• 1 Post
  • 23 Comments
Joined 9 months ago
cake
Cake day: March 3rd, 2024

help-circle













  • Something which has not been mentioned yet - Russia controls DNS resolution for any .ru site, and here’s how that works:

    When you browse, say, www.yandex[.]ru, your computer needs to know the IP address of a server that hosts that site. Let’s say you are not using an ISP or public DNS server to get your name resolution from DNS hostname to IP address. (All of the following is essentially still what happens, just with a less complicated explanation.)

    First, your computer contains a list of root DNS servers. Every DNS query starts with a root server, and those root servers are associated with the often-excluded ‘.’ at the end, like “www.yandex[.]ru**.**” - that trailing dot at the end always exists, we just don’t type it.

    The root server says, “Here’s a DNS server which is authoritative for the .ru top-level domain, go ask them.”

    Then your computer asks the .ru DNS server where to find www.yandex[.]ru, and the .ru DNS server says “Here’s the server that is authoritative for the “yandex” subdomain under .ru, go ask them where their “www” host is.”

    Then your computer asks the yandex[.]ru DNS server where to find www.yandex[.]ru, then that DNS server says “Here’s the IP address that goes with that hostname,” and your computer asks the server at that IP for the website.

    Again, Russia controls DNS resolution for anything at .ru. All they would need to do for any subdomain beneath .ru is provide their own authoritative DNS server for yandex[.]ru - or for any other whatever[.]ru DNS name. They could then redirect all browsing traffic to anything under .ru to anything they wanted.

    Those FBI takedown pages? This is exactly how that is done. The FBI doesn’t reconfigure a server at the “correct” IP; they redirect DNS for the subdomain to their own IP and own web server in order to display the takedown page. That operation is performed within legal limits, but from a technical perspective, such an operation could just as easily happen outside of legal limits, especially when the party trusted to properly respond to DNS queries is Russia.

    tl;dr: Russia can very easily redirect any traffic to any .ru site to anywhere they want.