3

A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that the certificate is untrusted and you must have to trust or install those certificates manually.

In short, you use gov-t issued certificates to encrypt your traffic which is then decrypted again on ISP level to be then encrypted again by the original (valid) certificates before being sent to the websites you access. Which basically means ISPs can do whatever they want with your data as if you were using HTTP all along.

AFAIK, one solution would be using a trusted VPN service. However this drastically worsens the usage experience and essentially makes you trust to the VPN Provider (which majority don't care to check).

So my question is: if I were to change my DNS to say, 1.1.1.1 by Cloudflare, will it prevent my ISP from acting as a middle-man?

Edit: if it won't help, what can I do to protect my privacy?

Improve this question
5
  • 2
    It depends on how the ISP does the filtering. One way of filtering traffic is to return bogus DNS answers, and redirect traffic that way. But probably they redirect packets, and do not rely on DNS for this.
    – vidarlo
    Jul 20, 2019 at 16:51
  • Do you need to cover your DNS traffic or your HTTP traffic?
    – Mukesh Sai Kumar
    Jul 20, 2019 at 17:20
  • I want to workaround using their certificates over HTTPS.
    – qarbyz
    Jul 20, 2019 at 17:53
  • Don't you think that IP addresses can be redirected too? If the client (DoH or DoT for that matter) does not check the remote end certificate (and obviously blacklist some generic CAs known to have been added just to do MITM attacks), then it can exchange securely because of encryption... but with an unknown endpoint that can as well lie to it in any way it wants.
    – Patrick Mevzek
    Jul 22, 2019 at 18:25
  • As for VPNs you might be interested by this: computerweekly.com/news/252466203/… "Nearly a third of top VPNs are secretly owned by Chinese companies, while other owners are based in countries with weak or no privacy laws, potentially putting users at risk, security researchers warn"
    – Patrick Mevzek
    Jul 22, 2019 at 18:26

2 Answers 2

Reset to default
5

Does changing DNS help prevent MITM on ISP level?

In short: very likely just changing the DNS server will not help.

There are several technologies an ISP might use in order to redirect or MITM the traffic of a customer:

  • ISP provided DNS server returns a different IP address
    This relies on the fact that most users will use the DNS server of the ISP. This is usually used for blacklisting specific sites and is a cheap option to do this. It does not work well for large-scale (all-domain) MITM since it somehow must return a different ISP-owned IP address for each domain or hope that their is a clear-text hostname in the TLS ClientHello (i.e. SNI).
    A way around this is to use a custom DNS server.
  • ISP redirect any outgoing traffic to port 53 (DNS) to their own DNS server.
    This is done so that the ISP's DNS server with the implemented blacklists is enforced even if the user has configured its own custom DNS server. This is a bit more expensive but still scales well. But it also has the same problems for large-scale MITM.
    It can be worked around by using DNS over HTTPS (DoH).
  • Deep Packet Inspection or transparent proxies.
    Since the ISP is in the path of all traffic it can play active MITM on all traffic. But this is really expensive since it must check all traffic if this is TLS and then (and only then) intercept the rest of the connection. Easier would be to inspect only the common ports like 443 and accept that HTTPS on other ports will be missed.
    This can be worked around by VPN, Tor or other tunnel technologies - as long the ISP still allows arbitrary traffic.
  • Mandatory proxy and deny most other traffic.
    In this case the customers must not only add the government CA but also explicitly configure a proxy. Any direct traffic which is not using the proxy gets blocked (i.e. Tor, VPN, tunnels...) , maybe with the exception of some protocols to send and receive mail etc. This is easier for the ISP than the last option and it guarantees a broader coverage, but not all applications can deal with proxies so that some applications might not work.

if it won't help, what can I do to protect my privacy?

It depends on how the MITM is done and how it is enforced (both technically and legally). If you are lucky a VPN or Tor or some SSH tunnel or similar will work and use of these will also not cause legal trouble for you.

In general the workaround is to use something which gets not analyzed.
Given that some applications outside the browser do SSL pinning (I think Dropbox on Windows) and that the government might want to allow these applications to work, they might have whitelists for domains which gets not intercepted. This can be used by custom tunnels which look like they have traffic for these domains but in reality connect to somewhere else. But note that with some advanced traffic analysis such misuse can be detected by the ISP and might be treated as unlawful.

Improve this answer
4
  • Appreciate your thorough explanation!
    – qarbyz
    Jul 20, 2019 at 19:04
  • Although I doubt that they are using whitelists now, I'm afraid they can change if need be. As for VPN and/or Tor, funny it is that they're illegal.
    – qarbyz
    Jul 20, 2019 at 19:06
  • "very likely just changing the DNS server will not help." and yet all proponents of DoH and to a lesser extent DoT exactly give this use case to promote it ("getting back control of our resolution against the evil ISP") ;-). So "It can be worked around by using DNS over HTTPS (DoH). " what about if a CA is added in the trust store that allows to do MITM (exactly the plan of Kazakhstan) and some BGP hijacks to get any address to reply locally as one wishes?
    – Patrick Mevzek
    Jul 22, 2019 at 18:28
  • @PatrickMevzek: ""getting back control of our resolution against the evil ISP" claims a different thing than getting rid of MITM attacks. DoH/DoT is effective against the first but not the second. And the OP is asking about MITM and if using a different DNS server (no matter if direct or DoH/DoT) would be effective against this. The answer is that using a different DNS server does not help in this case since DPI and/or transparent proxies are used for MITM, not DNS spoofing or tracking. No BGP is needed here since the MITM is done by the ISP which is by definition in path to the internet.
    – Steffen Ullrich
    Jul 22, 2019 at 19:03
0

Kazahstan is intercepting all of your HTTP traffic, but they were already logging and intercepting all of your DNS traffic, because DNS esentially is plain-text.

Changing the DNS servers will not help. Actually encrypting your DNS will not help, because all of your HTTP traffic is logged anyways...

I actually know a bit about Kazahstan and they are blocking VPN as well, so that won't work either.

One of the ways to stay anonymous is to use something like: https://shadowsocks.org/en/index.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .