Internet providers plug loophole for accessing blocked websites

Some internet service providers (ISPs) have been found plugging a loophole that would otherwise allow internet users in Malaysia to access websites that are supposed to be blocked.

According to the report by Sinar Project today, its testing has found that when internet users make a domain name service (DNS) query via services provided by Google or Cloudflare, these requests are redirected back to the ISP’s own DNS service instead.

This was done through the implementation of transparent DNS proxies.

“Users that have configured their internet settings to use alternative DNS servers, would have found that they are now unable to access websites officially blocked by the Malaysian Communications and Multimedia Commission (MCMC) and getting a connection timeout error.

“Instead of the intended Google and Cloudflare servers, users are being served results from ISPs’ DNS servers.

“In addition to MCMC-blocked websites, other addresses returned from ISP’s DNS servers can also differ from those returned by Google and Cloudflare,” Sinar Project said in its report.

The report was made as part of the Internet Monitoring Action Project to monitor network interference in nine countries and territories, including Malaysia.

The issue was first noticed during automated and manual testing of the networks yesterday.

How MCMC blocks websites

Besides preventing users from accessing blocked websites despite having changed their DNS settings, Sinar Project noted that redirecting users to unauthenticated websites different from the intended website can “pose a security risk and result in unexpected technical issues”.

For context, a DNS service is akin to an address book used by computers for navigating the internet.

For example, when a user keys in a website’s URL such as “malaysiakini.com”, the computer would query a DNS server, which would respond by providing the internet protocol address (IP address; a set of numbers such as 104.22.21.197) for reaching the website.

By default, computers are typically configured to use the DNS servers provided by their ISPs such as TM, Maxis, Yes, or Time.

If the user attempts to access a website that the MCMC orders to be blocked, however, the ISP’s DNS servers would provide the ‘wrong’ IP address – essentially tampering with the address book to lead people away from their intended destination.

In the past, users would be redirected to a website showing a notice from the MCMC stating that the website violates national laws. More recently, users would get no response when redirected to the wrong address.

Therefore, a relatively easy way to circumvent this is to simply change the default network settings to use a different DNS server, particularly free services provided by Google, Cloudflare or OpenDNS.

Implementing transparent DNS proxies plugs this loophole by quietly redirecting users back to the ISP’s own DNS servers instead of the third-party services.

Simple workaround

Nevertheless, the Sinar Project report has offered a relatively simple workaround.

The digital rights advocacy group said affected users could change their DNS settings again so their DNS lookups with third-party DNS services are transmitted over a secured connection known as “DNS over HTTPS”, instead of being sent in the plain where such requests could also be viewed or logged.

“This will also bypass transparent DNS proxy interference and provide warning of interference,” it said.

Previously, it was reported that the MCMC had ordered 3,110 websites to be blocked between 2016 and January 2017, most of them carrying content deemed “pornographic, disgusting, false, or threatening”.

Websites for gambling, prostitution, cheating, piracy, unregistered medicines, and fake products are also banned.

In 2018, Malaysiakini’s website for live updates of the 14th general election results was also blocked after it announced Pakatan Harapan had won the election, which was later vindicated by the official results.

Last year, several news websites were also briefly blocked by the MCMC, namely MalaysiaNow, UtusanTV, and TVPertiwi.

Some of these incidents occurred despite Communications Minister Fahmi Fadzil’s assurance that news websites would not be blocked while an investigation is still ongoing.

Responding to last year’s incidents, the MCMC had said its actions are guided by provisions under the Communications and Multimedia Act 1998, including the agency’s function to prevent the commission or attempted commission of an offence under any written law of the country.

It declined to comment on specific cases.

Fahmi: Meta reps couldn't give good answers, but PM accepts apology

PMO summons Meta rep to explain pro-Palestine content removal

COMMENT | Madani’s losing social media licence gambit

Turkiye blocks access to Instagram

MCMC blocked 549 porn, 69 prostitution websites since January - Teo