News for hackers. Stuff that matters.
Re:Thousands of Russians protest against internet restrictions by PeterZhizhin on Sunday March 10, 2019 @01:37PM (#19353090)
Right now, we have a legislation (this one existed since 2012) that requires to ban certain IP addresses. All ISP's are being monitored by the authority called Roscomnadzor and allowing access to a banned IP will lead to fines. Unfortunately, this doesn't really work because people here learned how to use VPN's, proxies and Tor. Moreover, with cloud providers you can easily switch IP addresses. Telegram messenger was banned here but it still works. I guess that they frequently change IP addresses and use multiple cloud providers. When Roscomnadzor tried to ban the messenger, they added significant number of IP subnetworks (I think that the largest blocked subnet was 52.192.0.0/11 used by AWS). This lead to all sorts of different problems because it turned out that some banks and large companies were paralysed for months as their websites were blocked.

After a year of of trying to block the messenger, they just decided to pass this law. All ISPs that handle inter-counties exchange must install a government backdoor that could shut down all outgoing and incoming connections outside from Russia.

Also, some websites now are blocked by their DNS record, not by their IP. This lead to other problems. Imagine there was a website X that was blocked in Russia. The X company decides to change the domain and abandon X. Now, someone else buys the banned domain and adds any IP addresses to the DNS (like, government authorities websites). Whoala! These websites are banned in Russia as well. This happened multiple times and lead to Google, YouTube and other websites being inaccessible here.

The legislation proposes a separate national DNS system that differs from the ICANN one. Similarly to how North Korea does this in their country. This way no-one could buy an abandoned blocked website and add a bunch of valuable and valid IPs there.

They claim that this will increase the stability of the Russian Internet. People in our government believe that the Internet was designed in the US to control the world. They also believe that they could shut down the Internet in any country at this point of time. They say that this has already happened in Syria once and we need to prepare for this.

They don't actually explain that the thing that happened to Syria was possible only because they had a single ISP. And their centralised system was hacked.

I believe that if we decide to install a backdoor to all of our ISPs, then someone else from the outside could pull the switch.

Re:Thousands of Russians protest against internet restrictions by ignoramous on Sunday March 10, 2019 @05:09PM (#19354517)
Thanks!

That's a tough stance for a government to take. I guess using proxies, VPNs (w IPSec), and overlay networks like Tor and i2p would be made illegal too?

DNS based blocking is easy to get around: It is known to not work effectively. Content based blocking can be done away with TLS. And... IP based blocking wouldn't scale [0], one would think, and def isn't reliable because of ElasticIPs offered by Cloud Providers like AWS, like you point out.

This might push them to take desperate measures like force ISPs to stop peering with the internet backbone altogether (or worse, nationalise ISPs), which might set a dangerous precedent for other powerful countries to follow.

This doesn't sound good, at all.

[0] With 5G/WiMax around the corner looking increasingly likely that it'd be exclusively on IPv6 ...

Re:Thousands of Russians protest against internet restrictions by lambdadmitry on Monday March 11, 2019 @05:37AM (#19357709)
I bet the next thing Russian (and many other oppressive ones) will try is forcing government-issued root certs on client devices with mandatory mitm. Sure, some devices might not be capable of importing new root certs, but for sufficiently dictatorial regime it's not a problem.
Re:Thousands of Russians protest against internet restrictions by ignoramous on Monday March 11, 2019 @03:29PM (#19362008)
Strict CertifcatePinning can thankfully prevent this from working [0] as intended, although on the flip-side it also introduces a significant problem for deep-packet inspection for malware/intrusion detection and privacy enthusiasts who would like to re-map certain kinds of traffic on the client-side [1].

[0] https://news.ycombinator.com/item?id=10727649

[1] https://news.ycombinator.com/item?id=19172038

Re:Thousands of Russians protest against internet restrictions by comboy on Sunday March 10, 2019 @02:05PM (#19353246)
Thanks for a detailed explanation.

That seems pretty radical. I mean, because of technology progress (mainly crypto improvements, but also cheaper hardware development) I only see two outcomes in the future: (it's a global issue, not just related to Russia)

1. We have a complete freedom of information exchange. It's a powerful thing. It's not only free speech, but also easily available all illegal digital content and ability to transfer money anonymously. In such scenario, it's inevitable that governments role will diminish. Well, they are huge and powerful, they can still retain a huge influence (and already do * ) by manipulating people, the software they use etc.

2. The Internet as we know it today ceases to exist. Basically what you wrote above and much more. Pretty dark scenario. I always hoped that enough big players (who are able to influence gov) depend enough on the way the Internet currently works, that it would be very hard push this. Maybe not as hard as I thought. Because note that most people, majority of users, simply don't care. Leave top 100 websites working (power law traffic distribution) and most people won't notice the difference.

*. https://www.youtube.com/watch?v=qOTYgcdNrXE&feature=youtu.be...

Re:Thousands of Russians protest against internet restrictions by egao1980 on Sunday March 10, 2019 @04:17PM (#19354150)
Nope, it's not radical. DNS system is controlled by US company and if you rely on it your country's infrastructure is vulnerable. So if US decides to cut Russia from DNS national services including government sites should continue to function.

People panic without understanding the reasons behind this law.

Re:Thousands of Russians protest against internet restrictions by comboy on Sunday March 10, 2019 @04:32PM (#19354252)
I would understand if you were talking about certificates, but DNS? It should not be trusted by default.
Re:Thousands of Russians protest against internet restrictions by liberte82 on Monday March 11, 2019 @04:31PM (#19362529)
Could you end up with competing DNS services in different nations that direct users to different IPs? Now that could be a mess.
Re:Thousands of Russians protest against internet restrictions by jamespo on Sunday March 10, 2019 @07:01PM (#19355302)
Doesn't Russia operate the authoritative servers for .ru ?
Re:Thousands of Russians protest against internet restrictions by rzerda on Sunday March 10, 2019 @10:14PM (#19356186)
TLD servers are useless without root ones. There are several replicas of K-root in Russia, but they are under control of RIPE (EU organization).
Re:Thousands of Russians protest against internet restrictions by jamespo on Tuesday March 12, 2019 @12:31PM (#19369949)
How are they useless in terms of "if US decides to cut Russia from DNS national services including government sites should continue to function"

What TLD are these sites hosted on?

Re:Thousands of Russians protest against internet restrictions by rzerda on Tuesday March 12, 2019 @01:41PM (#19370851)
TLD servers for .ru zone can answer questions like “who should I ask where kremlin.ru is?”, but before that there is a question “where .ru zone DNS servers are”, and that’s what root servers are supposed to answer. If - hypothetically - all root servers will answer “oh, .ru zone is served by that guy in Washington DC”, no DNS resolver would ask “real” .ru servers because list of root servers is effectively hard coded and changing it on all clients is a lot of work.
Re:Thousands of Russians protest against internet restrictions by anticodon on Sunday March 10, 2019 @08:25PM (#19355725)
> People in our government believe that the Internet was designed in the US to control the world.

Maybe it wasn't designed with this objective in mind, but it is definitely used this way. And the fact that Google and Facebook are de-facto monopolies doesn't help.

And I'm not from the government. I'm just another little guy that sees tons of that propaganda every day.

For example, I watch mostly videos from conferences on YouTube. Why YT displays rusophobic videos in the recommendations list instead of more videos related to the conference? Even after I clicked hide button on them multiple times?

And all those rusophobic comments under every video about Russia? Who writes them? Sometimes I see exactly the same comment from different nicknames. I even made a screenshots of such instances, only to find out that nobody cares.

Re:Thousands of Russians protest against internet restrictions by anticodon on Sunday March 10, 2019 @08:39PM (#19355789)
Another example: on one of facebook groups I regularly see posts from a person regularly bashing Russia. Under every post he leaves derogatory comments. Sometimes he posts derogatory posts although the facebook group is not about Russia at all.

Just recently he had shared a meme picture from some of the "opposition" groups (Alexei Navalny or his friends) stating that Russia has the highest suicides rate in the world (of course, because we're poor and doomed and Putin eats our children for breakfast).

I didn't believe it and went to several official sources (including international) to verify. Of course, we're very far from the first place in the list of suicide rates. I've commented this on the post and received zero reaction. Moreover, the post was liked and shared further by several members of the group.

This is all you need to know about our "opposition".

And there're many persons like this disseminating fake news in facebook groups and other communities. I have no evidence, but I strongly believe that they're on a payroll from some non-Russian agency or NGO.

Re:Thousands of Russians protest against internet restrictions by goto11 on Monday March 11, 2019 @01:23PM (#19360785)
For what it is worth, Wikipedia places Russia as number 3 in suicide rate (when standardized for age) behind Guyana and Lesotho. This is based on WHO numbers. (https://en.wikipedia.org/wiki/List_of_countries_by_suicide_r...)

> This is all you need to know about our "opposition".

Ok

Re:Thousands of Russians protest against internet restrictions by ativzzz on Sunday March 10, 2019 @11:01PM (#19356346)
> they're on a payroll from some non-Russian agency or NGO.

At this point, I would be incredibly surprised if any country in the world wasn't engaged in some sort of online trolling/fake news dissemination on either the global (e.g. Russia vs US vs China) or local (internal politics) scale. It's the best way to spread propaganda while making it seem as real as possible.

Re:Thousands of Russians protest against internet restrictions by liberte82 on Monday March 11, 2019 @04:34PM (#19362548)
And once you propagandize the population successfully enough, they'll carry on without you
Re:Thousands of Russians protest against internet restrictions by kurthr on Sunday March 10, 2019 @01:44PM (#19353135)
Yes... "don't create weapons you don't want your opponents to use", is an excellent maxim. Unfortunately, governments do it all the time.
Re:Thousands of Russians protest against internet restrictions by mobilemidget on Sunday March 10, 2019 @06:47PM (#19355209)
Extra note, Roscomnadzor also writes non Russian companies hosting content they have issues with and request that non .ru providers take it down to “protect” Russians.