But how are their propaganda farms going to be able to pretend they are in your country now?
They still get to operate don’t worry!!
official companies are still able to use vpn 😏
Exemptions that only apply rules to the common people. Maybe device registration with an exception using ipv6 address
Maybe they don’t actually have all those propaganda farms that the dems were crying about, did that thought cross your mind?
Sadly, but we have. There is a big propaganda campaign have been raised for the last 2 years. It was here before but not in a such huge amount.
Before it was widely reported, Twitter’s geocoding feature showed a ton of Russian-based accounts posing as “Americans” and only discussing politics. Would love to see lemmy be more transparent about accounts posting here too, tbh.
In all honesty, I would expect at least an organized troll farm to use VPNs ending outside Russia.
Random people in Russia might just act directly, but it’s a red flag that’s easy to pretty-inexpensively eliminate.
googles
It sounds like at least the Internet Research Agency troll farm used VPNs.
https://www.bbc.com/news/technology-43093390
According to court documents, the IRA took several measures to hide its tracks, duping the technology companies who were unaware, or unable, to stop what was filtering through their systems.
The key - and obvious - move was to hide the fact that these posts were coming from Russia. For that, the IRA is said to have used several Virtual Private Networks - VPNs - to route their operations through computers in the US. The operatives allegedly used stolen identities to set up PayPal accounts using real American names.
Even if it’s just a hash of an ip4, that would go a long way towards identifying who is coming from where
I’d say you probably want to check my geolocation?
Maybe, but get fucking real.
They exist. Inform yourself on the Internet Research Agency, one of Russia’s state sponsored troll farms. A handful of their activities are well documented in factual records. ‘Dems’ weren’t crying about it, every rational person who doesn’t want foreign interference and disinformation flooding our spaces is concerned about it. This should not be a partisan issue whatsoever.
Yeah, I don’t even really have a problem with RT, as long as it’s labeled so that people understand that it’s the Russian state speaking. But a lot of forums rely more-or-less on the idea that people are more-or-less good faith actors. Very large scale efforts to have people pretend to be someone else and make non-good-faith arguments is something that I think that a lot of our forums can’t today handle well.
Arguably, that’s a technical problem that needs to be fixed in some way.
I am pretty confused by the article.
What I’d expected based on what I’ve seen so far was that the Kremlin would not care what protocols are used, just whether the a given VPN provider was in Russia and whether it provided the government with access to monitor traffic in the VPN.
So, use whatever VPN protocol you want to talk to a VPN provider where we can monitor or block traffic by seeing inside the VPN. You don’t get to talk to any VPN providers for which we can’t do that, like ones outside Russia, and the Russian government will do what it can to detect and block such protocols when they pass somewhere outside of Russia.
But that doesn’t seem to fit with what the article says is happening.
The media in Russia reports that the reason behind this is that the country isn’t banning specific VPNs. Instead, it’s putting restrictions on the protocols these services use.
According to appleinsider.ru, the two protocols that are subject to the restrictions are:
- OpenVPN
- WireGuard
A Russian VPN provider, Terona VPN, confirmed the recent restrictions and said its users are reporting difficulties using the service. It’s now preparing to switch to new protocols that are more resistant to blocking.
I don’t see what blocking those protocols internal to Russia buys the Kremlin – if Terona conformed to Russian rules on state access to the VPN, I don’t see how the Kremlin benefits from blocking them.
And I don’t see why Russia would want to permit through other protocols, though maybe there are just the only protocols that they’ve gotten around to blocking.
EDIT: Okay, maybe Terona doesn’t conform to state rules or something and there is whitelisting of VPN providers in Russia actually happening. Looking at their VK page, it looks like Terona’s top selling point is “VPN access to free internet” and they have a bunch of country flags of countries outside of Russia. So maybe Russia is blocking VPN connectivity at the point that it exits Russia, and it’s affecting Terona users who are trying to use a VPN to access the Internet outside Russia, which would be in line with what I would have expected.
Your edit makes sense, it would be possible to block all VPN traffic but just whitelist traffic from trusted IP addresses (like those in Russia). But I don’t think we have enough info to say for sure that’s what’s happening.
Shadowsocks/ShadowsocksR/vmess/vless/trojan:
Shithole country
Worse: shithole country that turns everything they touch into shit too.
Bootlicking simply comes naturally to the Russian culture.
Edit: my apologies to the Russian brothers and sisters still fighting the good fight by blowing up Putin’s shit.
Racism comes naturally the Anglo brainpan.
Edit: My apologies to my Anglo brothers and sisters still fighting the good fight and blowing up US government property.
1: Russian isn’t a race, I’m actually being jingoist, you damn racist.
2: I’m Suomi/Celt. Slavs and Germanics can all get fucked, ancestrally speaking, you slaving imperialist pigs.
3:That was clearly a joke, go grow some sunflowers.
deleted by creator
I suspect that if things continue in the trajectory that they seem to be heading, that people from Russia who exit may likely be better-off too, as much as moving countries is a significant barrier.
Wouldn’t those be jobs that typically require advanced education? Why would they want to throw that subset of the population into the meat grinder?
deleted by creator
Good read. So it sounds like your analysis of the situation is that it is short sighted and Putin is simply a Megalomaniac attempting to hold onto power, would you say that is an accurate summary? Or is he just crazy and super optimistic that things will change all the sudden one day?
Because even if you kept all the people physically producing bombs and shells, eventually you will run out of the educated people that run the other industries that support the military industrial system in Russia if this goes on for long enough.
So it sounds like your analysis of the situation is that it is short sighted and Putin is simply a Megalomaniac attempting to hold onto power, would you say that is an accurate summary?
Yes, and worse than it appears in what I wrote. What is driving Putin right now is a demented vision of something called Russkiy Mir, or Russian World, wherein Russia reclaims its world glory, not least by reclaiming every square inch of land that was ever Russian. A lot of this comes from his close advisor Aleksandr Dugin’s neo-fascist book Foundations of Geopolitics, and it puts every country surrounding Russia at risk, especially Poland and the Baltic states, because Putin’s publicly acknowledged end goal is to sit as king over all of them in a new, reunified Russian kingdom.
Also, he’s not just running out of educated people, he’s running out of people, period. There are roughly 14 million in Moscow, 4 million in St. Petersburg, and 145 million in Russia total, leaving out Crimea. Again, outside the cities, they are spread out across a vast land mass. By contrast, in the US right now there are over double that, 333 million spread out over the lesser land mass of the southern portion of North America. Not only does he have very few men, he has a huge area for people to hide in, and a significant portion of his own populace that grew up under Soviet rule who are willing to hide anyone they love. Russians run the best black markets in the world, IMO, and now men of conscription age are a part of that. It’s a battle Putin will not win.
It’s also one of the reasons Putin grabbed Crimea, and is now trying to get Ukraine: to literally steal the children. This is not hyperbole, it is fact. Russia is now a failing country. Even if the war were to stop today, Putin’s misuse of his populace to chase his dreams of a pimped up new Russia has ensured that there simply won’t be the population needed to support a thriving economy.
And I won’t go into how poor Russia is because Putin’s entire goal the whole time he has been in ANY public office, including mayor, has been to fleece the people. He stole millions in food aid from hungry Petersburgians in the 1990s and hasn’t stopped since. He and his oligarch cronies are richer than most living people can imagine, and it’s all on the backs of poor Russians. If you’re interested, Alexei Navalny and the Bellingcat folks have done an amazing series of videos about Putin’s theft (turn on English subs) of Russia’s natural resources, to sell them for profit and divert the income through his close circle of cronies.
So yeah. He is a madman. In So. Many. Ways. Like, lay-off-the-crack-pipe-already crazy. I could write about it for hours, lol. Thank you for asking, because it was actually good to think about it as a whole picture for once. I am pleased when anyone wants to learn more about this conflict, because I believe it is going to shape not just the east, but the west for decades to come, no matter how it turns out.
As long as it doesn’t learn to block TOR via snowflake, there’s still hope.
Can someone explain from a technical standpoint how they can block OpenVPN running on port 443? my admittedly limited understanding is that port 443 is the common port for https. If they blocked that port wouldn’t that mean that they would be blocking nearly the entire internet?
From my understanding, they are most likely just blocking the defualt port of wireguard / openvpn and IPs associated with the VPN servers of VPN providers they dont like.
If they wanted to block VPN traffic over 443 to any IP, they would have to do deep packet inspection, which I would imagine is infeasible for Russia.
Supposedly, the Chinese great firewall does use deep packet inspection, so it is possible to do this at the country level.
They specifically mention it’s on the protocol level which would imply it’s doing more than just blocking some ports. Not sure why you’d think China could pull that off but it would be infeasible for Russia?
I don’t know what they actually do but one possibly is to look for (absence of) the TLS handshake. Or maybe they simply infect all devices on the Chinese market with MITM certificates to be able to decrypt all TLS encrypted traffic. Should be easy to force companies to do that in such a country.
The port isn’t their focus, they’re looking at the protocol that is being used, regardless of the port. The protocol is still visible when not doing deep packet inspection. That’s why there suggesting a socks proxy for Russian citizens, because that uses HTTPS to tunnel traffic, so it wouldn’t be caught up in protocol analysis.
can you maybe link some ressources on how the protocol used can be detected? i did not know about this and would like to read into it some more :)
Look up NBAR for the basic idea. Each vendor has their own ‘secret sauce’ implementation, Palo Alto only needs 9 bytes of payload for disambiguation, iirc.
thank you! so it is basically looking at identifiable patterns in the packet flow and matching them to protocols. i also found this paper about traffic identification interesting.
Time to up the spoofing game. Maybe some AI-generated traffic to throw off the packet analytics.
You can analyze the traffic, detect common patterns and also detect source of the request. Russian IT specialists are now using very complex solutions to come around the block which work a lot like MITM attacks.
However will they get messages through??
It was not working 2 day on mobile operators, now waiting full shutdown
yup. kinda same experience. tele2. complete shutdown on my vpn.
Shadowsocks worked fine
Shadowsocks is very difficult to block. What provider do you use for shadowsocks?
Is this just address/port blocking, or DPI of some kind? I’m wondering what they can trigger off?
Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
vpn traffic isnt directly hidden, but it can be helped along.
youd need to encapsulate your vpn traffic in a different protocol, make sure you shape your traffic to expected values for that protocol and then avoid known vpn endpoints.
OpenVPN + obfs4proxy should still work. I’ve been using it in China for some time along with a VPN client on Android & windows that support obfs3.
deleted by creator
There’s still headers and it’s fairly trivial to block using packet analysis. Using other protocols such as SSH tunneling may work (until they try to ban that I suppose). There’s always way around these kind of blocks, it’s a cat and mouse game.
SSL is a higher layer thing, isn’t it? A VPN is just encapsulating an IP packet in another IP packet and getting it to the tunnel endpoint. Unless the whole of the inner IP packet is encrypted, the service provider could just sniff your packets and block anything that looks like an IP packet in the outer packet payload?
Unless the whole of the inner IP packet is encrypted,
It is, because they’re inside an encrypted stream of data.
The way OpenVPN works is this:
-
OpenVPN establishes a TLS connection to the OpenVPN server.
-
Your computer’s kernel generates an IP packet.
-
OpenVPN sucks that up, shoves it into the TLS connection. That connection is encrypted, so the network provider cannot see inside it, know whether the data is IP packets or anything else, though I suppose maybe traffic analysis might let one classify a connection as probably being a VPN.
-
The data in that connection is broken up into IP packets, went to the OpenVPN server.
-
The OpenVPN server decrypts the data in the TLS stream, pulls the original IP packets out.
So the original packets are always encrypted when the network sees them. Only the OpenVPN server can see the unencrypted packet you originally sent.
What @raltoid is saying sounds plausible, though I can’t confirm it myself off-the-cuff – that OpenVPN is detected by looking at somehing unique in the initial handshake.
VPN detection is simple: track new encrypted connections outside of Russia, connect to the same server, check if it replies as a VPN server. If it does, block the shit out of it. No need for packet inspection or any voodoo.
Fair enough. I mean, there are ways around that too, like some port knocking scheme, but I assume that this shadowsocks thing solves the same problem in a better way.
But I do stand by what I was responding to on, the bit about the internal IP packets being encrypted and not readable.
-
Is OpenVPN not just SSL traffic?
It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.
A way around this would be to run an SSLVPN with a landing page where you log in instead of using an IPSec VPN or a dedicated SSLVPN client.
Another way around it would be to create a reverse SSH tunnel on a VM/VPC in another country/state and send all your traffic through that.
Is OpenVPN not just SSL traffic?
It’s not, it’s an IPSec VPN by default which runs over UDP. You can run it via TCP and it operates over the same port as HTTPS (443), but it’s not the same protocol and can be differentiated that way.
I think that either I’m misunderstanding what you’re aiming to say, or that this is incorrect.
OpenVPN can run over UDP or TCP, but it’s not IPSec, not even when running over UDP. IPSec is an entirely separate protocol.
It’s a custom protocol that uses SSL/TLS for key exchange and such, so it can be detected. It’s actually causing huge problems for many large Russian companies, as it’s common to use those protocols for remote access, work, etc.
As mentioned in the article you need something like “Shadowsocks” to avoid protocl blocking, since it fully disguises the traffic as standard SSL/TLS. Which was created for, and is still used to circumvent this type of blocking in “the great firewall of china”.
https://security.stackexchange.com/questions/187649/is-it-possible-to-detect-vpn-in-the-network
tl;dr: You can infer that OpenVPN is used from the key exchange somehow.
Yes there is a difference between https traffic.
Blocking all encrypted traffic… fantastic suggestion comrade, I’ll forward this on to the Kremlin. Also, you’ve been drafted.
I suppose with “comrade” you are hinting at Soviet customs, but Russia isn’t the USSR and couldn’t be further from being socialist
deleted by creator
Settle down, it was a joke
what
Russia isn’t the USSR but it is heading towards the USSR ways, and it’s already there in many aspects. It’s not just on a technical definition, a lot of pro-war and nationalist rhetoric is rooted in the old USSR culture.
The USSR wasn’t socialist, it was communist. And yes I know, it wasn’t real communism because real communism is a utopia.
Oh please. In all the ways that matter, it is identical.
Can this actually work? If you run Wireguard on a non-default port, is it possible to tell that it’s wireguard?
Yes ofc they can. The Wireguard protocol is not designed to be hidden.
Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
Chinese firewall can detect it, AFAIK
Wireguard through gfw worked fine when I tried it. The other client did have a static IP and static Port tho, that probably helped
Gfw is mostly picky about anything udp or where both ports are unknown. Also if the known port (server) isn’t from a licensed block.
Basically there are heuristics that lead to either a reset, a temp block, or a perm block, but it seems to vary from time to time a lot.
Most open source vpn protocols, afaik, do not obfuscate what they are, because they’re not designed to work in the presence of a hostile operator. They only encrypt the user data. That is, they will carry information in their header that they are such and such vpn protocol, but the data payload will be encrypted.
You can open up wireshark and see for yourself. Wireshark can very easily recognize and even filter wireguard packets regardless of port number. I’ve used it to debug my firewall setups.
In the past when I needed a VPN in such a situation, I had to resort to a paid option where the VPN provider had their own protocol which did try to obfuscate the nature of the protocol.
Is it possible to bypass this block? Say, embedding VPN packets within a different protocol?
I’ve had success wrapping OpenVPN (TCP) in stunnel on networks that have done similar things.
I don’t know why some moron downvoted you, but the answer is maybe. For reference, I have always bypassed SSH firewall blocking by sneaking SSH packets within https.
The only way this won’t be possible is if the government enforces installing a certificate to use the internet, so that they can do a man-in-the-middle-attack. I heard this is already being done in Afghanistan.
So sad. More and more we are seeing a world were the powers that be can do anything they want but if you do it it’s (rightfully) malware and illegal.
The vast majority of popular apps and OSes are spyware by any reasonable definition of the term.
I remember, back in the late 1990s, if I have the time right, when RealPlayer phoned home to check for updates, and there was enormous uproar over the privacy implications.
Things sure have changed since then.
For simple web browsing or streaming over https you can use a socks proxy.
For full VPN function you could try something like IPSec or L2TP, as they’re not listed in the protocols Russia is targeting.
using a vpn is also illegal in russia since 2017 😅
Using is not illegal
if you want to use it in its original purpose it’s illegal. If you use a vpn not registered with Roskomnadzor, it’s illegal because you can access stuff that putin does not want you to see.
therefore using a vpn with its normal purpose to create your private tunnel and access what you want is in fact illegal in russia.
Illegal to show how bypass bans, it is allowed to use VPNs
This is not accurate information. VPN usage is not banned.
But also laws don’t really matter in Russia.
well 😅
I’d appreciate a source for that statement. :o
In November 2017, the Russian government passed a law banning the use of VPNs, Tor, and proxies to access unauthorized content. Since that time, it has been used to restrict specific VPN services.
The ban targets VPN providers who refuse to submit data to the Russian government. The threat of bans came in 2019. Two waves of bans followed in 2021, covering 15 VPNs. Only one Russia-based provider is known to have complied with the rules.
https://surfshark.com/blog/vpn-in-russia
https://www.reuters.com/article/us-russia-internet-idUSKBN1AF0QI
IIRC Pakistan also do this (vpn is blocked by default and you’ll need to submit documentation to justify using VPN if you want to use VPN in your company), though their main reason is to reduce VoIP spammers.
It has got to be better to just make phone authentication better than to hope that nobody in the country is going to spam and then block VPNs to the outside.
This has nothing to do with phone security though. Pakistan is the source of spam calls in many developed nations. Those spam call center operators was able to operate on the cheap from Pakistan due to cheap labors and cheap access to international calls via VoIP, so by blocking unregistered VoIP and VPN, they hoped to kill the spam call center industries (or at least that’s what they tell people when they started cracking on vpn a few years ago, might be legitimate if they’re getting pressure from western goverments to control the spam situation). This will also increase tax revenue because legitimate call centers will have to use licensed VoIP services that pay tax to Pakistan government.
Oh, okay, I gotcha. I figured that it was the other way around, that people spamming from outside Pakistan were targeting people inside.
I see! So, to quote the sources you provided:
“Despite widespread speculation, the law does not directly ban the operation of VPNs and anonymisers. However, it does restrict access to banned websites with the help of these tools.”
I.e. the VPN providers themselves are not illegal, though the VPN providers technically have to not allow users to access content listed by rospotrebnadzor. That’s responsibility on the side of the providers, not a ban on use. Practically speaking it still is attempting to censor content, but neither of the three sources claim that VPN use is illegal in Russia.
You can argue as much as you want, but the full usage of a vpn is illegal in russia by law, because you could access real informations instead of their bullshit propaganda.
Yes you can install it freely and “use” it to a certain degree to browse on pages uncle Putin allows you, but you can’t use it completely without any restrictions, e.g the definition of real usage in my opinion. So in my understanding the (full) usage of a vpn is prohibited by law in russia.
And they are now actively blocking protocols…so 🤷♂️
Don’t get me wrong, I think those restrictions are horrible and Putin is a tyrant, but it’s irresponsible to say that VPNs are illegal. They are not. People should use them to access alternative media like Meduza instead of accepting that there’s only state media. VPNs are still incredibly useful and we shouldn’t play into the scare tactics of the Russian government by insinuating that you can end up in jail by using VPNs. I think that’s coming, too, but these tools are still available to get around lots of the censorship. As you yourself noted, most of the VPN providers aren’t actually complying with the law, so you can access way more material, without current legal repercussions to the individual, at least based on the sources you provided.
This has been happening intermittently since 2012 or something.
Not wg, cause it wasn’t popular then.
HTTP\HTTPS tunneling etc are not that hard, ya knaw.
Or encrypted GRE, ffs.
