How Intelligence offices deny access to some sites?

Question

I'm from Republic of Moldova and during recent events in april our government restricted access to some websites that presented news from other point than the official one, also it was restricted access to facebook and over social networks.

I'm wondering how it is done.

NOTE: The restriction could be overcomed by using Firefox plugin Tor.

Answer 1

There are numerous ways to block undesirable traffic.

• Identify all the connections to the outside world
• Instruct the owners of those connections to:
  • Block certain websites based on their IP (ie, don't route packets addressed to certain IPs on a block list)
  • Block DNS results based on wildcards (so *news* might block all DNS requests that have "news" anywhere in their name)
  • Use a packet inspector to monitor HTTP and other traffic for keywords, and send a TCP disconnect packet if certain triggers on the content are seen.
  • Block non port 80 and 25 traffic

Note that the gov't can't control all the ISPs (those with satellite phone data plans are ok since the company doesn't have an office in the country they can put pressure on).

Further, some tactics can't be used due to the burden - the packet inspector, running on even a relatively slow 10gbps trunk line requires a ton of processing power and speed to keep up with traffic. Compromises must be made.

On the other hand, 99% of the people in the country are going to be stymied by a simple DNS blocking scheme. Those that can get past that easily will also be able to get around most of the other block anyway.

The goal of such a program isn't to prevent anyone from having access, it's to capture the greatest portion of the public and make sure they are getting your message and only your message.

In political battles that's usually sufficient.

-Adam

Answer 2

The easist way for them to block sites, is to redirect the DNS record.

The easy way to check this, would be to use a DNS server from another country, or set up your own dns that hasnt blocked the sites. (in other words, does the entire check from root dns for every new site you try to access.

Answer 3

At a guess, making sure there were blackhole routes in place on most (all?) ISPs' connection to "outside of Moldova". This would tie in nicely with "works to bypass via TOR" (as the packet destined for the server IP would be encapsulated until quite probably outside of Moldova).

As far as I understand TOR, name resolution still happens as per normal on the client machine, so any DNS intercept would still have caused a block. The blackhole route option is also good from a network performance perspective, as it doesn't require any extra work to be done for either "blocked" or "unblocked" packets, it's still just normal routing packet forwarding.

Answer 4

Well ... Probably done by some kind of firewall technology, that would have to be running at the country's all ISP:s, to inspect and block traffic to selected external sites.

And, not to give them any ideas, but ... According to the wiki page on Tor, it should be possible to block that too, for an entity like a government. At least it's possible for the US government.

Answer 5

If you can gain ssh access to server outside of the country (any sort of shared hosting solution such as dreamhost can provide this for maybe 10 bucks a month) you can then tunnel your traffic through this server using ssh. If you tunnel both the web and DNS traffic through ssh you should be able to browse anything. I wrote how to do this in my blog here, it says how to do this with Firefox (I hope the plug is okay, if not let me know and I will edit my post).