{"id":3751,"date":"2022-07-13T21:38:41","date_gmt":"2022-07-13T21:38:41","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=3751"},"modified":"2022-09-14T12:59:35","modified_gmt":"2022-09-14T12:59:35","slug":"network-monitor-june-2022","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2022\/07\/13\/network-monitor-june-2022\/","title":{"rendered":"Network Monitor: Iran Attacks Circumvention Tools, Encryption and Hijacked DNS in Favor of Children’s Internet"},"content":{"rendered":"

In June, authorities set their sights on sabotaging internationally provided circumvention tools while starting\u00a0 to introduce their own government sanctioned VPNs and internet censorship measures for children. In this context, Iranians experienced less intense, more sporadic, and shorter internet disruptions than they did in May<\/a>.<\/p>\n

Circumvention Tools Disruptions<\/h1>\n

Starting in mid-June, the Filterwatch team observed disruptions targeting circumvention tools. Specifically, from June 16-25, the Telecommunication Infrastructure Company<\/a> (TIC) aggressively targeted the encryption protocols used by circumvention tools such as Psiphon<\/a> and Google Outline.<\/p>\n

\"Screenshot
Loading...<\/figcaption><\/figure>\n

On June 29, the head of the Information and Public Relations Center of the Information and Communications Technology (ICT) Ministry announced that their intention was not to disrupt internet access but to prevent the \u201cillegal sale of VPNs.\u201d<\/p>\n

\u201cWe've observed a significant portion of the protests [against internet disruption]. A group of companies that sell illegal VPNs believe that the internet has been intentionally disrupted. We are not required to cover illegal group work and let them do illegal work,\u201d said<\/a> Mehdi Salem, head of the Information and Public Relations Center of the ICT ministry in a June 29 interview.<\/p>\n

Curiously, these disruptions come as the government tries to launch a legal<\/a> VPN<\/a> project. For years, authorities have been promising to roll out state-sanctioned VPNs that could enable \u201cqualified individuals\u201d access to otherwise blocked content. These VPNs would basically give different users varying levels of access to online content based on factors such as their\u00a0 profession, gender, and age. Moreover, these VPNs are very likely to bolster the state\u2019s information control and surveillance capabilities.<\/p>\n

Authorities could be disrupting circumvention tools in a bid to promote legal VPNs. It is unclear, however, if the aim was to deliberately target the encryption protocols of these circumvention tools or if authorities are cracking down on encryption protocols more broadly and targeting multiple platforms.For example, the recent disruptions impacted Whatsapp, making it temporarily inaccessible in Iran.<\/p>\n

\"Screenshot
Loading...<\/figcaption><\/figure>\n

Disruption on Encrypted Internet Traffic<\/h1>\n

At the same time Iranian authorities are preparing to roll out the legal VPN project, they are also getting set to introduce an internet for children. The plan, introduced by a resolution<\/a> of the Supreme Council of Cyberspace (SCC), aims to create SIM cards that provide curated access to content based on age and gender.<\/p>\n

\u201cCreating a restricted, safe, healthy and useful dedicated network for children and teenagers and increasing the traffic of useful content, specific to the age groups of children and teenagers, to fifteen percent of the traffic of the whole country.\u201d -Article 2-2-3-6 of The Master Plan And Architecture Of The National Information Network.<\/i><\/p><\/blockquote>\n

In May<\/a>, Filterwatch had access to a sample of children's internet on MCI<\/a> network, one of Iran\u2019s largest mobile operators. In this sample, if you try to go to google.com, you would automatically be redirected to https:\/\/boomino.ir<\/a> which is a platform full of local services, including a search engine, developed by MCI<\/a>.<\/p>\n

This example provides us with\u00a0 an alternate explanation on why Iran is trying to disturb encrypted internet traffic, such as those traveling through Pisphone and Google Outline. In order to implement a scenario like redirecting google.com authorities need to interfere with encrypted internet traffic. In other words, a request made to a website with a SSL\/TLS\u00a0 certificate, which proves an encrypted connection and makes traffic encrypted cannot, as a technical matter, be redirected unless the encryption is interfered with. As long as encryption is working, you cannot redirect from https:\/\/google.com<\/a> to https:\/\/boomino.ir<\/a>.<\/p>\n

It is, however, not clear to FilterWatch whether the end goal has been to attack circumvention tools or encrypted communication more broadly. A source under condition of anonymity has told FilterWatch that the long-term plan in Iran is to redirect all Google requests to something similar to https:\/\/boomino.ir<\/a>.<\/p>\n

DNS Hijacking<\/h1>\n

As Filterwatch was writing this June Network Monitor, we predicted that in the coming days and months, as Iran approaches the launch of the children's internet, we will see more disruptions on encryption protocols and probably DNS.<\/p>\n

On July 12, as we were finalizing this report, Iran\u2019s Telecommunication Infrastructure Company (TIC)<\/a> started to implement DNS hijacking to force Iranian users to use Google SafeSearch<\/a> instead of the regular Google search engine. Google<\/a> SafeSearch is a feature designed, in part, for children that excludes explicit content from search results. SafeSearch was on for almost the entire internet users base in Iran with the exception of users of the Rightel<\/a> service provider. It\u2019s not clear why Rightel is an exception.<\/p>\n

\"Screenshot
Loading...<\/figcaption><\/figure>\n

Network Outages<\/h1>\n

After at least 26 days of <\/a>nationwide throttling and mobile data shutdowns across Iran in May, during the month of June Iranians experienced less intense, sporadic, and short-term internet disruptions as street protests died down.<\/p>\n

The bulk of internet disruptions impacted Kerman, Ardabil, Qazvin, Fars, and Zanjan provinces. Users in Kerman, Ardabil, Fars, and Zanjan provinces faced prolonged outages lasting several days as the graphs below demonstrate. Qazvin users experienced several short-term outages in the middle of June. No outages were reported for Chahar Mahall and Bakhtiari, Lorestan, Kermanshah, or Markazi provinces.<\/p>\n

Outages in the Kerman province that began in late June are ongoing, leaving Iranians cut-off from the global internet since the end of June; users of certain internet service providers have similarly been cut off from the global internet for much of June. In one case, the Internet Service Provider Dadehgostar experienced an outage which impacted their network of users since June 3rd.<\/p>\n

Regional Disruptions<\/h1>\n

NOTE:\u00a0 In some cases the available data allows FilterWatch to determine if the disruption is a type of shutdown of access or throttling (i.e., a dramatic slowing of connection speeds). In other cases we can just observe a disruption or outage of some kind without more specificity. <\/i>Overall we\u00a0 still existing tools are not able to always accurately identify and fully examine the nature and scale of disruptions to Iran\u2019s domestic internet connection.\u00a0<\/i><\/p>\n

Timeline of internet shutdowns, throttling, and disruptions based on regions and cites.<\/p>\n