Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Lantern is an app to avoid censorship. It is hosted at getlantern.org.
I just noticed that the cloud server my client is using is actually roundrobin.getiantern.org
Notice the i in getiantern instead of getlantern.
They look extremely similar with the app's font, I had to look very closely to see the difference.
Should I be worried?
Or can the getiantern domain be trusted?
getiantern is not found in the Lantern source code.
There are two possibilities in my mind:
Given the fact that you state that the apps font is very little, could it be that roundrobin.getiantern.org is in fact roundrobin.getiantem.org? Notice that the only difference is rn and m at the end of the domain name, and with some fonts it may be difficult to read especially if you have the domain getlatern in mind.
Why am I asking this? The domain roundrobin.getiantem.org is mentioned in the source (line 63).
The second option is found in the same code file on lines 33-43:
final File cfcerts = new File("cloudflare-certs");
final File[] certs = cfcerts.listFiles();
for (final File cert : certs) {
LOG.info("Loading cert...{}", cert);
try {
DEFAULT_HOSTS_TO_CERTS.put(cert.getName(),
Files.toString(cert, Charsets.UTF_8).trim());
} catch (IOException e) {
LOG.error("Could not load cert?", e);
}
}
What it does is looking in a folder named cloudflare-certs and loading all hosts for the certificates in that folder. It may be that there is a certificate for roundrobin.getiantern.org. But if so you should be carefull in the git repository there is no such certificate.
As far as I could see with a quick view, Latern tries to take an host from a certificate and connects to roundrobin.getiantem.org if this fails.
If none of the two options apply you should perhaps really be worried as someone may try to manipulate your traffic. Or you may accidentally downloaded a malicious package with different servers.
getiantern.orgsays that it is registred via Domains By Proxy, which means that the registrant wants to hide their identity. This is no proof that they have a malicious intent, but doesn't look trustworthy either. – Philipp Aug 20 '14 at 6:13getlantern.orgitself is also registered over Domains By Proxy it could be part of the real Latern program. I don't think it is unnormal for a tool like this, perhaps the creator of it needs some anonymity to prevent legal consequences. – Tokk Aug 20 '14 at 7:19