Live data from Hacker News

Iran Shuts Down Major Websites and Https Protocol

news.ycombinator.com

81–90 of 151 posts

Re: Iran Shuts Down Major Websites and Https Protocol

#81
As it so happens, I've spent the last day trying to break in through the technical restrictions of a regime from the outside. There is a country with a very oppressive government that prevents outsiders from observing them. It's a tiny island monarchy that doesn't matter much in the grand scheme of things, but you may have heard of them; it's called the "United Kingdom" or "Great Britain" or whatever.

If you don't live within their control, they don't want you to see the propaganda they put out on their "British Broadcasting Corporation" (BBC) television stations and web site. Needless to say, there are ways around their entirely pointless technical restrictions.

(Note_To_Self: As somewhat dyslectic person, I'll never forgive patio11 for nick-naming his product "BCC").

I would like to say that by-passing government sanctioned Internet restrictions is simple and easy, but it's not true. Doing it safely can be impossible at times, and considering the rather severe punishments for getting caught (i.e. death), it may not be the smartest choice you could make. If you want to take your chances, there are often technically possible ways to by-pass the restrictions. It's not easy, and it may not be entirely safe, but usually, it is technically possible.

There are free solutions out there like Tor ("The Onion Router" https://www.torproject.org/), but they mostly suck. If you don't believe me, then just try using them. The other problem with the free solutions is a lot of government filtering knows about them and adjusts accordingly (when possible). There is also a lot of monitoring an profiling done on the traffic on the free solutions like Tor since the traffic is interesting.

If you need a solution that sucks less, you'll need to pay for it. As much as many would like to believe otherwise, bandwidth and servers are not free, so when a service is unable to support itself through advertising, then you'll need to pay for it. The commercial VPN vendors are more reliable and have far better security, privacy and performance than the free alternatives.

I've been a paying customer of https://www.tunnelr.com for over a year, and really enjoy their service. I'm on friendly terms through email with the two founders, Daniel and Jared, so I'm probably guilty of some sock puppetry or fanboyism. They also run the "devio.us" free shell provider service which is very impressive.

The thing to realize is the people responsible for controlling the network you are on and enforcing the restrictions probably have a way out of their own. It could be that their "day job" gives them access to the "other" side of their censorship filters, or possibly they've left a few holes here and there that they can use to by-pass their own filtering system. If the latter, it's probably done with a VPN of some sort.

In the case of a good commercial service like tunnelr.com, you don't need to worry too much about figuring out where things were left open.

Typically, if UDP traffic is found going to port 53, most people expect it to be DNS lookups from client systems. Again typically, if TCP traffic is going to port 53, most people expect it to be DNS lookups done by DNS servers. Of course, if you see TCP traffic going to port 80, you'd expect it to be going to a web server...

The common expectations are not "wrong" in most situations, but these expectations can be wrong if things are configured differently.

In the case of good VPN services, things are configured differently!

For example, I can use TCP and connect to port 80 but establish a SSH connection, or use UDP and connect to port 53 but establish an OpenVPN connection.

This kind of trickery will not fool filters with the capacity to do "Deep Packet Inspection" ("DPI" e.g. protocol profiling), but the vast majority of filtering tech out there can't do deep packet inspection all of the time. It requires too much computation to be effective on fully saturated links, so it slows things down terribly. There are a few products out there that can do DPI at "wire-line" speeds, but they are hellishly expensive and fairly difficult to manage properly.

BTW, if you go the SSH route, check out dsocks by Dug Song. It runs on most UNIX systems, on MacOS, and on MS-Windows through cygwin.

EDIT: I totally forgot about countless the payment options you have available in Iran (i.e. none). If that's an issue for you, contact me privately (email address is in my HN profile).

Re: Iran Shuts Down Major Websites and Https Protocol

#82

Earlier quoted context omitted.

Maybe but they'll lose the productivity gains from networked organizations and communities. China can grow a long way without those gains, but they'll eventually hit a wall.

>Maybe but they'll lose the productivity gains from networked organizations and communities Absolutely but the effect will be not be huge in my opinion because of the language differences. All my Chinese friends here in the EU still use mainly Chinese language website, most of which are based in China, especially the social networking ones.

Companies aren't going to manage inventory, customer relations or finance over open channels. So they'd reduce the gains from networking their own internal communications.

They could try to mitigate by rationing secure channels, or allowing them with backdoors, but this still sacrifices the spontaneous creativity of a truly open system.

Re: Iran Shuts Down Major Websites and Https Protocol

#83
post #46

This is why good old analogue amateur or personal radio should still be a powerful force for people who are rebelling against their governments and corporate overlords. The Internet is easy to kill, as are digital cell-based radio networks. Proper amateur radio is not. Jamming is not that effective over a large area before anyone suggests that.

The internet may be easy to disable but to kill it is another ball game

Bits of it are easy to kill (at country level at least).

Re: Iran Shuts Down Major Websites and Https Protocol

#84
post #65

Earlier quoted context omitted.

but it's easy to triangulate the broadcaster and take measures (imprison, torture, kill). I lived through the communist era in Poland. Amateur radio stations were banned and prosecuted (you would go to jail), even possession of a CB radio was a crime. Things may be similar in Iran.

It's not that easy and there are simple anti-triangulation countermeasures you can use. It's possible to drop decoy transmitters/relays, which are easy enough to knock up and are cheap. You can also use refraction to "bounce" HF radio waves off the ionosphere to mask the source. You can scramble the signals. You can disguise the signals as legitimate but include carrier data. There are lots of ways of hiding what you…

Do you have more resources on that? Occasionally I think about the problem of censorship and free speech and wonder how to enable occupied people to report their plight. So far I could not think of a solution, because I assumed any kind of broadcasting would make the broadcaster an easy target. So what you say interests me (to be fair I am not building anything at the moment, and I am not a hardware person - yet).

Re: Iran Shuts Down Major Websites and Https Protocol

#85
post #30

Earlier quoted context omitted.

What about ssh over port 80? I realize that would have to be set up in advance from outside the country, but the question is are they using port numbers to aid in their filtering or deep packet inspection?

If they are dropping all encrypted connections, it doesn't matter what port you use for ssh, it'll be dropped.

If.

That is why I asked the question.

Re: Iran Shuts Down Major Websites and Https Protocol

#86
post #81

As it so happens, I've spent the last day trying to break in through the technical restrictions of a regime from the outside. There is a country with a very oppressive government that prevents outsiders from observing them. It's a tiny island monarchy that doesn't matter much in the grand scheme of things, but you may have heard of them; it's called the "United Kingdom" or "Great Britain" or whatever. If you don't li…

But DPI is used in Iran and just using different ports does _not_ help

Re: Iran Shuts Down Major Websites and Https Protocol

#87
post #77

Moreover, SSH has stopped working, too. But, finally I found a way to circumvent it. A simple twist in the client side, could simply bypass the filtering. I wrote a simple script to do this, and I would like to share it with all of my countrymen: https://launchpad.net/~mohammad-sepent/+archive/ppa/+package... To use it, just replace ssh command with issh like this: issh user@hostname [other-ssh-options]

Where is the link to the required changes? Binaries = scary. Also, an SSL link doesn't seem useful?

Re: Iran Shuts Down Major Websites and Https Protocol

#88
post #69

I live in Iran. The fact about the shut down is correct. I would also add that secure connection to servers inside Iran is possible. I've tried some, and they work. But trying to connect to services like Github and PivotalTracker, which we relay on in our starup, results in no response. Also I will note that the ssh protocol is the same. I can ssh into my university machine (inside Iran) but I can't access my rackspa…

Are you inside Iran right now?

Re: Iran Shuts Down Major Websites and Https Protocol

#89

Earlier quoted context omitted.

They drop ALL encrypted connections. You cannot even make a normal ssh connection, since they drop the connection during handshake. (SSH has been disabled for a few months)

What about ssh over port 80? I realize that would have to be set up in advance from outside the country, but the question is are they using port numbers to aid in their filtering or deep packet inspection?

They have to be using ports. Deep packet inspection is far too expensive to do on a massive scale.

Re: Iran Shuts Down Major Websites and Https Protocol

#90
post #87
post #77

Moreover, SSH has stopped working, too. But, finally I found a way to circumvent it. A simple twist in the client side, could simply bypass the filtering. I wrote a simple script to do this, and I would like to share it with all of my countrymen: https://launchpad.net/~mohammad-sepent/+archive/ppa/+package... To use it, just replace ssh command with issh like this: issh user@hostname [other-ssh-options]

Where is the link to the required changes? Binaries = scary. Also, an SSL link doesn't seem useful?

I took a look at it. It's not a binary. It's a python file (easily readable) that acts as a wrapper for ssh. Extract the contents of the tar.gz[1] for example to see it. It's great if it works because it apparently doesn't need changes to the remote ssh server.

[1] https://launchpad.net/~mohammad-sepent/+archive/ppa/+files/i...

Edit: Non SSL link: http://ppa.launchpad.net/mohammad-sepent/ppa/ubuntu/pool/mai...

Post reply on HN