full-disclosure - Re: Gmail and China's GFW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c7b78144c3eca8490b20c113e03546b4.squirrel@gameframe.net>
Date: Tue, 22 Mar 2011 01:53:57 +0200
From: nix@...roxylists.com
To: nix@...roxylists.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Gmail and China's GFW

>> Gmail can be blocked by simply blocking Google's SSL certificate(s).
>>
>> When you visit Gmail, Google sends your browser its SSL Server
>> Certificate. Without this certificate, no connection can be made.
>>
>> For example, running the following command, then browsing to
>> <https://mail.google.com/>, will produce the following output:
>>
>> $ sudo ngrep -d eth0 -x 'Google Inc'
>> ...
>>   47 6f 6f 67 6c 65 20 49    6e 63 31 18 30 16 06 03    Google Inc1.0...
>>   55 04 03 14 0f 6d 61 69    6c 2e 67 6f 6f 67 6c 65    U....mail.google
>>   2e 63 6f 6d 30 81 9f 30    0d 06 09 2a 86 48 86 f7    .com0..0...*.H..
>> ...
>>
>> This output shows part of Google's ASN.1 encoded X.509 certificate.
>>
>> Therefore, the following Linux firewall commands will stop any
>> connection to Gmail:
>>
>> $ sudo iptables -I INPUT -m string --algo bm --hex-string
>> '|476f6f676c6520496e63311830160603550403140f6d61696c2e676f6f676c652e636f6d30819f30|'
>> -j DROP
>>
>> Try it, you will get a connection timeout:
>>
>> $ curl --connect-timeout 60 https://mail.google.com/
>> curl: (28) SSL connection timeout
>>
>> The same applies for Twitter, Facebook... Much more efficient than
>> DNS/IP blocking!
>>
>
> Thanks for the information. I was not actually aware of that you can block
> with iptables using hex strings. Very nice.
>

Forgot to say, in terms of performance. It's better to use -j REJECT
instead of DROP (then no timeout is caused and the connection is rejected
with ICMP destination unreachable.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/