Several ISPs in Turkey are hijacking traffic to a Google service that until Saturday offered locals a way around the government’s blockade on Twitter and YouTube.
Google on Saturday confirmed that its public domain name system (DNS) service was being intercepted by “most” Turkish ISPs. Until then, the service had been a popular way to bypass Turkey's Twitter and YouTube blockade beginning last week after an order from Turkey’s President, Recep Tayyip Erdoğan.
“Turkish ISPs have set up servers that masquerade as Google’s DNS service,” Google announced on its online security blog.
Google’s DNS resolver provides users an alternative internet “phone book” to one that, for most internet users, is provided by ISPs. The problem with relying on a local ISP’s DNS resolver is that governments can order ISPs to alter that phone book to serve up false IP addresses for blacklisted sites.
That's what Turkey's ISPs appear to have done. Following the initial blockade on Twitter someone in Turkey spray-painted the Google DNS service’s IPv4 addresses — 8.8.8.8 and 8.8.4.4 — on a public wall, suggesting it as a way to bypass the ban.
Other IP addresses that could be used to bypass the blockade were BGPMon’s OpenDNS address 208.67.222.222 and Level 3’s addresses 4.2.2.1 and 4.2.2.2.
People looking to get around the blockade could change their devices’ DNS settings to those services to avoid local operators, under government instruction, providing them with incorrect IP addresses for the banned sites.
While Turkish ISPs are the behind the DNS service intercept, it would appear they're doing it against their own business interests.
“The government did not instruct [Turkish ISPs] to block Google or Level 3 DNS servers… The government told them to block Twitter and then YouTube. The providers are seemingly trying to implement the ban in small incremental steps that still satisfy the letter of the law,” wrote Emil Zmijewski, VP and general manager of network intelligence provider Rensys.
According to BGPMon’s founder, Andree Toonk, the fake DNS servers that Turkish ISPs are using to intercept their traffic appear to have been designed in a way lets them comply with the Turkish government’s blockade without breaking internet connectivity for Turkish users.
“Instead of null routing this IP address [Turk Telekom] brought up servers with the IP addresses of the hijacked DNS servers and are now pretending to be these DNS servers,” Toonk explained.
“These new fake servers are receiving traffic for 8.8.8.8 and other popular DNS providers and are answering DNS queries for the incoming DNS requests. One of the possible reasons for impersonating these DNS providers instead of just null routing traffic to these DNS providers is that they did not want to break Internet connectivity for the significant number of Turkish users that are using these popular DNS servers.”
According to Toonk, the fake Google DNS server on 8.8.8.8 returns the IP address 195.175.254.2.
“This IP is a machine on Turk Telekom and not a real Youtube server. Interestingly the returned IP is the same IP address where we’ve seen Twitter.com traffic for users in Turkey redirected to since last week.”
Reneys’ Zmijewski also confirmed the server in question was returning the same IP address for users in Turkey attempting to access YouTube.
“Now when Turkish users seemingly ask a Google DNS server for YouTube’s address, they get the IP address of a Turkish government site (195.175.254.2), explaining the ban,” said Zmijewski.
This article is brought to you by Enex TestLab, content directors for CSO Australia.