Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Iran Shuts Down Major Websites and Https Protocol

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 151 posts

Re: Iran Shuts Down Major Websites and Https Protocol

#91

Post by j_s »

kiloaper wrote: post #90
j_s wrote: post #87

Earlier quoted context omitted.

Where is the link to the required changes? Binaries = scary. Also, an SSL link doesn't seem useful?

I took a look at it. It's not a binary. It's a python file (easily readable) that acts as a wrapper for ssh. Extract the contents of the tar.gz[1] for example to see it. It's great if it works because it apparently doesn't need changes to the remote ssh server. [1] https://launchpad.net/~mohammad-sepent/+archive/ppa/+files/i... Edit: Non SSL link: http://ppa.launchpad.net/mohammad-sepent/ppa/ubuntu/pool/mai...

Thanks for digging into this.

Re: Iran Shuts Down Major Websites and Https Protocol

#92

Post by kiloaper »

chernevik wrote: post #82
kiloaper wrote: post #79

Earlier quoted context omitted.

>Maybe but they'll lose the productivity gains from networked organizations and communities Absolutely but the effect will be not be huge in my opinion because of the language differences. All my Chinese friends here in the EU still use mainly Chinese language website, most of which are based in China, especially the social networking ones.

Companies aren't going to manage inventory, customer relations or finance over open channels. So they'd reduce the gains from networking their own internal communications. They could try to mitigate by rationing secure channels, or allowing them with backdoors, but this still sacrifices the spontaneous creativity of a truly open system.

You make a good point. It certainly would discourage or kill small businesses but, as you suggest, I'm sure larger more powerful ones will get special treatment (native ones particularly so). Considering China was willing to let Google leave the country it appears that the balance of power is shifting already.

Re: Iran Shuts Down Major Websites and Https Protocol

#93

Post by pooriaazimi »

dasil003 wrote: post #85
gsa wrote: post #30

Earlier quoted context omitted.

If they are dropping all encrypted connections, it doesn't matter what port you use for ssh, it'll be dropped.

If. That is why I asked the question.

They drop all secure connections. For security reasons, I had to access a VPS on port 33 (instead of 22), and in the past couple months I've been unable to do so.

Re: Iran Shuts Down Major Websites and Https Protocol

#94

Post by pooriaazimi »

sepent wrote: post #77

Moreover, SSH has stopped working, too. But, finally I found a way to circumvent it. A simple twist in the client side, could simply bypass the filtering. I wrote a simple script to do this, and I would like to share it with all of my countrymen: https://launchpad.net/~mohammad-sepent/+archive/ppa/+package... To use it, just replace ssh command with issh like this: issh user@hostname [other-ssh-options]

Ironically, I can't access your script (it's https!). I'd be thankful if you could just copy/paste it here.

Re: Iran Shuts Down Major Websites and Https Protocol

#95

Post by peterwwillis »

I haven't checked yet whether they're using layer 7 filtering or just blocking ports, but assuming it was a lame combination of the two, you can try tunneling through HTTP on port 80.

Download proxytunnel and follow this guide to set up Apache (or whatever server you prefer) to http proxy ssh connections to port 22: http://dag.wieers.com/howto/ssh-http-tunneling/

Then run ssh with proxytunnel as the ProxyCommand (as shown in the guide). It will make a plaintext HTTP connection, request a CONNECT yoursite.com:22, and if they aren't inspecting "too deep" you should be able to get an ssh connection.

If that doesn't work there's always icmp tunneling (hans), dns tunneling (iodine), and various other options. See if you can make a udp connection over port 53 to a remote host and transmit non-DNS packets; if they aren't intercepting DNS traffic, just make an openvpn udp connection over port 53 for your tunnel.

I actually have a whole paper on circumventing captive portals and firewalls and a crappy tool to probe them if anyone wants it.

Re: Iran Shuts Down Major Websites and Https Protocol

#96

Post by pooriaazimi »

dutchbrit wrote: post #18

And here I was, about to ask HN to force SSL on the login page..

Please... don't. I have enough trouble with GitHub right now. Those guys enforce SSL not only on login page, but on all pages - yesterday it took me 2 hours to clone a github project (that was only 30k).

Re: Iran Shuts Down Major Websites and Https Protocol

#98

Post by jcr »

mrud wrote: post #86
jcr wrote: post #81

As it so happens, I've spent the last day trying to break in through the technical restrictions of a regime from the outside. There is a country with a very oppressive government that prevents outsiders from observing them. It's a tiny island monarchy that doesn't matter much in the grand scheme of things, but you may have heard of them; it's called the "United Kingdom" or "Great Britain" or whatever. If you don't li…

But DPI is used in Iran and just using different ports does _not_ help

Do you have any supporting data for your statement?

I'm not trying to be an ass by asking; I'm actually curious, but testing it myself (American) is not particularly smart.

Anyhow, if DPI is in place and at wire-speed (rare, but would cover everything), then the answer is obvious; ssh over http. It can be done with gothard [1] and corkscrew [2].

[1] http://www.nazgul.ch/dev.html [2] http://www.agroman.net/corkscrew/

Re: Iran Shuts Down Major Websites and Https Protocol

#99

Post by pooriaazimi »

Almost all websites that worth visiting are either blocked by Iranian government or by US export laws (SourceForge, Google Code, ...) so people rely heavily on VPNs and proxies. One of the most used proxies is YourFreedom[1] that offers a special service for Iranian people (a free 512 kbps socks proxy). It sounds great, but unfortunately they have been compromised. About 10 months ago, I contacted them (they didn't respond, which makes me a little worried).

It looks like Iranian government uses a transparent proxy, so all connections to ems01.your-freedom.de (ems01 through ems24) first redirect to iran.ir and then go to YF's servers!

(YF is blocked right now, so I can't re-do this test right now. These images are from my email to YF 10 months ago)

http://www.imeezo.com/v/images/49229825994939115647.png

http://www.imeezo.com/v/images/46490363986030440278.png

A page accessed without a VPN/proxy: http://www.imeezo.com/v/images/98155525346546936123.png

The same page, but with a VPN: http://www.imeezo.com/v/images/30239946359511647325.png

In the third image, the response is from iran.ir's transparent proxy, not YF servers...

[1] your-freedom.de

Re: Iran Shuts Down Major Websites and Https Protocol

#100

Post by Retric »

Spearchucker wrote: post #67
humanfromearth wrote: post #32

They control the physical network. As long as they have that control they will be able to do what they want. The only way to deal with these fuckers (not just Iran) is to start using collectively Ipsec or something similar. All SSL movement is just the beginning. I'm sure every big service will try to encrypt it's traffic more and more to protect itself from governments that try to criminalize their users. Forcing co…

I think that on the Internet TLS and SSL are fast approaching their sell-by dates [1]. We can do secure comms over HTTP - all it takes is a binary protocol like TLV, encrypting that, and implementing a well thought through approach to key management. Ideally something derived from the Needham-Schroeder protocol, but if we take on some lessons from PGP and the like, using timestamps instead of nonces. The Internet is…

Deep packet inspection allows you to block any well known protocol.
Post reply on HN