Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS results now being manipulated in Turkey

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 73 posts

DNS results now being manipulated in Turkey

#1

Post by makmanalp »

Here is a valid reason for adopting DNSSEC or DNSCrypt. It's likely they're using deep packet inspection. Using VPNs seems like the only valid solution here for now.

Result from "dig youtube.com":

  ; > DiG 9.8.3-P1 > youtube.com
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER
Result from "dig youtube.com @4.2.2.2":

  ; > DiG 9.8.3-P1 > youtube.com @4.2.2.2
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER
Clip from the whois result on 195.175.254.2:

  inetnum:        195.174.0.0 - 195.175.255.255
  netname:        TR-TELEKOM-960902
  descr:          Turk Telekomunikasyon Anonim Sirketi
  country:        TR

Re: DNS results now being manipulated in Turkey

#7

Post by Jugurtha »

STSW wrote: post #3

Hide my ass will do a good job here..

Yeah, tried that. It's really slow most of the time, plus many websites will warn you or delay you (Google will display a message). Plus I wouldn't trust my data going through those machines.

As I said, I much rather get my own hosting (even shared hosting) for as cheap as 4 bucks a month, and tunnel my traffic through that machine.

But HMA is a valid solution for someone who's not willing to pay.

Re: DNS results now being manipulated in Turkey

#8

Post by alex1 »

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control.

If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. Of course, this wouldn't work if they got some Turkish (or other) CA to sign a bogus www.youtube.com certificate.

EDIT: As lawl points out, trying to require SSL on www.youtube.com won't work either, since they could just do an sslstrip type attack.

EDIT 2: Proof that they are in fact messing with routes to Google Public DNS anycast addresses (they're doing to same to OpenDNS): https://twitter.com/esesci/status/449902883933126659

Re: DNS results now being manipulated in Turkey

#9

Post by mrtksn »

alex1 wrote: post #8

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control. If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs…

how about this: http://i.imgur.com/2jEais0.png

Re: DNS results now being manipulated in Turkey

#10

Post by makmanalp »

alex1 wrote: post #8

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control. If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs…

Actually this seems likely, hmmm:

  traceroute to 8.8.4.4 (8.8.4.4), 64 hops max, 52 byte packets
   1  192.168.1.1 (192.168.1.1)  4.260 ms  0.969 ms  0.865 ms
   2  host-92-44-0-42.reverse.superonline.net (92.44.0.42)  7.465 ms  7.903 ms  7.384 ms
   3  host-82-222-174-177.reverse.superonline.net (82.222.174.177)  8.772 ms  13.703 ms  8.482 ms
   4  host-85-29-17-234.reverse.superonline.net (85.29.17.234)  7.736 ms  7.830 ms
      host-82-222-35-54.reverse.superonline.net (82.222.35.54)  11.449 ms
   5  212.156.45.29.static.turktelekom.com.tr (212.156.45.29)  30.518 ms  17.123 ms  8.674 ms
   6  inkilap-t2-1-kartal-t3-1.turktelekom.com.tr.220.212.81.in-addr.arpa (81.212.220.250)  9.945 ms *  15.140 ms
   7  * * *
   8  ulus-t3-4-ulus-t2-2.turktelekom.com.tr.223.212.81.in-addr.arpa (81.212.223.7)  18.020 ms  17.709 ms  15.444 ms
   9  * * *
  10  * * *
  11  * * *
  12  * * *
  13  * * *
Post reply on HN