full-disclosure - Iran is doing ip-and-port filtering of SSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPdaGT7kouwfwBniD6nzEOAdyXme3-SV=1KyqEonX=UHuwWaqg@mail.gmail.com>
Date: Wed, 8 Feb 2012 19:54:25 -0500
From: Sai <sai@...zai.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Iran is doing ip-and-port filtering of SSL

I have pretty definitive proof that Iran is doing ip-and-port based
filtering of SSL.

Filtering is being done by 217.218.154.250 after a hop through
217.219.96.120 / 217.219.96.132. This hop is after my source's ISP,
and all three IPs are owned by ITC, Iran's central telco.

Filtering targets all google.com IPs, some but not all torproject.org
IPs, probably more. Haven't attempted a broad scan. It's a simple
connection drop; filtered connections just time out.

It is not based on SSL handshake signature; testing SSL on nonstandard
ports worked successfully, and testing non-SSL on :443 of target IPs
was blocked.

I'm not sharing screencaps in order to protect my source, but tests
included TCP traceroutes on different IP/port combinations and some
simple use of curl.

Cheers,
Sai

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/