6 ms·
Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're
by alex1 12y ago
Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control.
If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. Of course, this wouldn't work if they got some Turkish (or other) CA to sign a bogus www.youtube.com certificate.
EDIT: As lawl points out, trying to require SSL on www.youtube.com won't work either, since they could just do an sslstrip type attack.
EDIT 2: Proof that they are in fact messing with routes to Google Public DNS anycast addresses (they're doing to same to OpenDNS): https://twitter.com/esesci/status/449902883933126659 https://twitter.com/esesci/status/449902883933126659
- mrtksn 12y agohow about this: http://i.imgur.com/2jEais0.png http://i.imgur.com/2jEais0.png
- darkhorn 12y agoWhat application is this?
- makmanalp 12y agoActually this seems likely, hmmm: traceroute to 8.8.4.4 (8.8.4.4), 64 hops max, 52 byte packets 1 192.168.1.1 (192.168.1.1) 4.260 ms 0.969 ms 0.865 ms 2 host-92-44-0-42.reverse.superonline.net (92.44.0.42) 7.465 ms 7.903 ms 7.384 ms 3 host-82-222-174-177.reverse.superonline.net (82.222.174.177) 8.772 ms 13.703 ms 8.482 ms 4 host-85-29-17-234.reverse.superonline.net (85.29.17.234) 7.736 ms 7.830 ms host-82-222-35-54.reverse.superonline.net (82.222.35.54) 11.449 ms 5 212.156.45.29.static.turktelekom.com.tr (212.156.45.29) 30.518 ms 17.123 ms 8.674 ms 6 inkilap-t2-1-kartal-t3-1.turktelekom.com.tr.220.212.81.in-addr.arpa (81.212.220.250) 9.945 ms * 15.140 ms 7 * * * 8 ulus-t3-4-ulus-t2-2.turktelekom.com.tr.223.212.81.in-addr.arpa (81.212.223.7) 18.020 ms 17.709 ms 15.444 ms 9 * * * 10 * * * 11 * * * 12 * * * 13 * * *
- alex1 12y agoYeah, looks like they're mucking with the routes for Google Public DNS anycast IPs. EDIT: More evidence that this is what's happening (they're doing to same to OpenDNS's anycast addresses): https://twitter.com/esesci/status/449902883933126659 https://twitter.com/esesci/status/449902883933126659
- lawl 12y ago> another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. What? NO! They are messing with the DNS results from 8.8.4.4 (Google DNS) Too early for TLS to do anything. Maybe with HSTS, but I still doubt that HSTS is any effective against state level MITM.
- alex1 12y agoYou're right. Maybe if they turned on and required SSL for everyone visiting www.youtube.com and added www.youtube.com to Chrome's preloaded HSTS list and somehow got everyone to use Chrome. Sadly, this probably won't happen, but DNSSEC adoption probably won't happen either. Even with DNSSEC, they could still do deep packet inspection on HTTP traffic going to YouTube IPs and initiate MITM attacks that way.
- psykovsky 12y agoWhy not ditch the current DNS system and use Namecoin? If you have to force some piece of software into users computers, let's do it right at least...
- deleted 12y ago[deleted]
- GICodeWarrior 12y agoAre you suggesting the government compromised a trusted SSL CA? Or are you just saying they blocked HTTPS?
- codesuela 12y agoHuh? The government of Turkey itself is a trusted CA http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ http://www.mozilla.org/en-US/about/governance/policies/secur... Ctrl+F "Government of Turkey"