BolehVPN: Freedom Through Security

As you probably are aware, over the past few months our focus has been to improve the customer support experience.

We’ve started using Zendesk a fully fledged ticketing system that replaces our previous Portal system and we now have some statistics to share with you.

In the month of April, we received 615 unique tickets, meaning we had 615 separate incident requests.

Our Average First Response Time Statistics:

67% 0 – 1 hr

29% 1 – 8 hr

3% 8 – 24 hr

1% 24 + hrs

This shows we have a bit of work to do to reduce the response times for the 8 hours and above but we have beaten by a huge margin the IT Services and Consultancy benchmark average first response time which is 25 hours (something that would prompt a reprimand in our support team).

We have now enabled Customer Satisfaction reviews of ticket resolution. This directly affects our Support Staff appraisal so we ask you to be fair when rating tickets handled by them. We hope to share these results later on!

0 0 0 0

Before I begin this post, we at BolehVPN are of diverse political views and have supporters of both sides. However, when it comes to dealing with internet censorship, we’re all in agreement that it’s bad.

There is strong evidence that Streamyx is employing Deep Packet Inspection (DPI) to censor certain political YouTube videos as discovered by Lowyat forumer rizvanrp.

This means Streamyx has employed hardware to identify certain sites as blacklisted and deny access. These sites are such as Youtube videos on Bala’s wife, and possibly MalaysiaKini and DAP’s Facebook page. Using encrypted HTTPS seems to bypass this. Another way is to use a VPN which is a more secure solution to protect yourself against DPI.

This is an excerpt from rizvanrp’s post:

All plaintext HTTP connections on Unifi (and maybe Celcom + Maxis) are being man-in-the-middle’d and dropped if they contain blacklisted data.

What we know :

i. The DPI isn’t only being used to selectively block YouTube videos, however unencrypted Facebook pages belonging to certain parties are also being blocked. You can get around this by appending ‘https://’ to the Facebook URLs rather than trying to use ‘http://’.

ii. The DPI is based on TCP segment analysis. Basically, every single TCP packet has its payload analyzed for certain request URI strings that have been blacklisted. Obfuscation attacks such as packet fragmentation (splitting a large TCP payload containing a single HTTP request into smaller TCP segments) as well as packet padding (appending large amount of junk data to the HTTP request URI in order to force the ‘HTTP/1.1\r\n’ trailer into a separate TCP segment) will also work however you need specialized HTTP proxy software or iptables rules (on Linux) to do this.

iii. Once a blacklisted payload is detected within a packet, the header information for the TCP stream (SRC/DST port + SRC/DST IP address) is added to some kind of blacklist for 90 seconds. This causes all traffic for that particular TCP stream to be dropped for 90 seconds (hence the 90 second gaps in my packet capture samples above). This is also why some of you have noticed that if you wait long enough (well, 90 seconds in my tests).. the videos/sites that are blocked will eventually continue to load. Due to the persistent nature of TCP, once the 90 second blacklist window passes.. your TCP stream will continue and the payload data for whatever you’re requesting will reach your computer.

Mitigation techniques :

i. Use ‘https://’ wherever possible (especially on Facebook). Users in the thread have recommended HTTPS Everywhere which is a Firefox/Chrome addon to do this automatically for most major websites.

* While YouTube supports HTTPS for their main website, their player does not support it so even if you were to use HTTPS on YT.. the videos won’t load.

ii. For accessing blocked YouTube videos, you can use some of the various YouTube proxy sites such as ProxFree.

iii. Get a VPN/SSH tunnel service if you’re worried about having your HTTP requests intercepted.

Sinar Project’s Google + update also confirms this:

TMNet’s filtering of +Malaysiakini video interviews of Bala’s widow

We strongly suspect some sort of basic content filtering to censor online media in Malaysia is happening. Investigation was done on multiple networks based on the id/url of these videos served from Google’s +YouTube  cached servers located in TMNet network.

We are not aware of all the details of Google’s infrastructure, but testing so far has revealed that when request is served from servers not in TMNet’s network, the video can be viewed immediately. The content filtering is not effective all the time, and it can sometimes pass after a period of time if the request is fragmented into multiple packets.

Many people have reported difficulties with viewing the following video interviews linked from MalaysiaKini’s interview article herehttp://www.malaysiakini.com/news/228492. It is an interview of the window of a private investigator’s widow who implicates that the caretaker Prime Minister Najib Razak was indirectly involved in their plight to cover up possible interference in the murder case of Mongolian citizen Altatunya.

- Isteri PI Bala: Kami betul-betul macam pelarian
- Isteri PI Bala: Apakah salah berkata benar?

This is similar to the recent attempts at censoring MalaysiaKini http://www.malaysiakini.com/news/228203 for which normal users think that there is something wrong with their Internet connection, rather than a more sophisticated form of censorship.

We strongly condemn the actions of TMNet and parties involved in censoring  access to free media in Malaysia and hope that +Google‘s +YouTube team can help shed more light on this with their own internal investigations.

0 0 0 0

Although we at BolehVPN are a big supporter of P2P, we always believe that good game developers should be rewarded and that their games should be bought! Gone are the days where digital distribution was not as widespread and games won’t be available via the legal channels. Now, as someone who is earning a decent income, it is only fair that I put my dollars to where I think they are deserving.

Game Dev Tycoon,  had an interesting way to educate players on this by sneaking into the pirated version of the game, a message:

Slowly their in-game funds dwindle, and new games they create have a high chance to be pirated until their virtual game development company goes bankrupt.

In fact, the real life company that released this game showed that over 90% of people who played this game had pirated it!

If you liked to read their official post on this, continue on here. I haven’t personally had the chance to try this game out but just maybe I’ll give it a go . Pretty ingenious marketing on their part!

0 0 0 0

If you’re Malaysian and have imported stuff from overseas, you would have probably encountered the sometimes arbitrary applications of taxes upon your goods. Here is a quick guide, to quickly estimate the taxes payable and make sure you’re not being ripped off. This is not related to our VPN services, but merely a public service announcement since the system we have on Customs is pretty crap.

1. Search the HS Code (Harmonized System Code) for your item. There’s a lot of sites for this but this I found Export Malaysia’s HS site to be pretty easy to use.
2. Surf to the Customs website here. The reason why we did Step 1, is that the customs website isn’t accurate in searching for item descriptions  (in typical Malaysian style).
3. Enter the first four digits of the HS Code into the Search By field. Do not enter the full code as sometimes the site will return no result so it’s better to go to the more broad category first.
4. There might also be in the Notes some description of import restrictions.

As a working example, let’s say I want to import earphones. I do a search on Export Malaysia and the results are as follows:

I then enter the first four digits (8518) of the HS Code into the Search By Field in the Customs Website (http://tariff.customs.gov.my/) and get the following results.

I can see that earphones fall under 851830100. Also I now can see, import tax duty is 5% and Sales Tax is 10% so I can expect to pay 15% tax.

Note how if I enter in the more complete code of 851830, I am not shown the 851830100 result for some absurd reason and would have been left blind.

Hope this helps any of you seeking to import things from overseas! This isn’t professional advice as well and it’s merely a guide to show you how to get the Tariff site working for you.

0 0 0 0

The Old CISPA

In 2012, three pieces of USA legislation with huge potential effects on the Internet were tabled. They were the Stop Online Piracy Act, Protect IP Act and the Cyber Intelligence Sharing and Protection Act.

Of all three, the majority of publicity went to the first two. If you remember, SOPA and PIPA were stopped by a huge protest generated by internet activists. CISPA was shelved after not gaining any traction in the Senate. Even if it had passed the Senate, the White House had threatened to veto the bill anyway, due to privacy and civil liberty concerns.

The New CISPA

The new version of CISPA has undergone some changes to clean up definitions and ensure privacy is maintained. However, the language is still murky and vague and the majority of the bill is unchanged. CISPA is designed to prevent cyber attacks by obtaining and sharing “cyberthreat information”. In practice, this means private sector firms are able to  access personal and sensitive data of US citizens such as emails, cloud-storage, documents and so on.

If CISPA is passed, it will override existing privacy law and provide immunity to participating companies and the US government. The data collected will be exempt from the Freedom of Information Act and other state laws that require disclosure . Once collected and passed on to the government, it can be disseminated to any agencies and used to investigate other crimes not pertaining to cybersecurity.

CISPA Today

CISPA recently passed the House of Representatives and is headed for the Senate. If it is not filibustered there, the only hope to stop it is a presidential veto. And several of the big tech companies which opposed SOPA and PIPA are backing this bill (Full list of supporters can be found here).

The biggest impact this bill will have is on US citizens, however non-US citizens may be affected as most US companies keep their data in local datacentres. And it won’t matter to the government agencies if the data is from foreign users. Think on how many US based websites we use, and how much data we give away.  It would be a treasure trove for intelligence analysts, but a deep invasion of our privacy as Internet users.

Sources: http://www.zdnet.com/what-is-cispa-and-what-does-it-mean-for-you-faq-7000013965/

https://intelligence.house.gov/hr-624-letters-support

https://www.eff.org/deeplinks/2013/04/cispa-amendment-and-passed-out-committee-heres-why-new-version-still-threatens

0 0 0 0