat is completely different, although I agree with you they're providing the illusion of end to end security when that's not the case.

The likelihood of a bad actor between Cloudflare and the origin server seems lower than a bad actor between Cloudflare and the user - where I'd class a coffee shop wifi portal page as a bad actor.

Re: Airtel is sniffing and censoring CloudFlare’s traffic in India

#20

Post by pilif »

ComodoHacker wrote: post #13
spikengineer wrote: post #11

Here is what is happening: Cloudflare Indian datacentres are hosted on Airtel's networks. Airtel by default blocks and replaces(with a notice) Piratebay traffic all across it's network due to multiple court orders. Cloudflare India servers call the piratebay origin servers and ask for a master copy and Airtel instead gives the substitute page on all the http traffic from piratebay to cloudflare servers. Cloudflare se…

>Airtel blocks the http traffic to piratebay No, Airtel substitutes Piratebay's response to CloudFlare.

And this is why we want HTTPS everywhere. Yes. It would probably mean that the site is completely not reachable, but I prefer that to an altered response.
Post reply on HN