2

Lantern is an app to avoid censorship. It is hosted at getlantern.org.

I just noticed that the cloud server my client is using is actually roundrobin.getiantern.org

Lantern getlantern roundrobin.getiantem.org

Notice the i in getiantern instead of getlantern.
They look extremely similar with the app's font, I had to look very closely to see the difference.

Should I be worried?
Or can the getiantern domain be trusted?

getiantern is not found in the Lantern source code.

3
  • 1
    The whois info of getiantern.org says that it is registred via Domains By Proxy, which means that the registrant wants to hide their identity. This is no proof that they have a malicious intent, but doesn't look trustworthy either. – Philipp Aug 20 '14 at 6:13
  • If we look at the Whois info again it shows that it was registered on October 13, 2013 and expires on October 13, 2018 a person who plans on putting it up on Sedo.com will not register it for that long. Maybe someone plans on doing some phishing attacks. – BigBob1000 Aug 20 '14 at 7:06
  • But given the fact that getlantern.org itself is also registered over Domains By Proxy it could be part of the real Latern program. I don't think it is unnormal for a tool like this, perhaps the creator of it needs some anonymity to prevent legal consequences. – Tokk Aug 20 '14 at 7:19
3

There are two possibilities in my mind:

Given the fact that you state that the apps font is very little, could it be that roundrobin.getiantern.org is in fact roundrobin.getiantem.org? Notice that the only difference is rn and m at the end of the domain name, and with some fonts it may be difficult to read especially if you have the domain getlatern in mind.

Why am I asking this? The domain roundrobin.getiantem.org is mentioned in the source (line 63).

The second option is found in the same code file on lines 33-43:

final File cfcerts = new File("cloudflare-certs");
final File[] certs = cfcerts.listFiles();
for (final File cert : certs) {
    LOG.info("Loading cert...{}", cert);
    try {
        DEFAULT_HOSTS_TO_CERTS.put(cert.getName(), 
                Files.toString(cert, Charsets.UTF_8).trim());
    } catch (IOException e) {
        LOG.error("Could not load cert?", e);
    }
}

What it does is looking in a folder named cloudflare-certs and loading all hosts for the certificates in that folder. It may be that there is a certificate for roundrobin.getiantern.org. But if so you should be carefull in the git repository there is no such certificate.

As far as I could see with a quick view, Latern tries to take an host from a certificate and connects to roundrobin.getiantem.org if this fails.

If none of the two options apply you should perhaps really be worried as someone may try to manipulate your traffic. Or you may accidentally downloaded a malicious package with different servers.

2
  • You're right, it is actually getiantem! – Nicolas Raoul Aug 20 '14 at 8:00
  • Well in this case I think we have an answer to your question, and you don't have to be worried. – Tokk Aug 20 '14 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.