<div dir="ltr">Hi,<div><br></div><div>I recommend this article (well translation from French to English), there are more technical details:</div><div><a href="http://serendipity.ruwenzori.net/index.php/2010/03/26/dns-spoofing-in-china-by-stephane-bortzmeyer">http://serendipity.ruwenzori.net/index.php/2010/03/26/dns-spoofing-in-china-by-stephane-bortzmeyer</a></div>
<div><br></div><div>Rafik<br><br><div class="gmail_quote">2010/4/3 Brenden Kuerbis <span dir="ltr"><<a href="mailto:bkuerbis@internetgovernance.org">bkuerbis@internetgovernance.org</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Robin,<br><br>Renesys has done the best write up of the incident:<br><br><a href="http://www.renesys.com/blog/2010/03/fouling-the-global-nest.shtml" target="_blank">http://www.renesys.com/blog/2010/03/fouling-the-global-nest.shtml</a><br>
<br>For me, the takeaway is that root server operators could choose to not locate root server instances in countries with govt's that censor the DNS. Similarly, ISPs could choose not to access root server instances through providers that are under govt pressure to censor the DNS. Both scenarios might help prevent "leakage" of DNS censorship (but not eliminate it), and would probably diminish DNS availability for Internet users in censoring countries. <br>
<br>A tough call for root operators/ISPs, and I think in many ways similar to what Google considered over the past year. In any case, I think it should be clear here that the real problem is the government's censorship policy.<br>
<br>I'd like to hear what others think.<br><font color="#888888"><br clear="all"><br>Brenden</font><div><div></div><div class="h5"><br>
<br><br><div class="gmail_quote">On Mon, Mar 29, 2010 at 1:21 AM, Robin Gross <span dir="ltr"><<a href="mailto:robin@ipjustice.org" target="_blank">robin@ipjustice.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left:1px solid rgb(204, 204, 204);margin:0pt 0pt 0pt 0.8ex;padding-left:1ex">
<div style="word-wrap:break-word">
<div>I'd like to learn more about the implications for censorship in this recent episode with the Chinese root server and NIC server in Chile. Any DNS experts provide any guidance?</div><div><br></div><div>Thanks,</div>
<div>Robin</div><div><br></div><a href="http://www.itworld.com/networking/102576/after-dns-problem-chinese-root-server-shut-down" target="_blank">http://www.itworld.com/networking/102576/after-dns-problem-chinese-root-server-shut-down</a><div>
<br><div style="margin:0px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:24px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="6">After DNS problem, Chinese root server is shut down</font></div>
<p style="margin:0px 0px 10px;line-height:19px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:14px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4"><b>The server is thought to have extended Chinese filtering technology to Chile and the US</b></font></p>
<div style="margin:0px;line-height:22px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:12px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="3">by <font style="color:rgb(242, 95, 58)" color="#f25f3a"><a href="http://www.itworld.com/node/510" target="_blank">Robert McMillan</a></font></font></div>
<div style="margin:0px;line-height:16px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:12px;line-height:normal;font-size-adjust:none;font-stretch:normal;color:rgb(164, 164, 164)" color="#a4a4a4" face="Arial" size="3"><b>March 26, 2010, 08:10 PM — </b></font><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:12px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="3">IDG News Service — </font></div>
<p style="margin:0px 0px 10px;font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal;min-height:15px"><br>
</p><p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">A China-based root DNS server associated with networking problems in Chile and the U.S. has been disconnected from the Internet.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">The action by the server's operator, Netnod, appears to have resolved a problem that was causing some Internet sites to be inadvertently censored by a system set up in the People's Republic of China.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">On Wednesday, operators at NIC Chile noticed that several ISPs (Internet service providers) were providing faulty DNS information, apparently derived from China. China uses the DNS system to enforce Internet censorship on its so-called Great Firewall of China, and the ISPs were using this incorrect DNS information.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">That meant that users of the network trying to visit Facebook, Twitter and YouTube were directed to Chinese computers instead.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">In Chile, ISPs VTR, Telmex and several others -- all of them customers of upstream provider Global Crossing -- were affected, NIC Chile said in a <a href="http://blogs.csoonline.com/1179/chile_nic_explains_great_firewall_incident" target="_blank"><font style="color:rgb(242, 95, 58)" color="#f25f3a">statement</font></a> on Friday. The problem, first publicly reported on Wednesday, appears to have persisted for a few days before it was made public, the statement says.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">A NIC Chile server in California was also hit with the problem, NIC Chile said. While it's not clear how this server was getting the bad DNS information, it came via either Network Solutions or Equinix, according to NIC Chile.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">Network Solutions wasn't to blame as it does not offer backbone provider services to NIC Chile, said Rick Wilhelm, the company's vice president of engineering. Equinix and Global Crossing could not immediately be reached for comment.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">Netnod, which maintains a copy of its root DNS server in China, has now "withdrawn route announcements" made by the server, according to company CEO Kurt Lindqvist. This effectively disconnects the server from the Internet. In an e-mail interview, Lindqvist said he could not recall when his company took this action.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font style="font-family:Arial;font-style:normal;font-variant:normal;font-weight:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-stretch:normal" face="Arial" size="4">Netnod insists that its server did not contain the bad data that redirected Internet traffic, and security experts agree, saying that its data was probably being altered by the Chinese government somewhere on China's network, in order to enforce the country's Great Firewall.</font></p>
<p style="margin:0px 0px 10px;line-height:18px"><font face="Arial" size="3"><span style="font-size:13px;line-height:normal"><br></span></font></p><p style="margin:0px 0px 10px;line-height:18px"><font face="Arial" size="3"><span style="font-size:13px;line-height:normal"><br>
</span></font></p><div> <span style="font-size:12px"><div><br><br></div><div><br></div><div>IP JUSTICE</div><div>Robin Gross, Executive Director</div><div>1192 Haight Street, San Francisco, CA 94117 USA</div><div>p: +1-415-553-6261 f: +1-415-462-6451</div>
<div>w: <a href="http://www.ipjustice.org" target="_blank">http://www.ipjustice.org</a> e: <a href="mailto:robin@ipjustice.org" target="_blank">robin@ipjustice.org</a></div><br></span><br> </div><br></div></div></blockquote>
</div><br>
</div></div></blockquote></div><br></div></div>