Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS results now being manipulated in Turkey

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 73 posts

Re: DNS results now being manipulated in Turkey

#21

Post by alex1 »

vijayp wrote: post #14

Too bad DNSSEC isn't widely used; signing the records would prevent this from working. The government could still block the DNS requests, though.

Sure, they wouldn't be able to proxy all HTTP requests through their own servers like they're doing now, but they'd still be able to do MITM attacks at the IP level. They're already messing with routes to Google Public DNS IPs so they could just as easily mess with routes to YouTube's IPs. I don't think DNSSEC is the solution in cases like this. Somehow getting everyone to use SSL for everything is a much better solution in my opinion.

Re: DNS results now being manipulated in Turkey

#22

Post by wila »

Google also offers IPv6 public DNS servers, maybe that helps? (probably not though as they might not yet have turned on ipv6)

2001:4860:4860::8888 and 2001:4860:4860::8844

Also look at the other links that user lemonade posted here.

Re: DNS results now being manipulated in Turkey

#23

Post by alyxr »

michh wrote: post #16
Jugurtha wrote: post #6

SSH tunneling also works. It's cheap and easy to set up.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, se…

Why isn't it default behavior to route dns through socks?

Re: DNS results now being manipulated in Turkey

#24

Post by kijin »

michh wrote: post #16
Jugurtha wrote: post #6

SSH tunneling also works. It's cheap and easy to set up.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, se…

If you're on *nix, sshuttle is the tool you want. It's ssh tunnel on steroids, and it works with every program even if they're not configured to use a SOCKS proxy (such as Flash). It's also faster because it avoids the TCP-over-TCP problem that the usual SOCKS proxy entails.

    sshuttle --dns -v -r username@servername 0/0
https://github.com/apenwarr/sshuttle

Re: DNS results now being manipulated in Turkey

#25

Post by davidu »

DNSSEC wouldn't stop this... unless the resolver knew to require DNSSEC and ignored unsigned responses (which is unlikely).

DNSCrypt could help here... but chances are their middleware would just barf on it.

You need something more evasive.

Re: DNS results now being manipulated in Turkey

#26

Post by michh »

alyxr wrote: post #23
michh wrote: post #16

Earlier quoted context omitted.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, se…

Why isn't it default behavior to route dns through socks?

AFAIK it's a legacy thing. SOCKS4 didn't support it, SOCKS5 did but using that functionality changes behaviour depending on which SOCKS version the remote end happens to use.

Re: DNS results now being manipulated in Turkey

#27

Post by Jugurtha »

michh wrote: post #20
Jugurtha wrote: post #18

Earlier quoted context omitted.

What happens when you change the default DNS on the router level to OpenDNS or Google. (i.e: Telnet to the router, and change DNS there).

That's the whole point: they seem to be using deep packet inspection to mess with all DNS traffic regardless of the DNS server being used.

Aha, I see. I'll look this up in addition to what kijin said (sshuttle).

It's not like our government is blocking anything (there were rumors it was blocking Facebook in 2011, but it wasn't true as I was able to log in without any issue. It was just slow, but it's not like we have the fastest internet here).

But it's nice to know. Thanks for the clarification.

Re: DNS results now being manipulated in Turkey

#28

Post by michh »

kijin wrote: post #24
michh wrote: post #16

Earlier quoted context omitted.

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally. As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config. Of course, se…

If you're on *nix, sshuttle is the tool you want. It's ssh tunnel on steroids, and it works with every program even if they're not configured to use a SOCKS proxy (such as Flash). It's also faster because it avoids the TCP-over-TCP problem that the usual SOCKS proxy entails. sshuttle --dns -v -r username@servername 0/0 https://github.com/apenwarr/sshuttle

That's going to come in useful, bookmarked, thanks!

Re: DNS results now being manipulated in Turkey

#29

Post by bayesianhorse »

mrtksn wrote: post #19
bayesianhorse wrote: post #15

Seems like Erdogan is hell-bent on restricting free speech in Turkey. Somehow it is comforting how abysmally bad he is at doing that though...

The elections are tomorrow and it's prohibited by law to broadcast political rallies on the last day. The pro-government TV channels are broadcasting Erdogan's rallies while other TV channels respect the law(and they are afraid of disproportional penalties if they do the same). So today only Erdogan is on national TV.

So every voter in Turkey essentially knows what Erdogan is doing. So nobody who understands democracy should vote for Erdogan.

If however not enough people understand democracy ...

Post reply on HN