General Musing

blaze your trail

I have found definitive proof that Iran is port basod filtering

leave a comment »

I have pretty definitive proof that Iran is doing ip-and-port based filtering of SSL.

Filtering is being done by eg 217.218.154.250. This hop is after my source’s ISP. The filtering IPs are owned by ITC, Iran’s central telco. It’s http://bgp.he.net/AS12880 (h/t to Tor team for that).

Filtering targets all google.com IPs, some but not all torproject.org IPs, probably more. Haven’t attempted a broad scan. It’s a simple connection drop; filtered connections just time out.

It is not based on SSL handshake signature; testing SSL on nonstandard ports worked successfully, and testing non-SSL on :443 of target IPs was blocked.

I’m not sharing screencaps in order to protect my source, but tests included TCP traceroutes on different IP/port combinations and some simple use of curl.

ETA 2/10: Further testing done. Conclusions:

1. IP-and-port filtering for some IPs
2. SSL protocol filtering on standard ports for targeted IPs / sites
3. No request header filtering
4. Some IPs / sites NOT SSL protocol or port filtered!
5. All Tor filtered, even unpublished proxies

I’m not going to openly publish what went through to prevent it getting blacklisted and useless for testing, but it was a full normal https://something:443 connection, green lock w/ verified serial # and all.

ETA2 2/11: SSL to previously working site now down. SSL to internal Iranian site up. Don’t yet know why on either.

obfsproxy is working successfully from inside Iran and enabling full Tor access.

Install: https://www.torproject.org/projects/obfsproxy

List of bridge relays being distributed privately. Not public to prevent relay IPs getting blacklisted, but contact me or anyone on the tor dev team to get a copy.

Help censored users: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html

ETA3 2/11: SSL w/out tor is currently erratic. https://www.google.com and https://mail.google.com sometimes get through, as do some other sites; https://encrypted.google.com eg does not. Traffic is still going through the same filter server. Still don’t know cause; SSL certs of connections that go through do confirm as legit.

Still to test, will update post:
* ssh on standard & nonstandard ports
* nonstandard ssl ports

More info:
https://blog.torproject.org/blog/iran-partially-blocks-encrypted-network-traffic (based in part on my info)
http://news.ycombinator.com/item?id=3575029

View or comment on Daniël Crompton’s post »

 

Written by Daniël W. Crompton (webhat)

February 12, 2012 at 3:32 pm

Posted in Uncategorized

Please Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: