A technical look at Iran's internet shutdowns
zola.ink
zola.ink
Looking at a bigger picture though, honestly I think we're seeing the end of the raw global Internet for the masses. 20 years ago, it seemed impossible, but here we are.
It's simply not going to be possible to meaningfully use the Internet unauthenticated and unapproved in a few years. Costs to reach mass audiences online will increase until only the big players can do it, and it'll be their platforms or nothing. There's going to be no room for anything that those with millions and billions of dollars don't want or can't make money off of in some way.
Overall, this makes me want to reduce the role of the Internet and tech in my life. I don't need the fastest data plan, latest PC, newest phone, or whatever AI trend is hot to use the apps I need for daily life or to line up events and meetings with others that I actually know.
Some sources [0][1]
> I would guess it's at least a set of nationally managed DNS servers that will always resolve national IPs even if upstream global DNS is cut off.
Yep. Along with an entire ecosystem of domestically created and regulated search engines, DPI, centrally managed certs, AV, networking backbone, etc.
It's similar in intention to the Great Firewall in China, except much more restrictive.
Imagine corporate IT restrictions and posture being deployed nationwide on all endpoints, that's how these kind of initiatives tend to architected.
SSE/Zero Trust, DPI, Cert Mgmt, etc are all dual-use, and it's essentially a logistics and organization problem.
[0] - https://apps.dtic.mil/sti/pdfs/AD1107324.pdf
[1] - https://www.article19.org/data/files/medialibrary/38316/The-...
It is way more than just DNS.
> the only google service that did work at that time was google search as far as I know nothing else worked (no gmail, maps, etc.)
Yea, sounds like they resorted to a hard whitelist. How were other Internet services impacted in Iran? My understanding is payment is increasingly tap-to-pay or via digital wallets within Iran? How was that impacted during the shutdown?
This is defeatist. You're probably right 'for the masses' but there will always be those networking and collaborating and bypassing whatever restrictions get put in place. I have online contacts in 'firewalled' regimes that use v2ray/shadowsocks or whatever the thing of the now is to get around the restrictions.
There's a ton of cheap tools now that can be used for running local or citywide networks, hams have their own packet radio stuff. There's now all those new LoRa networks that only really popped up in the past few years.
What I'm trying to say is the stuff is there and it's accessible, but it's only going to be a minority of people that use it just as it's a small minority that comments on posts like this (people like us) and even smaller yet again that write content on how to do it and create those tools to begin with. But it has always been this way....
Exactly. This is why the tech has to be made resistant to surveillance and censorship by default. Until usage of alternative connectivity and circumvention methods sticks out as a sore thumb (turns out, for most tools it does), it applies a constant pressure on anyone under oppression to stop, increasing the risks for those who continue to use them.
We got basically three different things. First we got APRS, mostly used for position reports (go on aprs.fi for a map). That is pretty nice but unusable for anything more than a SMS worth of things, and you need repeaters and not just internet gateway collectors to actually have something that's resilient.
Next thing is AX25, the technical foundation behind APRS. Yes you can use it to create actual data links, but it's about modem speeds so virtually useless outside of toying around.
And finally there is HamNet but it's line of sight based and not cross routed to the internet, and identically to all things ham radio, encryption is banned by law.
And on top of that, you can expect regulatory agencies to crack down on ham radio fast and hard, should it be used for political dissency motives at scale. It's already against ham practice to talk politics, especially with people in repressive countries - we don't want more countries other than Yemen and North Korea to just blanket ban ham radio.
i.e. if there's a blanket ban, can you use your radio hidden in your house or can the government easily find out that the user they've noticed on the airwaves is located there and knock down your door?
Sadly, yes. A bunch of SDRs spread over the whole country with precise clocks or a scheme like the one used in ADS-B MLAT reception (that's based on using the internal SDR clocks without requiring precise clocks on the host) is enough to use multilateration to hone in on any kind of signal, even looking up in raw signals in the past.
If I were to guess, I'd assume that even in nominal democracies the secret agencies are already running such monitoring stations so it's probably already the case that, should need be, all communications can be triangulated.
The HF bands are all small enough to be sampled whole with a single cheap RTL-SDR each, a KiwiSDR can sample literally all of them at the same time, only the VHF/UHF bands need more dedicated equipment (e.g. a BladeRF) - all of that is inside the range that hobbyists can easily afford.
"Huff Duff" is WW2 technology.
https://en.wikipedia.org/wiki/High-frequency_direction_findi...
The units used for detecting and locating clandestine transmitters started WW2 as large truck mounted facilities to hand carried units (with antennas) that fit inside suitcase-sized containers.
Modern ham groups engage in transmitter hunting as part of organized events. Bunny hunting and fox hunting are alternate names for such activities.
https://en.wikipedia.org/wiki/Transmitter_hunting
How to do it: https://www.youtube.com/watch?v=PN-c5DQFuhI
Governments use much large automated facilities:
https://en.wikipedia.org/wiki/Circularly_disposed_antenna_ar... https://en.wikipedia.org/wiki/AN/FRD-10
I don’t understand this sentiment. For exchanging information, modem speeds were great. Wikipedia, forums like this one, instant messengers, etc all worked fine
The problem is, websites got wasteful. You're not going to get any modern website - including Wikipedia - to load in anything close to usable waiting times over a modem speed constraints. HN and maybe Old Reddit are an exception but HN is a niche forum and Old Reddit is probably going to get dumped once Reddit manages to port over all features that were only exclusive to Old Reddit for like six years or so. IRC is all but gone, in no small part "thanks" to Freenode going down the drain and Slack/Discord/Teams eating its lunch.
I don't think so. It's just a question of the severity of the punishment for violating regulations. A couple of small fines for an unlicensed networking and collaborating - and there will be no one left.
>There's a ton of cheap tools now that can be used for running local or citywide networks, hams have their own packet radio stuff.
The issue has never been in the technical plane. The equipment for building and operating networks has become dozens of times more accessible over the past couple of decades. The problem is in the increasing number of regulations that purposefully lock all clients into a few select controlled service providers. They have a goal and they have the tools to achieve it, so it's only a matter of time before they reach the minority of network-enthusiasts.
I don't think you give people enough credit. There have been dissidents in totalitarian regimes the world over, even when the punishment was death or being sent to a labour camp.
You might think that unlicenced networking isn't important enough, but I think many people would see it as the start of China-like censorship. Especially now that we've had decades of a mostly-free Internet, I don't think people will react kindly to politicians taking it away.
Edit0: I checked, as this seemed self evident, but it's seemingly perfectly fine for residents to use VPNs and for adults to visit porn sites on or off a VPN. Obviously not for minors but that's not the point.
You probably know very little about totalitarian regimes? The thing is that they usually have a rather weak legal system, governed by the principles of lawlessness. This creates strong incentives for dissident activity:
- You won't be caught, because the police are interested in breaking their own laws, and not in finding criminals - If you are caught, there is a chance to buy your way out, because the police are more interested in receiving bribes than in jailing a dissident who has violated something unclear - Even if you are completely law-abiding, you can still be detained as a dissident, because they urgently need to catch a dissident today - You can't be completely law-abiding citizen, no one can, laws doesn't supposed to be workable. And if you break a bunch of laws just because you breathe, it's easy enough for you to break just another one - And even if you obey all the laws you can, what awaits you? A miserable, half-starved life that can be cut short at any moment for any reason - You don't receive social stigma and disapproval, because the majority of society clearly does not approve of the persecution of dissidents
The point is that severe punishments, including the death penalty, are used under totalitarianism precisely because of impotence in the fight against dissidents.
But we are talking about completely different regimes. Regimes with laws that work. Regimes with extremely efficient bureaucracy. Regimes where people have very much to lose and where they clearly know what they need to do to avoid losing it. And regimes with a system of totalitarian surveillance of all citizens. People won't need to be executed. Just a small fine EVERY time - and very quickly there will be no one left.
> but I think many people would see it as the start of China-like censorship.
The start has already begun, and as I see it, China is a children's party with tea and custard cakes compared to what awaits us.
Totalitarian regimes don't need to be failed states. These countries had functioning rule of law and bureaucracy before WW2, and this apparatus was fully used by the new totalitarian governments. So I think they're the closest model that we have for how our ("western") societies might work after sharing undesirable information is made an offence.
Pirate radio isn't new, and hardware has gotten both cheaper and more sophisticated since kids drove around in cars with haywire FM transmitters.
The current american administration clearly wants to stamp down on disruption, too. If they can't deport us I think they'd be fine with prison or working us to death. Future administrations won't be so dumb to think this is just related to criticizing Israel, either, but anything.... disruptive.
it seems then that store-and-forward ad hoc p2p (ie extremely high unpredictable latency) is the only option for those who can reach some node with a connection to the outside (maybe laser near the border). or perhaps really clever steganography with outside partners assisting.
Starlink/Kuiper and the geostationary satellites are an alternative. Not perfect... but far better than *nothing*
Only when (if) Stalink removes the need for base stations and just sends the traffic directly between satellites.
You still need the Starlink coverage to be enabled on system level, and the local government to care enough to track down Starlink users at the same time. I can't imagine that there are many countries that meet both criteria.
You’ll be found on the internet too btw. But far more easily.
But no matter what they do there will be light at the end. it cannot always be night.
I feel like I’ve been hearing this for decades. During the initial wave of Napster-era piracy debates a lot of people assumed the end of the free internet was near because corporations wouldn’t allow it.
> It's simply not going to be possible to meaningfully use the Internet unauthenticated and unapproved in a few years.
I will take the opposite of that bet any day. Certain countries like Iran will impose their restrictions, but if you think the average country is going to restrict internet access in only a couple of years I don’t know what to say.
Today's crowd is full of lickspittles who are constantly searching for someone or something to kneel before. Money, power, or at least flavour-of-the-month fame. A lot of work was put into spreading those ideals, and not teaching anything “outdated”, “dissenting” or “controversial”.
So you're not just waving the white flag even before anyone intimidates you personally, you're actively working for that cause, willingly or unwillingly.
Something tells me that you were not using 56 bit encryption when posting. In a different world, you would, and lament how pathetic and insecure it is to let someone calling themselves “government” have access to everything, but how understandable it is in presence of communists, terrorists, degenerates who have rejected the democratic values and thus stopped being humans, etc.
Dystopias and the dystopian outlook actually helps any kind of high profile swindler a lot. People treat them as the portrayal of “how the world really works”, and expect it to be normal when someone does it, or just hints at such option to scare the public, while they were intended to portray how stupid people can be if they cease to think. Please choose some higher standards.
End of the day, what happened to Slashdot 20 years ago happened to society - an endless stream of trolls and jerks ruined everything.
It's AS12880, the state owned telecom company which all ISPs are obligated to be downstream of. It operates Iran's international links to other global scale ISPs via Turkey and other paths.
https://www.peeringdb.com/asn/12880
And its also government run counterpart, the "TIC"
https://bgp.he.net/AS49666#_asinfo
https://www.google.com/search?client=firefox-b-d&q=AS12880+i...
Not quite true. Wireguard is already actively detected and suppressed if necessary. There's already a fork that employs basic changes to improve the protocol in this regard. AmneziaWG was shown to be more robust to detection for now.
https://docs.amnezia.org/documentation/amnezia-wg/
Too bad managing WG is such a pain and Tailscale/Netbird don't support this protocol yet. The following two issues need attention:
We just upstreamed our patch to quinn-rs that pads Datagrams to MTU: https://github.com/quinn-rs/quinn/pull/2274
Actually, some DPIs just straight-up reject UDP (and since DNS and NTP are UDP-based*, just straight-up interception-and-redirect).
* TCP DNS exists but practically not used for most "normal" tasks, and at this point the censor is trying to block anything anyways.
It is? My clients on OpenBSD need about ten lines in /etc/hostname.wg[0-9]+ and that includes the routes!
This is surprising to me. Surely iranian ISPs would have directly allocated IP space?
Or alternatively, surely Iran's gov would be in the routers and be able to blackhole any routes leaving the country?
(Fun fact about sanctions: the International Criminal Court is sanctioned away from Microsoft, so they can't legally get access to Windows or Office. This is because they prosecuted a war criminal the USA likes.)
How does that even work? There are many companies in the EU that (legally) sells second hand Windows and Office licenses to anyone.
SMS everywhere is unencrypted
Job security for me I guess lol thanks
I found the whole article to be unfortunately light on both technical details and practical details, and certainly wouldn’t suggest that anyone use it as a guide.
Matrix isn't meaningfully encrypted, so it's mostly irrelevant, hooray!
Other stuff is weird in their post and suggests they are speaking for Iranians without actually knowing any online. I know a few from the Cellmapper community and SMS is very much not expensive. 1000 SMS costs around 0.03USD worst case: https://irancell.ir/en/p/3771/tariffs-and-voice-packages-en
Finally it's not really that Starlink uses proprietary encryption that's special. They can use any sort of common encryption standard and there's not much Iran can do but locate and seize the terminal since they don't have the keys to it. I imagine at some point they were start looking for signal emissions in known Starlink bands and use that to locate terminals. Allegedly Russia has a detection system 'Kalinka' already built: https://www.space.com/space-exploration/tech/russia-and-chin...
Hard to find that out, as I can imagine outlets like HN are actively monitored as well - if an Iranian account would be like "hello I am in the resistance movement", they'd be painting a target on themselves.
But the US is heading this way too if I may put on my conspiracy thinking hat; "we" already knew, but the Snowden leaks confirmed that the NSA and co are inside all of the major internet companies, probably including Starlink.
When the shit hits the fan, it is us techy internet peoples' responsibility to ensure information continues to flow freely, be it through access to information (like these local portable wifi network devices that have a small internet full of knowledge like Wikipedia pages), communication (the Matrix servers mentioned in the article), and communication to the outside world.
On that note, what would be the next option if for example the US cut itself off of the global internet and Starlink? Ham radio / whispernet? I mean I'm pretty confident that at the moment there's just too much freedom still for an internet shutdown to be viable, but having the knowledge is important nevertheless.
ok conspiracy hat off. Disclaimer, I don't live in the US, but my grandparents did live through WW2, during which people had secret radios because the Nazis confiscated all of them to try and keep people uninformed. The radios were essential for the resistance movements, with public BBC broadcasts containing secret messages informing the reistance of e.g. sabotage supply drops. See https://en.wikipedia.org/wiki/Dutch_resistance for a good starting point, and https://en.wikipedia.org/wiki/Resistance_during_World_War_II for the rest of Europe.
Also, those who can be executed like that have already realised that “safe” way of being a “good citizen” does not exist, it's a phantom for people who are — at the moment — rich, happy and walled from the rest (either physically or in their minds). They probably don't need to be told not to trust someone who is offering to solve all their problems.
? A totalitarian regime doesn't need much motivation to have people killed, to the point where even having knowledge or reading the wrong thing will have you put on a list.