Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identifying Airtel middleboxes that censor HTTPS traffic

iamkush.me

Post reply on HN
Print view View original

51–60 of 130 posts

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#51

Post by walrus01 »

tialaramex wrote: post #46
justDankin wrote: post #35

Earlier quoted context omitted.

Well, they could block TLS1.3 entirely (which would force hosts to drop down to 1.2 for connections) GFC does this, I really hope it doesn't happen here

The Great Firewall does not block TLS 1.3. You may have seen headlines which claim it does, but they're based on a report that actually says it doesn't. Remember journalists probably know even less than you do about most things they write about! In this case the report says the Great Firewall was determined to block the following specific combination: * A ClientHello for TLS 1.3 that * Includes the 0xffce extension v…

While all of the above is correct, it doesn't stop the GFW from implementing per flow based DPI that drops traffic, or throttles it to a throughput that is so slow as to be unusable, based on detection of consistent encrypted flows between an IP that is outside of China, and domestically within China.

The one thing TLS1.3 with ESNI is not is hard to detect. It's a consistent traffic pattern if you throw a sufficient amount of CPU and RAM resources at doing DPI on each and every user's flows.

In an ordinary non censored ISP environment the ratio at which you export netflow data to a collector adjacent to the router is quite low. And not a great deal of CPU and RAM resources are put into doing detailed analysis of it, other than for basic things like figuring out who you should be peering with that you aren't peering already, and identifying percentages of traffic patterns (eg: at 10pm every night we see this much traffic from our on-net locally hosted netflix cache boxes going towards the residential GPON customers).

If you are a Chinese entity with access to the router-design people at Huawei and ZTE, and sufficient motivation to do so, there's no reason why you couldn't crank up the ratio greatly and (on a middle mile and per POP basis) export netflow by a dedicated 100Gbps link to a set of directly-adjacent high performance x86-64 servers, running custom flow analysis and DPI inspection software.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#52

Post by silon42 »

detaro wrote: post #9
justDankin wrote: post #5

Earlier quoted context omitted.

I haven't been able to test that yet, neither am aware of any research which answers that question. IMO the only way to do that would be to either (i) block the IP (high collateral blocking) or (ii) block TLS 1.3 itself (GFC does this). A major blocker in answering this is finding a potentially blocked website that also supports TLS 1.3

If they block ESNI, it's likely all ESNI requests would be blocked, because they can't tell if its a blocked site or not. (it'd be possible they only apply ESNI-blocking against IPs associated with blocked sites, but that seems unlikely)

This is what would consider doing in my home firewall, because I don't want requests going out to unknown sites.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#53

Post by IceWreck »

uname_amiy wrote: post #26
dannyw wrote: post #16

Earlier quoted context omitted.

DuckDuckGo is blocked in India??

Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible. https://imgur.com/a/y7wnOjD

even the http version is accessible to me

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#54

Post by IceWreck »

airtelblock wrote: post #13
justDankin wrote: post #12

Earlier quoted context omitted.

Yeah there was a huge outcry about it on Twitter some time back. P.S. From the screenshot, it looks like you're trying to connect to [http]://duck.., hence shifting to https works. This also hints towards a mixture of plain old http censorship and https censorship, which Airtel (in fact all ISPs) do randomly

This is not about the block a month ago. This is a new block. When it was blocked a month ago, there was no notice. Now, there is a notice that it is a TRAI order. usually seen on sites that the govt themselves ask to block (piratebay, torrentz.eu, etc)

I guess its only limited to some regions. I'm using Airtel for my home connection as well mobile and get redirected to https everytime I visit the http version of ddg on both connections.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#55

Post by disiplus »

kzrdude wrote: post #25
Tepix wrote: post #24

Earlier quoted context omitted.

How do they inject stuff into HTTPS pages?

it does say "Not secure" for the https info, so I guess they intercept the request

yeah but not secure is regular http. on https they cannot do that without triggering a browser warning.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#56

Post by walrus01 »

smolder wrote: post #34
uname_amiy wrote: post #26

Earlier quoted context omitted.

Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible. https://imgur.com/a/y7wnOjD

What reason could they have for blocking DDG? Is it easier to find pirated content there than on Google or something? That's my best guess. I can't imagine they'd block on behalf of a competitor or something.

https://en.wikipedia.org/wiki/Internet_censorship_in_India

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#57

Post by walrus01 »

aeyes wrote: post #43
tyingq wrote: post #23

Some older research suggests Airtel uses Netsweeper: https://citizenlab.ca/2018/04/planet-netsweeper-section-1-me... Netsweeper is a Canadian company in the business of content filtering: https://www.netsweeper.com/

Another possible supplier is this company: https://www.ipoque.com/ They openly state that they supply ISPs with DPI hardware, I talked to them in person 15 years ago and they had no problem to admit that they also supply government institutions.

My job overlaps with microwave and millimeter wave RF engineering somewhat. R&S also has no qualms about selling high-end spectrum analysis equipment to authoritarian regimes. Probably done through middlemen. For instance, you can find the Iranian government using their equipment in Tehran to hunt down things they don't like.

To be fair, there's probably less than ten manufacturers of their category of spectrum analysis gear (for commercial/non-military use) in the world, and their stuff is top quality.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#58

Post by joosters »

walrus01 wrote: post #37

On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them. It is regretful that organizations like NANOG, R…

All well and good, but are these kind of 'middleboxes' unequivocally unethical? For example, some ISPs might want to block highly illegal content - let's use the typical examples, e.g. child porn sites, malware domains, and so on. It's not inherently unethical (or, at least, there are plenty of reasonable people who would say it is ethical) to install a middlebox that will make it more difficult for users to access these sites.

So now your company has got a content blocker installed. What exactly are your network engineers meant to do now? Demand personal refusal over any additions to the sites that these boxes will block? That seems highly unlikely to happen, and how could that even work in practice? Are all the engineers meant to vote on blocks, and only those unopposed sites get added to the list?

Can ethical network engineers usefully oppose content blocking?

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#59

Post by walrus01 »

joosters wrote: post #58
walrus01 wrote: post #37

On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them. It is regretful that organizations like NANOG, R…

All well and good, but are these kind of 'middleboxes' unequivocally unethical? For example, some ISPs might want to block highly illegal content - let's use the typical examples, e.g. child porn sites, malware domains, and so on. It's not inherently unethical (or, at least, there are plenty of reasonable people who would say it is ethical) to install a middlebox that will make it more difficult for users to access t…

> let's use the typical examples, e.g. child porn sites, malware domains

a futile game of whack-a-mole that only serves to make politicians feel good, and so they can claim they're "doing something" about social threats.

malware domains can be adequately addressed at the application level through things such as: https://www.google.com/search?channel=fs&client=ubuntu&q=goo...

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#60

Post by tyingq »

walrus01 wrote: post #57
aeyes wrote: post #43

Earlier quoted context omitted.

Another possible supplier is this company: https://www.ipoque.com/ They openly state that they supply ISPs with DPI hardware, I talked to them in person 15 years ago and they had no problem to admit that they also supply government institutions.

My job overlaps with microwave and millimeter wave RF engineering somewhat. R&S also has no qualms about selling high-end spectrum analysis equipment to authoritarian regimes. Probably done through middlemen. For instance, you can find the Iranian government using their equipment in Tehran to hunt down things they don't like. To be fair, there's probably less than ten manufacturers of their category of spectrum analy…

Interesting, so triangulating people forwarding "open" internet over consumer-grade microwave (like Ubiquiti or similar)?

I assume they can't do much about Toosheh since it's "read only", multiplexed with legitimate TV channels on the same transponder, and uplinked from the UAE.

Post reply on HN