Shamar @Shamar@qoto.org

Hey @ondiz come va?

Fra qualche giorno parteciperò alla #AIUCD2021 per discutere questo breve saggio sulla lotta di classe degli informatici: http://www.tesio.it/documents/2021_AIUCD_La_lotta_informatica.pdf

Mi piacerebbe moltissimo sapere cosa ne pensi...

@z428

I think there's no safe way to use primitive tools (like the ones we have these days) for people who do not understand their inner working.

#BigTech lock them in chains by telling them that #Informatics can be easy and for free, but what looks easy is just a way to enslave you.

A more honest approach would be to say "Informatics is simple, but it cannot be easy until you learn it."

Like it or not, there is no way out.

Let strangers chain up you hands and necks and you will still be able to try to escape #slavery.

Let them chain up your mind, and you will never realize you are a slave.

Thanks @ekaitz_zarraga for the most valuable (and expensive!) gift I received this year! 😉

http://www.tesio.it/2020/12/25/que_es_la_informatica.html

@freemo

The problem is that I do not care about the client location, but the server's one.

In our working evample, Eve has several public IP addresses available and 3 datacenters: one in the US, one in Europe and one in China.

We know that packets for a certain IP are routed to the US datacenter but we want to to check that this statement is true even for Alice (that is in Europe) as it is for Bob (that is in the US).

As said, whatever happen inside the datacenter (say, the transfer a copy of all the data to the Chinese datacenter) is not relevant for this specific problem.

We just want to be sure that Alice's packets for say 6.6.6.6 is not routed to the datacenter in the EU or the one in China, but just the one in the US (like the Bob's ones are). They could be ICMP packets... doesn't matter for our purpose.

@khird

@freemo
Sorry for my bad explaination.
Let me try again.

By "ethernet" I meant the public internet-facing interface that first handles the packets that target a specific public IP.

In our example, this is likely a router's interface in the Eve's datacenters. I do not care about what happen inside the Eve's datacenter that receives the packet, but I need to prove that when Alice sends an level 3 packet (it could be a HTTPS over TCP or even a HTTP/3 over Quic, but I think it's not relevant to routing... is it?) to such IP address, the Eve's datacenter that receive the packet from the public Internet is the one in the US.

Now, I know that in mainsteream networking theory, an IP should only match one physical destination on earth.
So I know my question look weird (and possibly is dumb).

BUT I remember of a iranian attack, some time ago, that used fake BGP routes to obtain victim traffic to known US IP addresses. So I thought: what if such techniques (or similar ones I'm not aware of) were used as a sort of level 3 load balancing to reduce latency?

In this case, I'm looking for ways to ensure this is not happening.

In other terms, I'm looking for a way to exclude such IP address duplication in different zones of the planet.

Is my question more clear?
(I'm doing my best from my limited networking knowledge, maybe you can ask good questions...)

@khird

@freemo

Continent level precision is actually enough but a nation level would be better.

The issue in @khird's solution (vpn tunneling) is that it doesn't say anything about the IP location, just ensures that both Bob and Alice connect to the same location.

Instead I need to ensure that such IP, when connected directly from Alice, goes to the same etherney when connected from Bob.

In other terms Alice and Bob need a test that proves that the ethernet responding to such specific IP is globally unique and physically located in the US (or at least in America).

I guess the key is to exploit transoceanic TTL but... I do not know exactly how.
Maybe an altermative would be to actually dump and compare the respective BGP routes... but I do not know how.

@freemo

Still looking for solutions.

@khird has been very kind, but unfortunately what he proposed is not what I need. Which is a way to prove that a certain IP is ONLY located in a specific continent.

And as I wrote these are deep waters for my networking skills...

@khird

Well, that would probably solve the security issue of Bob and Alice but would not solve my issue that is to prove that a certain IP is ONLY going to a certain continent.

I mean, I know they could both move to an alternative architecture, but for reasons, their issue is to actually prove that such specific IP is in the states.

@khird

Ok sorry let's be more specific.

Suppose that Eve controls several public IPs, a datacenter in the US, one in Europe and one in China. Eve is not necessarily evil, but she is uncooperative and cannot be trusted on this specific matter.

Alice is in Europe and want to ensure Bob (who is in the US) that when they connect to a certain Eve's IP, their packets will reach an ethernet in the US. What happen to the packets after they reach the target IP is out of scope for this question.
Bob trust Alice.

What experiment could they do to verify that such specific IP is routed to the same physical ethernet from both sources (their point of observation) and that such ethernet is actually in the US?

They want to exclude that (something like) BGP trickery can cause that specific public IP to be assigned to different ethernet in different continents.

While this might look as a theoretical problem, it's not.

That's why I wrote this is something for #networking #hackers and asked to boost in the hope it reach somebody deep enough in these low level waters that could actually help.

#infosec #security

@khird

What about comparing the #traceroute from different continents?

Or maybe there is a way to dump and compare the #BGP routes of an IP range and spot the duplication?

To be honest, these are deep waters for my #networking skills, so be patient with my dumb questions... but I really need an answer.

#InfoSec #cybersecurity #security

@acesabe

I'm not much interested where the server actually is, but where the first ethernet that receives the packets directed at such IP is located on Earth surface. Possibly at nation level, but at least at continental level.

I need to exclude the duplication of the public IP over different physical locations, say for load balancing issues.

I know DNS level load balancing is simpler and effective, but... I need to specifically exclude this sort of L3 tricks... for reasons.

(Not that I know anybody doing something like this, BUT I know I'm not an expert on global scale network machinery).

@jartigag

Thanks @khird!

This is a nice trick!
I didn't think of it.

I wonder: is there a way to exclude a tricky #BGP duplication of an #IP over different regions?