\documentclass{beamer}
%\documentclass[ignorenonframetext,handout]{beamer}
%\usepackage{pgfpages}
%\pgfpagesuselayout{2 on 1}[a4paper,border shrink=5mm]

\usetheme{Afnic}
\usepackage[english]{babel}
\usepackage[utf8x]{inputenc}
\usepackage{bortzmeyer-utils}
\setlength{\parskip}{\baselineskip} 

\title{Hijacking through routing in Turkey}
\author{Stéphane Bortzmeyer\\\texttt{bortzmeyer@nic.fr}}
\date{RIPE 68, DNS working group, 14 may 2014}

\begin{document}

\maketitle

\begin{frame}
% TODO empty on purpose  
\end{frame}

\begin{frame}
\frametitle{Context}
\only<1-2>{Criticisms against the turkish government on Twitter and YouTube\ldots}

\only<2-3>{\ldots First, the government requests IAPs to censor, through
  lying DNS resolvers, sending false results for \computer{twitter.com} (21 march)\ldots}

\only<3>{\ldots Users switch to other resolvers, such as Google
  Public DNS\ldots
\includegraphics[scale=0.4]{turkey-google-dns.jpg}}

\end{frame}

\begin{frame}
\frametitle{Context - 2}
\ldots Governement blocks some of the alternative resolvers,
  breaking Internet access for their users (25 march)\ldots

\end{frame}

\begin{frame}
\frametitle{Facts}
Turkish IAPs inject routes (29 march) for the important public resolvers
(\computer{8.8.8.8/32})\ldots
  
\only<2->{\ldots An actual DNS server listens on these addresses (like
  \computer{8.8.8.8}). It lies about \computer{twitter.com} and
  \computer{youtube.com}, to send users to \computer{195.175.254.2}\ldots}

\only<3->{\emph{It is no longer ``simple'' censorship, it is now
    hijacking by the State.}}

\end{frame}

\begin{frame}
\frametitle{Aftermath}
\begin{enumerate}
\item Lying apparently stopped (4 april)
\item Hijacking apparently stopped (7 april)
\end{enumerate}
\end{frame}

\begin{frame}
  \frametitle{Proofs}
  \begin{enumerate}
  \item (No NSID or \computer{hostname.bind} for Google Public DNS but
    they are easy to forge, anyway)
  \item Turk Telecom's Looking Glass,
  \item DNS requests from RIPE Atlas probes (when the probe is
    connected to a network which is tunneled outside, the problem disappears),
  \item DNS requests by human users in Turkey,
  \item Traceroutes,
  \item Latency to \computer{8.8.8.8}, measured by Atlas probes and
    Renesys probes (unlike many other things, like traceroute, latency
    is hard to fake). % TODO: include image from RIPE?
  \end{enumerate}
\end{frame}

\begin{frame}
\frametitle{Solutions}  
DNSSEC would help if done properly (validation on the user's own
machine) and if \computer{twitter.com} were signed.

\ldots Authentication of the resolver (with TSIG, SIG(0) or DNScrypt - like OpenDNS does) would help (the security of a very long ``last mile'')\ldots

\ldots RPKI would not help: hijacking was internal, inside the IGP. No routing security solution here\ldots

\ldots Detecting the lie is one thing, working around it is another issue\ldots
\end{frame}

\begin{frame}
\frametitle{For the regular user}
\begin{enumerate}
\item Switch to another public resolver (many were not blocked),
\item Local DNS resolver (port 53 was not blindly blocked),
\item tunnels, Tor\ldots
\end{enumerate}

\end{frame}

\begin{frame}
\frametitle{References}  
\begin{itemize}
\item
  \url{http://www.renesys.com/2014/03/turkish-internet-censorship/}
\item
  \url{https://labs.ripe.net/Members/emileaben/a-ripe-atlas-view-of-internet-meddling-in-turkey}
\item \url{http://www.bgpmon.net/turkey-hijacking-ip-addresses-for-popular-global-dns-providers/}
\item \url{http://www.bortzmeyer.org/dns-routing-hijack-turkey.html}
\item \url{http://www.afnic.fr/medias/documents/conseilscientifique/SC-consequences-of-DNS-based-Internet-filtering.pdf}
\item \url{http://www.internetsociety.org/deploy360/blog/2014/04/turkish-hijacking-of-dns-providers-shows-clear-need-for-deploying-bgp-and-dns-security/}
\end{itemize}
\end{frame}

\end{document}

