Activists took advantage of the vulnerability in the work of Roskomnadzor and now they block other people's sites. How is it arranged?

On June 4, some users have problems with access to the Telegram messenger, and many popular and public sites-the IVI.ru, Wikipedia, Medusa and many others were not available within three days. The reason for the malfunctions was that the owners of resources that fell into the register of prohibited sites (Roskomnadzor leads) took advantage of vulnerability in the system of monitoring sites and blocking sites themselves-they themselves entered the register of prohibited sites of the IP address of resources, which are not in the black list. "Medusa" tells how it happened and who does it.

How does this happen?

Roskomnadzor introduces the domain name and IP address of the prohibited resource in the register. For example, the name is http://grani.ru/, and the address is a set of numbers, a kind of coordinates of the resource in the global network. In order not to have an address every time you have to enter the address in the browser line, there is a special database - Domain Name System (“Domain names”, DNS). In it, opposite each name, the address is recorded.

Owners of any resources independently prescribe addresses opposite their domain names, but what they write there is not controlled by anyone. It would seem that such control is not needed: for example, the owners of the Meduza.io domain are not interested in users who enter their address into the browser line, for example, to the Roskomnadzor website.

Nevertheless, the owners of sites that have already been in the black list of Roskomnadzor began to prescribe third-party IP addresses in the DNS opposite their domain names. Thus, they force providers to block those sites that they want.

Only small providers suffer from vulnerability, since the large ones have a special system that allows you to not pay attention to which address is registered in DNS. Buying and setting up such a system for eight thousand users will cost about a million rubles - small operators simply cannot afford it.

Why do the owners of some domains block the addresses of others?

one of the activists tells; He asked not to indicate his name

The topic that it was possible to block sites in this way for a long time-even before the start of any locks, many warned that this scenario was possible. Now someone has finally used vulnerability in practice and launched a wave. Many such locks in recent days are the consequences of both a viral effect and systematic work.

Some in the wake of the Ugar troll Roskomnadzor and other state bodies, blocking their sites. Others use vulnerability as a weapon in the war with Roskomnadzor. The task of these people (I also belong to them) is to complicate the life of the life of everyone who is trying to encroach on freedom of speech and anonymity on the network. So, the service servers of Roskomnadzor can be blocked, and the work [of the department] will be difficult to block sites. Propaganda resources - the NTV website and others are also goals.

We have no coordination. There was an initial message: “There is Roskomnadzor and their vulnerability. You know what to do. ” Technically, everything is very simple. Among the blocked domain names there are a lot of those that have been freed and are on free sale. For example, the names in the .Space zone of the Namecheap registrar are 80 cents. You register the liberated domain, located in the register of prohibited sites, and prescribe in its DNS the resources that are objectionable to you - at least a hundred, at least more. All.

I immediately bought 18 pieces, then I bought the same amount. I prescribed there the service servers of the Examiner system, the portal of United Russia. Soon there is still a straight line with Vladimir Putin, I am sure that someone will enter the IP address of the broadcast. In general, there are many applications. You can simply close the Internet for a large part of our citizens.

And by the way, we do not violate the law-we just change the DNS records. But, of course, just in case we use [anonymous network] Tor.

Evgeny Berg