Internet outage in China on Jan 21

Yesterday we witnessed one of the largest Internet outages ever in China. We have three theories about why this outage may have occurred - two related to the Falun Gong but our third theory is that the Chinese authorities set out to attack our unblockable mirror websites.

From 15:30 to 16:30 (China time) on January 21, DNS lookup to any domain would incorrectly resolve to 65.49.2.178. Websites inside and outside of China were affected. Even Baidu and Sina were inaccessible. Only software using IP directly (e.g. QQ, VPNs) worked during that time. Attempts to visit any website redirected to http://65.49.2.178, which didn’t respond during that time.  The overwhelming traffic to this IP likely crashed the server.

Timeline

Event

15:15

GFW DNS poisoning begins. First recorded instance.

15:17

Local DNS servers began to cache incorrect responses. Some large websites in China began to be affected e.g Sina Weibo.

 

Incorrect DNS continue to spread through Chinese DNS servers. Major websites including Baidu, Sina affected.

15:39

DNS poisoning lifted by GFW. But local DNS resolvers cached incorrect responses. Users continued to experience outage.

16:00

ISPs around China were manually flushing DNS caches and connections were gradually restored.

We have conclusive evidence that this outage was caused by the Great Firewall (GFW). DNS poisoning is used extensively by the GFW. Some articles that have appeared about this outage suspected that the root DNS server in China was hacked and all domains hijacked to 65.49.2.178. This could explain why DNS servers in China were poisoned. However, during that time, we see that a lookup to 8.8.8.8, a public DNS operated by Google, returned bogus results if the lookup was done from China. In fact, the Google public DNS was not poisoned; the bogus response 65.49.2.178 could only have been returned by GFW.  If the Chinese root DNS server was hacked, a DNS lookup in China via 8.8.8.8 should have returned a correct response. See the below image from Zhihu.

Our testing system is designed to detect these bogus responses by querying non-existent DNS servers outside of China. Any valid response must come via GFW. We indeed observed such behavior during that time on all domains.  

But why did GFW poison all domains and effectively block all website traffic in China?

This action must have been unintentional. 65.49.2.178 is owned by Dynamic Internet Technology according to an IP lookup, and they are behind the famous circumvention tool FreeGate. Currently, http://65.49.2.178 is a mirror site for dongtaiwang.com, a news portal operated by Falun Gong groups.

Blocking 65.49.2.178

One hypothesis is that GFW might have intended to block the IP but accidentally used that IP to poison all domains.

Hackers

Many Chinese media stated that yesterday’s outage may have been due to a hacking attempt. The IP is operated by Dynamic Internet Technology, “mortal enemy number one” of the Chinese government. Some are suggesting Dynamic Internet Technology is behind the outage. However, hacking into a root DNS resolver is not enough to cause this outage, as we explained earlier in this post. They have to hack into GFW. If they are indeed capable of doing that, they can accomplish so much more than messing the entire Chinese internet up. In addition, 65.49.2.178 during that time was not serving any content and with such traffic, it looks more like a DDOS attack agasint 65.49.2.178. They couldn't use that IP to spread sensitive content during that time. However, from today, they have indeed started to use http://65.49.2.178 to distribute mirrors and stopped within a few hours.

Blocking our mirror sites

Our mirror site for FreeWeibo has attracted considerable attention and GFW has tried multiple times to block us. We automatically rotate backend servers and the GFW automatically scans new URLs and DNS poisons them.  DNS poisoning is not commonly used compared to connection reset. GFW seems to only use DNS poisoning as a last resort when connection reset fails to block a site. Our mirror forces GFW to add hundreds of rule-sets to DNS poisoning daily and perhaps because of this we were responsible for the system crashing. This is supported by the fact that our new backend domains are no longer automatically blocked.

We’re also continuously improving our backends to prevent automatic discovery from GFW. Perhaps the script operated by GFW acquired a “null” domain from us and consequently blocked everything.

评论

更多博客文章

订阅 email
显示 博客 | Google+ | Twitter | 全部 的消息. 使用 RSS 订阅我们的博客。

星期三, 8月 26, 2015

中国开发者被警察要求删除软件

发生了什么?

ShawdowSocks

8月22日,一个托管于GitHub的开源项目 ShadowSocks 被删除了。

ss.png

据该项目的作者透漏,警察联系了他,并要求他停止开发该工具,并从GitHub上删除所有代码。

police.png

后来他删除了关于警方的评论,想必是迫于警方的压力。
edited.png

消息传出后,许多中国和外国开发商,以及ShadowSocks用户,对作者致谢。同时由于这种广泛关注的结果,ShadowSocks成为了GitHub上的热门项目。

Github.png

 

星期三, 7月 15, 2015

商业巨人和道德矮子

当LinkedIn在2014年2月决定建立中国本地版网站的时候,它做出了一个艰难的决定,这是一个在公司价值观上的妥协。

值得注意的是,在LinkedIn发布领英网(该网站的中国本地版)之前,它就已经活跃在中国市场了。在他们的账户下,有四亿的注册用户(几乎没有进行市场营销),中国的客户会在他们的平台上购买广告(他们的主要收入)。当局曾对该网站进行了为期24小时屏蔽,但从未进行长期屏蔽。

那么,为什么LinkedIn非得在中国创建一个本地实体版?因为当地的实体公司将能够开具人民币的正式收据,这能够使本地企业更方便的购买网站上广告。当地实体也使得它更容易进行市场交易,促进领英在中国的发展。

但或许更大的吸引力在于这可以让它成为少数几个能与鲁炜以及中国网信办(CAC)愉快相处的国外互联网公司。这层与网信办的关系必将有助于那些想在中国发展的企。

2015-07-14-1436865048-6462717-1115415785_14326334877831n.jpg

图片说明: LinkedIn的雷德•霍夫曼多次会见中国的网络沙皇鲁炜.

当然,还会有许多其他的好处,但为了成为一个本地公司,LinkedIn不得妥协以下几点:

  • 要在当局的授意下全天候的审查用户发布在该平台上的内容,无论是在中国境内或境外。
  • 要在中国境内的服务器上存储所有中国用户的数据,并且要在中国当局能够随时随地的访问这些数据。
  • 要按照所有目前和将来的中国互联网法规来运营。

LinkedIn在中国的审查制度处理上曾有些尴尬。它们对审查透明度的承诺含糊不清,不置可否(“可能”,“或许”,“尝试”),但该公司的CEO,杰夫•韦纳,已经有比较明确对如何处理审查的态度。以下是他与BuzzFeed的麦特•霍南的22分钟的采访

星期六, 4月 04, 2015

CNNIC封杀自己对根证书被撤销的声明

谷歌于2015年4月1日宣布,他们将不再承认CNNIC根和EV证书颁发机构(CAs)。

在第二天,Mozilla也发表博文称:CNNIC给其他公司发行不受约束的中间证书是“令人震惊的做法”,而Mozilla的产品将不再信任由CNNIC根颁发的任何证书。 Mozilla还发表了关于他们的更详细的报告

在谷歌和Mozilla于2015年3月23日曝光了几个谷歌域名使用了未经批准的数字证书之后,CNNIC并未发表任何声明。CNNIC身为证书颁发机构,却一直在实施中国的网络审查。CNNIC不仅曾是,现在也是,并且将来还是会继续实施中国的互联网审查。

不出意外,上述关于4月1日和2日的新闻在中国的社交媒体和传统媒体上被封杀了。

下面是关于这些公告的微博截图。

请注意,在第一篇关于谷歌全面撤销CNNIC的根证书的截图中,下方有三个按钮,而在第二个截图中却有四个按钮,很明显能看出第一篇微博的转发功能消失了,可见中国当局正在如何防止负面信息蔓延上变得越来越有创意!最后这篇微博的命运和往常一样,被当局完全删除了。

即便在传统媒体网站上也有一些详细介绍了CNNIC对此“毫不知情”的报道,也已经被封杀。

网易的报道:“Chrome和Mozilla撤销了CNNIC CA”在发布后2小时之内就被删除。网易是中国最大的互联网服务提供商之一。

URL:http://tech.163.com/15/0403/08/AM8VPOLJ000915BF.html

新浪的报道:“CNNIC认为谷歌的决定是不可理解和不可接受的”被删除。新浪网是中国最大的门户网站之一。

URL: http://tech.sina.com.cn/i/2015-04-02/doc-ichmifpy5387951.shtml

搜狐的报道:“CNNIC谴责谷歌”已被删除。搜狐在全网Alexa排名第44。

星期二, 3月 31, 2015

中国当局的使用数百万网民进行网络攻击

鲁炜和中国网信办很明显的升级了他们控制信息的战术. 防火长城由一个被动的过滤器变成了一个具有侵略性的主动的武器。 这是一个非常可怕的发展,这种行动的影响将会延伸至互联网的每一个角落。简明的说,当局已经以前是对中国,现在到全球互联网都要执行严格的审查制度。

星期五, 3月 27, 2015

中国封杀有关CNNIC发布中间人证书的文章

日前,谷歌发现在多个未授权的针对谷歌域名的电子证书,而这些证书的根证书属于中国互联网络信息中心(CNNIC)。谷歌和Mozilla(火狐)分别公开了这一安全事件,就此分别发表了博客文章(GoogleMozilla)。但谷歌与Mozilla有关CNNIC发布中间人攻击证书文章的中文翻译,则在中国被勒令删除。

 

  • 中国著名IT博客“月光博客”不加任何评论,将谷歌的文章翻译成中文。在谷歌和百度上用中文搜索“CNNIC中间人攻击”,他的这篇文章都是搜索的首个结果。3月26日,他在推特上表示,新闻办打电话给他, 要求立即删除他的这篇文章。原文 http://www.williamlong.info/archives/4183.html 被删除了。但谷歌缓存仍然存在。

使用 RSS 订阅我们的博客。

评论

и сюда запостил.

inspired a lot from this post am following this blog regularly and found very good for bookmarking thanks admin
new year sms in hindi 2015
happy new year sms 2015
happy new year 2015 wallpapers
happy new year 2015 quotes
happy new year 2015
happy new year wishes 2015

this post is awesome, great msg for us, plz update ur blog for daily basis, i am regular visitor of this site, so keep posting for us,

click the below links to create backlink
best free backlink website
click here for msg movie

thanks for this post, keep it up for updating us, i am waiting for ur new article.
IPL 2015 Cricket live score
mpscomputers
Harjinder Singh
thanks again

添加新评论

Filtered HTML

  • 自动将网址与电子邮件地址转变为链接。
  • 允许的HTML标签:<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • 自动断行和分段。

Plain text

  • 不允许HTML标记。
  • 自动将网址与电子邮件地址转变为链接。
  • 自动断行和分段。
By submitting this form, you accept the Mollom privacy policy.