Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS results now being manipulated in Turkey

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 73 posts

Re: DNS results now being manipulated in Turkey

#11

Post by alex1 »

makmanalp wrote: post #10
alex1 wrote: post #8

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control. If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs…

Actually this seems likely, hmmm: traceroute to 8.8.4.4 (8.8.4.4), 64 hops max, 52 byte packets 1 192.168.1.1 (192.168.1.1) 4.260 ms 0.969 ms 0.865 ms 2 host-92-44-0-42.reverse.superonline.net (92.44.0.42) 7.465 ms 7.903 ms 7.384 ms 3 host-82-222-174-177.reverse.superonline.net (82.222.174.177) 8.772 ms 13.703 ms 8.482 ms 4 host-85-29-17-234.reverse.superonline.net (85.29.17.234) 7.736 ms 7.830 ms host-82-222-35-54.r…

Yeah, looks like they're mucking with the routes for Google Public DNS anycast IPs.

EDIT: More evidence that this is what's happening (they're doing to same to OpenDNS's anycast addresses): https://twitter.com/esesci/status/449902883933126659

Re: DNS results now being manipulated in Turkey

#12

Post by lawl »

alex1 wrote: post #8

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control. If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs…

> another solution would be for YouTube to require SSL for all connections coming from Turkish IPs.

What? NO! They are messing with the DNS results from 8.8.4.4 (Google DNS)

Too early for TLS to do anything. Maybe with HSTS, but I still doubt that HSTS is any effective against state level MITM.

Re: DNS results now being manipulated in Turkey

#13

Post by alex1 »

lawl wrote: post #12
alex1 wrote: post #8

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control. If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs…

> another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. What? NO! They are messing with the DNS results from 8.8.4.4 (Google DNS) Too early for TLS to do anything. Maybe with HSTS, but I still doubt that HSTS is any effective against state level MITM.

You're right. Maybe if they turned on and required SSL for everyone visiting www.youtube.com and added www.youtube.com to Chrome's preloaded HSTS list and somehow got everyone to use Chrome. Sadly, this probably won't happen, but DNSSEC adoption probably won't happen either. Even with DNSSEC, they could still do deep packet inspection on HTTP traffic going to YouTube IPs and initiate MITM attacks that way.

Re: DNS results now being manipulated in Turkey

#16

Post by michh »

Jugurtha wrote: post #6

SSH tunneling also works. It's cheap and easy to set up.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally.

As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config.

Of course, setting up an actual tunnel (i.e. on a lower network layer) would be better but that's a bit more complicated to do.

Re: DNS results now being manipulated in Turkey

#18

Post by Jugurtha »

michh wrote: post #16
Jugurtha wrote: post #6

SSH tunneling also works. It's cheap and easy to set up.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, se…

What happens when you change the default DNS on the router level to OpenDNS or Google.

(i.e: Telnet to the router, and change DNS there).

Re: DNS results now being manipulated in Turkey

#19

Post by mrtksn »

bayesianhorse wrote: post #15

Seems like Erdogan is hell-bent on restricting free speech in Turkey. Somehow it is comforting how abysmally bad he is at doing that though...

The elections are tomorrow and it's prohibited by law to broadcast political rallies on the last day.

The pro-government TV channels are broadcasting Erdogan's rallies while other TV channels respect the law(and they are afraid of disproportional penalties if they do the same).

So today only Erdogan is on national TV.

Re: DNS results now being manipulated in Turkey

#20

Post by michh »

Jugurtha wrote: post #18
michh wrote: post #16

Earlier quoted context omitted.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, se…

What happens when you change the default DNS on the router level to OpenDNS or Google. (i.e: Telnet to the router, and change DNS there).

That's the whole point: they seem to be using deep packet inspection to mess with all DNS traffic regardless of the DNS server being used.
Post reply on HN