Slashdot Mirror
China's Great Firewall Infects Other Countries
angry tapir writes "A networking error has caused computers in Chile and the US to come under the control of the Great Firewall of China, redirecting Facebook, Twitter, and YouTube users to Chinese servers. Security experts are not sure exactly how this happened, but it appears that at least one ISP recently began fetching high-level DNS information, from what's known as a root DNS server, based in China. That server, operated out of China by Swedish service provider Netnod, returned DNS information intended for Chinese users, effectively spreading China's network censorship overseas."
Chinese official: "Whoops..." (with big grin on face).
The world's burning. Moped Jesus spotted on I50. Details at 11.
Why am I not surprised?
And their firewalls didn't detect the melamine in the imported DNS records? Pitiful.
Now will somebody tell them to keep their sh*t for them? Or are we too weak to talk frankly to Chinese authorities?
Kindly go fuck yourself.
Shoes for Industry. Shoes for the Dead.
If you are reading this, you are not affected.
Fine Google you want to leave China. Where you going to go when we take over the whole internet.
The headlines now tell you absolutely nothing about the actual stories.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
This is why we need DNSCurve implemented on the wide scale. Badly.
Misconfiguration of resolv.conf does not put China's firewall in your way. Add yourself to the tool belt.
In other news, WW3 started slowly with Google and Dell pulling out of China. Infowars continued to increase when China's root nameserver began to propagate its information out to the developing world, areas that had been increasingly reliant on Chinese funding since the post-cold-War US' international power began to wane..
(Firewall is subverted...)
Damn you cyber-Mongorians!
Bow-ties are cool.
Either they already fixed it or the article is wrong, because I'm in Chile and Facebook and Youtube seem fine to me
China wants to rule the world. (Or at least make sure they make money somehow everywhere.) I can see the Chinese - all using Red Flag Linux (or some pirated copy of Wintendo) - gathering together to control all DNS machines. This was a warning - mess with us and we take your DNS down.
The Kai's Semi-Updated Website Thingy
So if the entire world's DNS resolved to the Chinese firewall simultaneously would it DOS them to oblivion and end these shenanigans? I'd give up a day of using the internet to see that go down.
Get a web developer
Youtube, Wikipedia and hell even Slashdot have had access problems this week. 6th form conspiracy theorist asks "Is 'something' is going on"?
US DNS servers magically start pulling DNS data from chinese servers? Uh huh. Completely an "accident".
moox. for a new generation.
... and nothing of value was lost
I was wondering about that fortune cookie that said "All of your root servers are belonging to us."
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
So any wrongful destination now has a lot of passwords. Especially IMAP and POP and suchlike, not even a need to set up a misleading website, you can play totally innocent.
Prevention:
1) Don't have a root server in a country that wants to censor information
2) Implement free SSL certs so that it is no longer "normal" to just click through the SSL cert alert
3) DNSCurve, DNSSEC, whatever
4) Encrypt.
5) Even when using encryption always use auth schemes that cannot be replayed afterwards. Without certs I don't think you can stop MITM, but much too many people use only one password for a lot of different things, at least that one won't be in the sniffer's hands.
More?
ancient chinese secret, huh?
fak3r.com
"The Net interprets censorship as damage and routes around it"
- John Gilmore
Firewall burns you!
How much you want to bet that this was not deliberate on their part...this is part of the whole scheme of them cyberattacking all other countries and controlling the new cyberage.
Come on, are we really being that stupid? Of course it was a hacker attack. The chances of an IP address "accidentally" being pointed to a Chinese one is remote.
These Chinese hackers (and hackers in general) are getting more and more dangerous. If they hack the DNS servers, we're talking about a massive ability to steal passwords, since https is based on domain name and not IP address. If the DNS is configured to give incorrect DNS information, then we really could get hosed here.
Maybe offtopic, but how does DNCSEC affect DNS level censorship?
-- I was raised on the command line, bitch
Heck, even Dell is pulling out.
So, because the Chinese persist in behaving badly it's time for internet war. Let's band together and shut 'em down. Close off internet to China and see how they like it - after all, the TLD's are controlled by the U.S. As to messaging etc. they can phone and fax.
Sorry for such a rant but there has got to be a consequence for the level and voracity of the issues and problems that emanate from China - especially when the government there is never responsible.
*** Don't be dull.***
The reference to firewall is just different in this case. In China it's called the "Golden Shield Project" outside of China it's called the "Great Firewall of China". If you miss configure your DNS to look at China's DNS then you are using their Golden Shield hence you are using The Great Firewall of China.
Remember that quote? "The Net views censorship as damage and, sometimes, routes into it..."
Oh, yes, another one of those "Why can't we be more like Europe?!" moments...
In Soviet Washington the swamp drains you.
In Soviet Russia, Firewall misconfigures you!
I am secretly hoping this was a Bind error wishing everyone would switch to the far superior http://cr.yp.to/djbdns.html
Yes they can, the same way that Pakistan's ISP took down access to Youtube for everyone in the world. Perhaps you should read up on the Border Gateway Protocol (BGP) before making such a stupid statement.
What gives with the media these days?
It's all too clear. Kinda like the cold war with Russia.
Except it's the Virtual War with China. Are yall ready for the next big pseudo war?
Arguably a war worth fighting, but at cost? Could this get ugly?
The timing of this incident makes me guess it is no coincidence. Begun the clone-wars has. Now, we should maybe not have put a single tsar in charge of US cyber-security. He's in the background pulling the strings. It's the same problem as in Star Wars. The cyber-star has aspirations on being an emperor in the new empire that will rise in the ashes of the old republic of Internet.
I live and work in Chile, and know the network problems well here. Here is my take on it.
I seen that nic.cl had several of their DNS servers that where failing about three weeks ago (I just figured someone would figure it out and fix it, guess not ). Any .cl using nic.cl as their primary dns server ( what most .cl domains use by default rather than having their own), was having failures based on which of the dns servers at nic.cl they were using (I think two of them where failing).
Here is what I seen happening. I have a U.S. server, that hosts certain .cl web sites. They all use my own dns servers including backups dns servers spread around the world rather than Chile's dns server. I also have most ISP in China blocked at a firewall level for spam and security reasons (I have no use for talking to China in my biz). Other companies with .cl domains could not send mail to .cl domains on my server, because they where failing in the reverse lookup. That got me checking their DNS server, which happened to be nic.cl directly.
Now there is only about three ISPs in Chile. Yea, there are many by different names, but they all contract or are owned by three companies with the same hardware. Basically there is VTR cable company, Telefonica, and Telmex. Almost all others that I am aware of are the same company under a diffrent name, or they buy their upstream services from them. They all seem to share lines internationally.
The unnamed service provider in this case is most likly telmexchile.cl as they are the host for nic.cl ( a guess, based on other DNS problems I have seen over the years in Chile ).
DNS issues are very common in Chile with all the isps. About 2 months ago, telefonica mis-configured their dns servers and somewhere around 60% of all internet users, including mobile phone users (telefonica is known as movistar cell phone company) lost the ability to connect to much of the rest of the World. Telefonica is the upstream provider for many smaller ISP in Chile, and at times contracts through telmex also.
I have to run my own caching name servers for my offices in Chile, and never depend on the isp here for DNS servers because they are notorious for having caches that are more than 48 hours out of date, not to mention a lookup of domain can add as much as 5-10 seconds to a connection over just trying to get to the other side of the World to reach a foreign server. Especially for stuff that they do not have cached regularly. This has also personally led me to not trust the quality of what they are returning.
So, there is about 90% probability that the ISP in question is either telmex in Chile or Telefonica. The other is VTR cable, and as far as I know they had nothing to do with it because they don't normally do corporate type hosting. 98% of all internet is provided by those three sources according to a recent OECD report (not even sure what the other 2% is they are refering to in the report. Perhaps satellite).
So, the market inbreeding has turned Chile's internet in to a very unstable and fragil set of networks in the last few years, that is essentially unregulated. For instance, during the recent earthquake, even the web site for the national police in Chile got knocked offline for over a week along with most other goverment servers.
So I do not blaim this on China so much (beyond normal things), but on the poor quality of the network administrators and the even lower quality management at the ISP. Mostly I blame this on the former government, for not regulating the ISP and instead encouraging the monopolies that have developed. This was made evident to the country when all the cell phone networks in the country failed for days after the earthquake because they failed to do things like have battery backups for the cell phone towers. I expect some serious changes are on the way.
Living in Chile
The "misconfiguration" was apparently at the routing layer, caused by BGP. There are 13 DNS root servers, A-M. Several mirrors around the world actually share the same IP for a specific root server. Your DNS query to a root server IP is usually routed to the closest server with that IP, due to anycast routing. Apparently, a BGP misconfiguration caused an incorrect route to be advertised. Ars Technica apparently broke the story and has a very good description. They quote VeriSign spokesman Brad Williams:
Mauricio Vergara Ereche, a DNS Admin for Chile NIC, first noticed the problem. Queries to the I root server i.root-servers.net at IP 192.36.148.17 for www.facebook.com resolved to an actual IP address (in China) instead of redirecting to the .com DNS server as it should have. He posted this in his message to the dns-operations mailing list:
Now who should we blame?
China or Sweden?
Turn out the Swedes are operating the Great Firewall of China.
If the Chinese are to be blamed of censorship, the Swedes must be blamed of ENFORCING the censorship.
Muchas Gracias, Señor Edward Snowden !
War was beginning...
(Obligatory humor: Somebody set up us the BIND).
This is what we get for not nuking the bastards when they crossed the Yalu River during the Korean War. Should have fixed it then...
>> we notified our technical partner in China and helped them resolve the issue.
>> Our network checks show that the issue is now resolved."
So this routing issue originated and had to be corrected in China???
So some low security DOD computer in the US goes to say dodsite1.gov and China can make it actually go to a Chinese controlled web site if they want to???
WHAT???
All,
as this topic has drawn quite some interest I would like to reiterate some of our other public comments.At Netnod/Autonomica we are completely dedicated to serving the IANA root zone as we receive it. We do not intercept, interfere, rewrite or otherwise alter either queries, responses or the content of the zone itself. The events that occurred are still being investigated and as soon as we deemed we had collected enough data we withdraw the announcements from on of our anycast nodes that serve i.root-servers.net.
I can't guarantee that me or any of our staff monitors this thread, but we do try and communicate to the community as much as we can without adding further speculations.
Best regards,
- kurtis -
---
Kurt Erik Lindqvist, CEO
kurtis@netnod.se, Direct: +46-8-562 860 11, Switch: +46-8-562 860 00
Please note our new address:
Franzéngatan 5 | SE-112 51 Stockholm | Sweden