Re:Iran Shuts Down Major Websites and Https Protocol
by Jach on Friday February 10, 2012 @05:22AM
(#3575219)
How do they distinguish an encrypted connection from a non-encrypted connection? How do they know those indecipherable bits are an encrypted message vs. a part of an image or video? I suspect they just block domains and IPs and common ports or they sniff for common handshakes and key exchanges and kill those.
[ Parent
| on HN ]
Re:Iran Shuts Down Major Websites and Https Protocol
by emilsedgh on Friday February 10, 2012 @05:53AM
(#3575269)
It works at different levels. First, they try to drop the connection during handshake (which is NOT encrypted yet). This works effectively. SSH has been taken down using this technique for a few months.
They also shape the bandwidth of encrypted connections. My guess is that they use something like L7 to guess the type-of-connection using different patterns.