PhoenixFire

Immunicity Returns

On the 2nd of October the Government Intellectual Property Office and the City of London Police PIPCU posted to twitter about how they’d diverted 11 million views from ‘pirate’ websites since July 2014.

Unfortunately there’s a slight problem with their claim; some of the seized domains, such as immunicity.org, have been under the control of Brass Horn Communications for several months now, hundreds of thousands of those supposed diverts have actually been seeing the following page;

divert

Domain seizures are censorship and as we all know; the Net interprets censorship as damage and routes around it.

Hopefully PIPCU will concentrate on people actually committing crimes rather than those who are just routing packets.

BwheKLxCQAAdzAP.jpg large

Filters Are For Coffee – Not The Internet

Today is International Coffee Day so what better day to take the Open Rights Group tag line of “Filters Are For Coffee Not The Internet” and investigate the capabilities of the Internet filtering at various coffee locations.

Costa Coffee / Cafe Nero – O2 Wifi

DNS Spoofing: Partial
MiTM SSL: No
Deep Packet Inspection: Yes
Destination IP Transit Interference: Yes

O2 WiFi requires two-factor registration via a phone number and SMS claiming that it is a legal requirement. This is easily traversed with a disposable PAYG phone (e.g. EE have a Nokia 106 for £4.99 – an excellent option for a burner phone). Once you’ve completed the two-factor check (the first being they record your MAC address) you can start browsing.

The first thing to notice is that unlike their mobile offering the WiFi has several layers of filtering, some DNS queries are intercepted to send you to a block page and even if you resolve the A record out-of-band Squid will intercept and block.

If you manually query a 3rd party DNS server for the record in question then it appears to return normally.

This level of blocking however is hit and miss with domains such as the thepiratebay.se suffering the worst interference but others that are blocked by the default mobile filters aren’t blocked on the WiFi.

Thankfully all the usual bypass methods (Tor, RoutingPacketsIsNotACrime.uk, SSH SOCKS5 tunnel and SSL) work flawlessly despite the use of Squid and DNS interference.

Interestingly O2 have chosen to force Google to not allow SSL searching (so they can inspect the content and block stuff) which also means anyone else in the coffee shop can spy on your browsing. DuckDuckGo.com does still offer SSL searching and isn’t blocked.

Breaking down an O2 Intercept

The packet capture for this attempt to hit http://reddit.com/r/nsfw is here, the pertinent part of the HTTP transfer is below;

GET /r/nsfw HTTP/1.1
User-Agent: curl/7.34.0
Host: reddit.com
Accept: */*

HTTP/1.1 200 OK
Date: Mon, 29 Sep 2014 10:28:51 GMT
X-Template: blacklisted
Content-Type: text/html
Content-Length: 195
Cache-Control: no-cache
X-Cache: MISS from Squid
Via: 1.1 Squid (squid/3.2.11)
Connection: keep-alive
< !DOCTYPE html>
<html>
<head>
    <meta http-equiv="refresh" content="0; url=https://www.o2wifi.co.uk/pages/n4?bd=http://reddit.com:80/r/nsfw"/>
    <title></title>
</head>
<body>
</body>
</html>

Despite getting the correct A records back from the nameservers in packet 5 we can see in packets 12 onwards that the O2 Squid server (ironically the same software PacketFlagon.is uses to bypass censorship!) returns back some HTML with a meta refresh that instantly directs the browser to their block page.

As shown in this packet capture there is no IP/Host matching it is all done on the GET path and the Host header so Hosts files hacks won’t work either.

High Court blocks are solved using DNS and an attempt to resolve thepiratebay.se returns 127.0.0.1.

Finally some other blocks such as the block of torproject.org are achieved by just silently dropping the packets.

Starbucks – BT / Friendly WiFi

The people at Friendly WiFi appear to be quite zealous about blocking “pornography” and come out with ridiculous claims such as that by putting in their filtering one gets a “porn free city”

Thankfully their blocks are almost as easy to bypass as O2′s. Interestingly, unlike O2, Starbucks and BT don’t believe they are required to legally know who is using their WiFi and no registration is required.

DNS Spoofing: Yes
MiTM SSL: No
Deep Packet Inspection: Yes
Destination IP Transit Interference: No

Websites that are blocked due to sub-content (e.g. reddit.com/r/nsfw) are blocked over HTTP but accessible over SSL. Interestingly thepiratebay.se is reachable over SSL e.g.

curl -k -v https://194.71.107.27 -H 'Host: thepiratebay.se'

Using PAC files such as RoutingPacketsIsNotACrime.uk was hit and miss and requires some more investigation but other bypass options such as SSL, Tor and using an SSH SOCKS5 tunnel all worked without issue.

BT also force Google to downgrade search to a non-ssl version which means others could monitor your search terms.

Breaking down a BT Intercept

When trying to hit reddit.com/r/nsfw this packet capture shows a HTTP 302 is returned rather than the site we’re after.

GET /r/nsfw HTTP/1.1
User-Agent: curl/7.34.0
Accept: */*
Host: reddit.com

HTTP/1.1 302 Found
Location: http://217.41.225.106/redirect/starbucks/index.html

An attempt to reach thepiratebay.se resulted in a forged DNS reply for 193.113.9.167 that simply displays the words “Error – site blocked”

Interestingly as shown in this packet capture, resolving the A record out-of-band and then passing a HTTP request through works fine!

Bonus – EE Hotspot

During my travels between coffee shops I stumbled across an EE hotspot which had a completely different set of filtering as it uses OpenDNS.

DNS Spoofing: Yes
MiTM SSL: No
Deep Packet Inspection: No
Destination IP Transit Interference: No

Much like O2 you are required to register using a phone and EE uses www.picopoint.com to do this.

The filtering is very lax with reddit.com/r/nsfw and the Pirate Bay being allowed through however shock sites like rotten.com resolve to 67.215.65.130 which results in an OpenDNS block page.

Since the filtering is entirely DNS based out-of-band resolution, RoutingPacketsIsNotACrime, Tor and SSH SOCKS5 tunnels all work fine.

I’ve drank far too much coffee today and it’s a shame that public establishments feel it necessary to put censorship technology that performs excessive over-blocking (how is torproject.org sexual?) but at least it is still easy to bypass.

coffeecoffee

image002

The City of London PIPCU attempts to Block Proxies (and fails)

The City of London Police Police Intellectual Property Crime Unit (PIPCU) arrested the operator of immunicity.org “on suspicion of running an ‘umbrella’ website providing access to other websites which have been subject to legal blocking orders.”

So some private entities sued some other private entities to prevent their customers from accessing certain websites. This, as far as I understand it, was a civil matter. How does the City of London Police gain the ability to arrest someone how was not party to either side of the civil matter.

An arrest is the act of depriving a person of his or her liberty usually in relation to the purported investigation or prevention of crime.Wikipedia

Routing packets is NOT A CRIME. What the fuck do they think they are up to?

 

Thankfully http://immunicity.co.uk/ and http://immun.es/ have already launched to help fill the space and more Tor Project relays are spinning up every day but let’s not stop there, if we don’t complain then they will continue to arrest and harass operators of these servers.

I would encourage people to complain to the City of London Police directly by tweeting at @CityPolice, by phone at 020 7601 2222, directly on their website with either this form (Public Complaints) or this form (Expression of Dissatisfaction) or by email; psd_public@cityoflondon.police.uk

If you have time then also make a complaint to the Independent Police Complaints Commission by calling on 0300 020 0096 or via the website: http://www.ipcc.gov.uk/complaints (it probably wouldn’t hurt to tweet @IPCCNews as well).

As always check our Top Ways to Avoid Filters page for the latest information on the best way to avoid Internet filtering be it performed by the state, ISPs, special interest groups or because your current method was illegally shutdown by a police force overstepping the mark.

Update: September – Immunicity,co.uk has shutdown and immun.es is very unreliable.
bg-telesales-signpost

Bypassing EE’s Content Lock system without a credit card or identifying yourself

When you buy a service from EE it will be filtered at their moderate level by default, the other options are Strict and Off.
Strict is designed to be safe for children and Off is for Adults.

Of course even if you were to request that all filtering to be turned off it is still possible that you’ll fall foul of an incorrect IWF filter and be presented with the following page;
ee-illegal

Putting the IWF and their secret blocklists aside there are many reasons you may not want to disclose information to EE or handover a credit card (you might not have one for instance) but still need to get past their filters that will block a female centric “adult” site that blogs about Censorship due to the content of the copy but will quite happily let you visit LiveLeak.com and watch people get killed.

The good news is that the EE Content Lock is quite easy to circumnavigate.

DNS Spoofing: No
MiTM SSL: No
Deep Packet Inspection: Yes
Destination IP Transit Interference: No
-
Unique Reason for Block: No
Categorised Block: No
Ability to report incorrect block: No

The goto advice is always to download Tor as it will not only bypass all filtering but it will also help mask those who need to use Tor to aid in protecting their privacy.

If you aren’t comfortable with installing software such as Tor then you could follow our guide on Creating a SOCKS5 Proxy which also works perfectly.

Finally the EE Content Lock system cannot MiTM SSL so even for blocked URLs such as http://reddit.com/r/nsfw (note that reddit.com isn’t blocked but /r/nsfw is!) can be accessed by using SSL.
Unfortunately reddit relies heavily on Akamai so the SSL certificate will be incorrect and you really shouldn’t get in the habit of accepting incorrect SSL.

Whilst this post proves it is trivial to bypass Government co-erced filtering it is likely that there will soon be a call to make filtering mandatory and criminalising attempts at bypassing them.

The best way to prevent this is to write to your MP and tell them that you don’t believe that any form of filtering has any place on the Internet.

costa_coffee

More Overblocking for reasons of “Sexual Orientation” – This time at Costa Coffee

It didn’t take long for more high profile websites to get overblocked by overzealous filters.

PinkNews.co.uk reported today that it is blocked at Costa Coffee locations due to “Sexual Orientation”.

Yes, we’ve got to protect those kids from the childhood corrupting influence of Gay news.

But don’t worry, in the event that someone then planned on browsing to Stonewall to report what they may feel is an inappropriate block bordering on discrimination they’d find that Stonewall is blocked too.

Things are only going to get worse…

12217_large_neutral-bits

U.K. Government Willing To Block EU Net Neutrality Deal

BuzzFeed has reported that the Government is so intent on continuing to block online material, that it is willing to block the EU Internet Neutrality laws;

We wouldn’t support anything that restricted our ability to block illegal material.

We do not support any proposals that mean we cannot enforce our laws, including blocking child abuse images.Government spokesperson

Note that is no longer just about protecting children, it’s safe to say we’ll start to see the blocking of “extreme” material soon enough…

jquery

Sky Overblocks and takes out JQuery

ThinkBroadband (amongst others) has reported that Sky has yet again overblocked a website.

This time it was code.jquery.com which a lot of other websites rely on to serve the well know Javascript frameworks core files from.

Things like this are bound to happen, were predicted to happen and will continue to happen, causing untold damage to businesses and people.

JQuery was temporary blocked this morning having been misclassified. Our review process kicked in shortly afterwards and the site was unblocked just over an hour later.Sky

nouveau-logo-league-of-legends

League of Legends patches intercepted by DPI / URL Filters

LazyGamer.net has reported that patches being rolled out for League Of Legends has been blocked due to incidental filenames.

If your patcher logs show many lines like this:

RADS::Common::HTTPConnection::GetFile: File not found

And that happens with files with a name similar to this:

VarusExpirationTimer.luaobj

XerathMageChainsExtended.luaobj

The cause is that your provider is blocking any URLs that contain any pornographic content. Apparently that includes cases like this. An other cause are Router protection settings, which may also block the word sex.

If you are experiencing this problem, you can try to get the whole LoL folder zipped from a friend every time you patch, or just call your ISP to lift the blockade.

Edit: This should only happen to people who switch or signup with new ISPs after a certain date (I’m assuming 1st Jan). The filter won’t be on by default to any existing customers, at least it won’t on BT, so most people will be unaffected. If the filter is on, all it takes is a call to your ISP and it’s off. (thanks to /u/mejti )

Edit2: Read this: http://www.huffingtonpost.com/2013/07/29/uk-internet-filter-block-more-than-porn_n_3670771.htmlhttp://www.reddit.com/user/LoLBoompje

What is obviously quite scary about this revelation is that it means that this might not just be a simple URL or DNS based block but could be indicative of the far more intrusive Deep Packet Inspection technology rolled out by China and TalkTalk.

It’s not a long shot to fear that games will start breaking or gamers will get accused of cheating by software such as Steams VAC if ISPs start blocking data (e.g. chat messages or server instructions) that contain naughty words.

Lord-Clement-Jones-_244642k

Lord asks “Shouldn’t Filters (that don’t work) be compulsory?”

On the same day that the BBC reports that “Children can turn off Net Filters” a LibDem Lord has asked whether the choice of filtering should be taken out of parents (read everyone’s) hands and be made compulsory

I also welcome the recognition by the Prime Minister and the Secretary of State for Culture, Media and Sport of the need for adequate filtering to protect young people from online abuse. However, as was discussed in this House only recently with the Online Safety Bill of the noble Baroness, Lady Howe, should we not be making filtering compulsory? Is it enough simply to leave it up to parents to make the choice about appropriate safety features?Lord Clement-Jones

Within weeks of the filters that everyone predicted would herald a slippery slope to mandatory filtering with ever encroaching levels of censorship going online we’ve already started to slide.

Now more than ever you need to start teaching your friends and family how to survive the Claire Perry Internet.