| ▲ | “Boobs check” – Technique to verify if sites behind CDN are hosted in Iran(twitter.com) |
| 225 points by defly 6 hours ago | 57 comments |
| https://xcancel.com/hkashfi/status/1995109785679573167 |
|
| ▲ | shishcat 5 hours ago | parent | next [-] |
| This behavior only works when the reverse proxy or CDN is configured like this: Proxy/CDN: HTTPS (443) → Origin server: plain HTTP (80) (example: Cloudflare in Flexible mode) If the origin server uses any proper TLS configuration, even a self-signed certificate, this method stops working. It only succeeds when the upstream connection to the origin is unsecured. If you want to test this on a random site without Cloudflare or reverse proxy in general on HTTP:
curl http://www.digiboy.ir/boobs.jpg -v |
| |
| ▲ | mort96 4 hours ago | parent | next [-] | | Ah, Cloudflare. The world's most widely deployed encryption remover. | | |
| ▲ | bawolff an hour ago | parent | next [-] | | Is it really that different than AWS? You either trust your service provider or you don't. | | |
| ▲ | lmm an hour ago | parent [-] | | AWS doesn't route requests from their load balancer to your server across the public internet. Cloudflare does. |
| |
| ▲ | spoiler 2 hours ago | parent | prev [-] | | To be fair, Cloudflare is also the reason why most sites even have TLS at all, because it offered free certs (through letsencrypt I think?) in a fairly easy to set up way. Certs used to be expensive, and had way more operational overhead and quirks (even setting up ACME/LE) | | |
| ▲ | estimator7292 an hour ago | parent | next [-] | | Absolutely not, no. That is all thanks to Let's Encrypt. | | |
| ▲ | DoctorOW 29 minutes ago | parent [-] | | This was true before Let's Encrypt existed, they'd buy massive 500 domain wildcard SSL certs that free users would split. |
| |
| ▲ | Tostino 2 hours ago | parent | prev [-] | | I'm not going to give them credit for the work that Lets Encrypt did. |
|
| |
| ▲ | bobmcnamara 4 hours ago | parent | prev [-] | | It'll also work DigiNotar-style, when using the only root CA blessed by the National Information Network for general use: I.R. Iran. |
|
|
| ▲ | vivzkestrel 8 minutes ago | parent | prev | next [-] |
| I am probably a little dumb, i read the article but dont understand what happened. can some HNer kindly explain? |
|
| ▲ | losvedir 5 hours ago | parent | prev | next [-] |
| How's this work with https like in the example? The hops along the way shouldn't see the path. Is this implying that all TLS is terminated at the Iran border and proxied from there? And all Iranian sites are required to host via http? That has significantly more implications than what this post is about. Maybe certificate authorities aren't allowed to issue private certs to Iranian organizations? Even LetsEncrypt? |
| |
| ▲ | tgma 4 hours ago | parent | next [-] | | This is referring to something else: to detect whether the backend server host itself is inside or outside Iran. TLS doesn't prevent the backend network from reading the URL of course. | | |
| ▲ | bawolff an hour ago | parent [-] | | Well it would if things are setup according to best practises (i.e. use TLS between the backend connections). Presumably most people dont do that. | | |
| ▲ | tgma 8 minutes ago | parent [-] | | Again, you are assuming a normal situation. The point is the country itself is operating (or has a heavy grip and perhaps even subsidizes) the backend CDN and enforcing that stuff in a rudimentary way. "TLS between backend connections" usually involves termination and decryption on the frontend webserver and re-encryption of the upstream traffic, whatever it may be. |
|
| |
| ▲ | SahAssar 4 hours ago | parent | prev | next [-] | | A lot of CF upstreams are (or at least used to be) plaintext. It is one of the criticisms of CF since it "whitewashed" plaintext to look like proper TLS when it was only TLS for client<->CF and then plaintext for CF<->server. | | |
| ▲ | koakuma-chan 3 hours ago | parent [-] | | Has anything ever prevented you from having TLS on your origin server? You can even get a certificate from Cloudflare. | | |
| ▲ | selcuka 3 hours ago | parent | next [-] | | This is a problem for the visitor, not for the server's owner. There is no way to know whether the traffic is encrypted between the server and CloudFlare. | | |
| ▲ | tialaramex 2 hours ago | parent [-] | | Regardless of Cloudflare, there is no way to know whether the traffic is encrypted between your apparent end-point and where it's actually used, nor whether that traffic is subsequently revealed to other parties, on purpose or by mistake. When you type your password into e.g. Hacker News, you are sending that password to the server. It doesn't matter that they're using bcrypt tuned for $1Bn attackers and you chose a sixteen character random alphanumeric string because that precise string, the valid password, is deliberately sent by you, to them, to authenticate and so if they accidentally reveal that or get compromised in any way, game over. It's getting a little bit better in some areas. My good bank actually has halfway decent security now, but the bank with most of my money (which is owned by my government, and thus avoids any risk consideration - if that bank fails, the currency my money is denominated in also fails, so, it doesn't matter any more) still thinks passwords are a good idea. Google lets me use a Security Key, but most web sites I authenticate with still use passwords. SSH is slightly better, because of its target audience. A lot of people use public key auth for SSH, which doesn't have this issue. But that's not the web. | | |
| ▲ | lmm 36 minutes ago | parent [-] | | > Regardless of Cloudflare, there is no way to know whether the traffic is encrypted between your apparent end-point and where it's actually used, nor whether that traffic is subsequently revealed to other parties, on purpose or by mistake. Any server could be leaking plaintext data, sure, but Cloudflare offers and even promotes wrong-thing-as-a-service. |
|
| |
| ▲ | LoganDark 3 hours ago | parent | prev [-] | | I've set up CF for a personal site and I even tell CF to use a client certificate (called "Origin CA") so nothing else can even connect to it. | | |
| ▲ | tgsovlerkhgsel 3 hours ago | parent [-] | | Have they started to use per-domain certificates for this, or can anyone who finds the origin bypass the check by creating their own (different) Cloudflare domain and pointing it at your origin? Edit: Looks still the same by default, but at least they're (somewhat obscurely) documenting the issue and providing the option to use a custom cert now... https://developers.cloudflare.com/ssl/origin-configuration/a... |
|
|
| |
| ▲ | bobmcnamara 4 hours ago | parent | prev [-] | | > Is this implying that all TLS is terminated at the Iran border and proxied from there? Yeah, the law-abiding type on the Iranian National Information Network(NIN), either using the Electronic Commerce Council's I.R.Iran CA for HTTPS or just HTTP. > Maybe certificate authorities aren't allowed to issue private certs to Iranian organizations? Even LetsEncrypt? Due to NIN registrations being not very much not anonymous, https://xkcd.com/538/ seems pretty appropriate if you want to use an unapproved certificate authority. |
|
|
| ▲ | Yokolos 5 hours ago | parent | prev | next [-] |
| I'm wondering for what purpose one would be interested in finding out if a site is hosted in Iran or not. |
| |
| ▲ | nostrademons 5 hours ago | parent | next [-] | | Would assume it's to check if a site is foreign propaganda. A lot of the lesser-known news sites that you see linked on social media are actually psy-ops pushing an agenda, many of them foreign-based. Follow the technique in the article and you can easily blacklist Iranian ones. | | | |
| ▲ | cj 4 hours ago | parent | prev | next [-] | | It’s illegal for US companies to do business with anyone in Iran. | |
| ▲ | delichon 5 hours ago | parent | prev | next [-] | | I'd rather not do business there. | |
| ▲ | asdefghyk 5 hours ago | parent | prev [-] | | Im guessing - its for some protest action? ... but really I have NO IDEA. |
|
|
| ▲ | KiranRao0 6 hours ago | parent | prev | next [-] |
| Does anyone have sample sites that return this? |
| |
| ▲ | phgn 5 hours ago | parent | next [-] | | Also interested in a sample site where the request successfully resolves ;) | | |
| ▲ | asdefghyk 4 hours ago | parent [-] | | If search in google search with site:ir
it returns lots .ir links.
I clicked on one and it went to a .com domain site. This may or may not be useful. How all this works is beyond my knowledge .. |
| |
| ▲ | readthenotes1 4 hours ago | parent | prev [-] | | Are you asking if there are pictures of boobs on the internet? |
|
|
| ▲ | bawolff an hour ago | parent | prev | next [-] |
| So does this mean 10.x.x.x is publicly routable inside iran? Why wouldn't the Iranian government just use its own ip space for the censorship message? |
| |
| ▲ | lmm 31 minutes ago | parent | next [-] | | > Why wouldn't the Iranian government just use its own ip space for the censorship message? IP addresses are expensive if you're not the US. Also they might be reusing a standard corporate filtering product that expects to be deployed on a private network (and in a way, that's what the Iranian internet is). | |
| ▲ | ycombinatrix an hour ago | parent | prev [-] | | I just tried this on a few Iranian websites and never got a 403, let alone an iframe. |
|
|
| ▲ | Aloisius 5 hours ago | parent | prev | next [-] |
| So presumably Iran has a reverse proxy in front of the entire internet for HTTP? I really want to know what's on the webpage for the iframe. |
| |
| ▲ | mschuster91 5 hours ago | parent [-] | | > So presumably Iran has a reverse proxy in front of the entire internet for HTTP? Standard DPI firewalls can do that for you. Absolutely no issue. | | |
| ▲ | manmal 4 hours ago | parent [-] | | For the path component, in a TLS secured request? | | |
| ▲ | bobmcnamara 4 hours ago | parent [-] | | It's a CDN, not an IP router. CDNs usually terminate TCP+TLS as close to the client as possible. This used to be done right at the edge - within the NIC for a long time, but CPUs have been more than capable for the last decade+ Few guesses: 1) CDN connects to backend server over TLS, using the national I.R. Iran root CA 2) CDN connects to backend server over HTTP 3) Backend server is running a nationally blessed Linux OS For 1 & 2, the National Information Network would be implementing this DigiNotar style but they already own the root keys. For #3, the backend does so itself. These are the people who p0wned DigiNotar after all. |
|
|
|
|
| ▲ | JumpCrisscross 4 hours ago | parent | prev | next [-] |
| I wonder if this could be broadened to a list of Wikipedia links to humanitarian content folks in repressed regimes are or might get blocked from. Tiananmen Square [1]. Wen Jiabao's staggering corruption [2]. Epstein's e-mails [3]. Et cetera. Like Netflix launching Fast.com, this would directly weaponise these regimes' censoring tendencies against themselves. [1] https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests... [2] https://www.nytimes.com/2012/10/26/business/global/family-of... [3] https://jmail.world |
|
| ▲ | cluckindan 5 hours ago | parent | prev | next [-] |
| Wow. The screenshot had the IP address exactly where I placed my finger to scroll, and iOS Safari briefly opened a popup window where it started connecting to that IP. Fuck this shit, I’m moving to a hovel in the woods. |
| |
| ▲ | rootusrootus 5 hours ago | parent | next [-] | | Along the same lines, I occasionally find myself cursing iOS for its willingness to just bring up the dialer and call a number. I really, really wish that it would confirm any dialing before doing it, especially if you didn't click on a phone number on a contact. Couple times I've ended up dialing a recent spam caller, which is the last thing I ever want to do. | | |
| ▲ | lxgr 4 hours ago | parent | next [-] | | On top of that, the only possible interaction with the number is to call it or to not call it. Want to copy the number into the clipboard to call it later, call it from a different app, or forward it to somebody else? Tough luck. | | |
| ▲ | furyofantares 2 hours ago | parent | next [-] | | There are a few options available if you press and hold it (Call, Message, Add to Existing Contact, Create New Contact, Delete). I feel this only make the fact that tapping calls without confirmation more annoying though. | |
| ▲ | MaintenanceMode 4 hours ago | parent | prev [-] | | Occasionally, if you're lucky enough, an option to copy the phone number shows up, it seems like completely at the whim of the OS. And that's after accidentally starting to dial the number, of course. |
| |
| ▲ | quesera 3 hours ago | parent | prev [-] | | iOS presents me with "Dial NPA-NXX-XXXX" and "Cancel" options in a bottom-raised dialog, when I tap a tel link. I don't recall doing anything special to make this happen, but I wouldn't put it past me. | | |
| ▲ | rootusrootus 3 hours ago | parent [-] | | That may be specific to a web browser hyperlink. Click on an entry in your recent calls list and it'll immediately dial the number that called you. | | |
| ▲ | quesera 2 hours ago | parent [-] | | Got it, I missed the context. Agreed, now that I remember the self-training I had to do to avoid the issue, this is an obnoxiously awkward design choice! |
|
|
| |
| ▲ | pizzalife 5 hours ago | parent | prev | next [-] | | It’s in a private Ip range so unless you’re inside Iran you’re fine. | | | |
| ▲ | culi 4 hours ago | parent | prev [-] | | Agree it's a stupid default but you can (and imo should) turn off link previews in iOS |
|
|
| ▲ | gnarlouse 3 hours ago | parent | prev | next [-] |
| I saw “boobs” so I ran. -Iran |
|
| ▲ | lovegrenoble 5 hours ago | parent | prev | next [-] |
| Why not? |
|
| ▲ | ThePowerOfFuet 6 hours ago | parent | prev [-] |
| https://xcancel.com/hkashfi/status/1995109785679573167 |
| |
| ▲ | Boogie_Man 6 hours ago | parent | next [-] | | Thanks for posting this. I mostly gave up on viewing the one or two Twitter feeds that interest me after nitter stopped working. It wasn't ideological, I just wasn't able to reliably view and navigate without an account, and when I made an account it just kept showing me like "black HS football player bad sportsmanship". Look like I've got about two years of James Cage White story arcs to check in on. | | | |
| ▲ | jimbob45 4 hours ago | parent | prev [-] | | Why does this work while nitter doesn’t? |
|
