1

Imagine a country ruled by a non-democratic government with an explicit disregard to local and international laws. The national registry for local domains (Country code top-level domains) falls under their area of influence. We know that this government actively surveillances its citizens and constantly throws people in jail.

My question is: can the government, using the Registry's resources, hijack traffic to the domains that have their ccTLD? And then hide it?

Mail traffic is my main concern. Wouldn't be as easy has having a hidden MX record on the targeted domain?

5
  • 2
    "a hidden MX record" - how could a MX record be hidden? If it is not visible to others, then others will not use it and thus not deliver the mail to the given MX. Commented Feb 2, 2023 at 19:56
  • You might find my answer to a very similar question there useful: superuser.com/a/1332238/693623 (with lots of example) Commented Feb 2, 2023 at 20:20
  • Adding to my previous comment: "hijack traffic to the domains that have their ccTLD? " Yes, and no, in the sense that it is unrelated to the local registry, and they can hijack other ccTLDs as well, or any TLD for that matter, see the great China firewall. Some - supposedly democratic countries - do already have rules that either registrar and/or nameservers (including registry nameservers if the job is outsourced) have to reside in the country to be able to apply both legislation and technical operations (aka: looking and filtering) to them. Commented Feb 2, 2023 at 20:23
  • "how could a MX record be hidden? " A nameserver can change its reply based on who is asking. Most often not a great idea, but totally possible. Even more so if you look at recent proposal for "ZeroDNS" aka DNS in a ZeroTrust network, where the nameservers use the client certificate given through DOH/DOT to decide what to reply. Commented Feb 2, 2023 at 20:27
  • 1
    @PatrickMevzek: true, but as I said: if the mail server does not see the MX record it will not deliver the mail to the given server. Commented Feb 2, 2023 at 20:31

2 Answers 2

2

Actually this kind of thing happens all the time but it's not dependent upon Registry resources.

Quite often BGP (Border Gateway Protocol) changes will misdirect vast swaths of IP addresses through inappropriate backbone gateways. This can be by accident or malicious intent to run traffic through some country that normally would never have any access. Typically this gets noticed fairly quickly, often on the order of a few days and corrected.

Within a given country, most countries have a small number of international gateways and are quite capable of monitoring or hijacking traffic right from the gateway.

This brings us to encryption. If the traffic does not use encryption then all bets are off and everything is accessible. Properly implemented encrypted traffic is accessible but unreadable. Email historically was entirely unencrypted until fairly recently, around 7 years-ish.

Thanks primarily to Google declaring they would no longer exchange email without encryption, most Server-to-Server exchanges are now encrypted. Note carefully that this is not end-to-end encryption. The server's store and forward functions hold the email in the clear. Any country is theoretically capable of monitoring this store-and-forward content.

3
  • 2
    "If the traffic does not use encryption" That is not enough at all. Authentication is what is important, not encryption. If you are encrypting all traffic but sending it to a remote side that you didn't authenticate in advance (or whose authentication has been hijacked) then you are potentially sending your traffic to "anyone". Commented Feb 2, 2023 at 20:48
  • @PatrickMevzek it is both. If you authenticate but do not encrypt, the bad guys force your un-encrypted traffic stream to go through their router, where they can at least read it. Commented Feb 3, 2023 at 21:36
  • Of course it is both, but authentication comes first and is more important. Your answer puts the onus only on encryption and as such gives misplaced goals. Commented Feb 4, 2023 at 0:54
1

Yes, absolutely. Each ccTLD is operated by a company within that country. Here's a list of TLDs including ccTLDs, and who manages them. For example, .ad is managed by Andorra Telecom.

Not only that, the actual traffic passes through ISPs in that company. A government can pass a law saying that Andorra Telecom has to not only change domain records on request by the government, but also redirect traffic to certain IP addresses or ports. Or else the CEO goes to jail.

Whether they can hide it, that's more difficult to speculate on. They can try, but there's often some discrepancy someone will pick up on - "why does NMAP say this website is running Windows now?" - another signature is that traceroutes of ICMP packets can take different routes or different time than traceroutes of port 25 TCP packets.

As Steffen already pointed out, there's no such thing as a hidden MX record - the originating mail server has to see the record so it knows where to send the mail. They can keep the MX record the same if the mail server is in Andorra and they redirect the IP address.

4
  • 1
    "Each ccTLD is operated by a company within that country." Technically, no, not by a "company". It is up to the government to decide who manages the TLD. It can typically be: the government itself, an outside entity having mission from the government, a branch of some academia in the country, a non-profit organization, OR a company. Commented Feb 4, 2023 at 0:55
  • "A government can pass a law saying that Andorra Telecom has to not only change domain records on request by the government, but also redirect traffic to certain IP addresses or ports." This part is completely wrong. The domain name registry DOES NOT see the traffic. It handles the authoritative servers that delegates domains in that TLD to other authoritative nameservers (and this is the only part where they can lie). Once a client got an IP, it connects to it, and registry systems are not part of the exchange, hence do not see anything (except if that IP is theirs of course) Commented Feb 4, 2023 at 0:57
  • @PatrickMevzek In the case of Andorra Telecom, it has a monopoly on all telecommunications within Andorra, since it is a very small country. Commented Feb 4, 2023 at 1:04
  • "In the case of Andorra Telecom, it has a monopoly on all telecommunications within Andorra, since it is a very small country. " Which is not the point, whatever Andorra's does is Andorra's business. Your sentence of "Each ccTLD is operated by a company within that country." is just incorrect for a strict definition of company. Look at who operates fr, de, and uk for starters, do you consider those entities to be companies? Then look at gr. Commented Feb 4, 2023 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .