Identifying Airtel middleboxes that censor HTTPS traffic • Hacker News Board

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#21

Post by [deleted] » Tue, Sep 29, 2020, 1:30 PM UTC

[deleted]

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#22

Post by galliher » Tue, Sep 29, 2020, 1:31 PM UTC

justDankin wrote: post #19

galliher wrote: post #17

This is pretty clever! The reset within airtel_103.224.212.222_fullhd720.com.pcap arrives with IP time-to-live of fifty-seven while the segment carrying synchronize | acknowledge flags arrived with a time-to-live of forty-four. So without any active probing, and some educated guesses around default IP time-to-live values @ 1<<[6..8] you could could conclude that the reset originated fourteen hops closer to the captur…

Yes! That's a great observation However, the reason I went for probing the entire path is because the TTL itself can be spoofed

Agreed, it's flimsy. Certainly a bit more effort for them spoof it correctly though. Would need to watch traffic on the path back per flow to isolate the number of prior decrements to the TTL leading up to MitM, and then store that value until such time that it sees an SNI it cares about / it's time to generate a reset.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#23

Post by tyingq » Tue, Sep 29, 2020, 1:32 PM UTC

Some older research suggests Airtel uses Netsweeper: https://citizenlab.ca/2018/04/planet-netsweeper-section-1-me...

Netsweeper is a Canadian company in the business of content filtering: https://www.netsweeper.com/

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#24

Post by Tepix » Tue, Sep 29, 2020, 1:33 PM UTC

airtelblock wrote: post #11

davidhyde wrote: post #4

Does Airtel block TLS 1.3 with the encrypted SNI extension enabled? https://blog.cloudflare.com/encrypted-sni/

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

How do they inject stuff into HTTPS pages?

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#25

Post by kzrdude » Tue, Sep 29, 2020, 1:40 PM UTC

Tepix wrote: post #24

airtelblock wrote: post #11

Earlier quoted context omitted.

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

How do they inject stuff into HTTPS pages?

it does say "Not secure" for the https info, so I guess they intercept the request

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#26

Post by uname_amiy » Tue, Sep 29, 2020, 1:41 PM UTC

dannyw wrote: post #16

airtelblock wrote: post #11

Earlier quoted context omitted.

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

DuckDuckGo is blocked in India??

Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible.

https://imgur.com/a/y7wnOjD

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#27

Post by gammarays_ » Tue, Sep 29, 2020, 1:51 PM UTC

xrisk wrote: post #14

You should consider using HTTPS :)

Please read the article :)

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#28

Post by amitheonlyone » Tue, Sep 29, 2020, 1:56 PM UTC

This is completely off-topic but the strike-through on links had me confused for a good few minutes. I was not clicking on those because I thought the link were not valid today and hence it has strike-through.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#29

Post by xrisk » Tue, Sep 29, 2020, 1:57 PM UTC

gammarays_ wrote: post #27

xrisk wrote: post #14

You should consider using HTTPS :)

Please read the article :)

I did. It was just a suggestion for OP to make his blog accessible via HTTPS.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#30

Post by kube-system » Tue, Sep 29, 2020, 1:59 PM UTC

gammarays_ wrote: post #27

xrisk wrote: post #14

You should consider using HTTPS :)

Please read the article :)

I think they're talking about the blog itself not being configured to use HTTPS. I had to add an exception in my HTTPS everywhere extension to read the article.