Open Letter To DDoS Proponents

To those of you who encourage the use of DDoS attacks against Iranian Government Web Sites, You have a responsibility to provide detailed answers to the following questions:

1. What is your motivation for launching these attacks?
   
2. What is the strategic value of the Iranian information assets you are targeting? How does taking these sites down help bring freedom or justice to the people of Iran?
3. Assuming your motivation is to help support the protest movement in Iran, how do you know that your actions are not harming the protesters?

Optional Bonus Question: Please explain in as much technical detail as possible how the Internet traffic gets from your computer to the target computer in Iran.

Please post your answers as comments. Please do not include any links to Web sites that host attack code.

Sincerely,

Mr. Fisk

For those of you who read this blog and wish to promote this discussion: Please tweet the following or something similar: "Supporters of DDoS: Please explain why: http://bit.ly/s5NJA"

Links for #iranelection

Here is a list of links to important information for opposition supporters inside and outside of Iran:

Set up a Tor relay:
http://anonygreen.wordpress.com/2009/06/18/how-to-setup-a-tor-relay-or-tor-bridge/
http://iansbrain.com/2009/06/15/tor-and-the-iranian-election/

Other ways to help:
http://iran.sharearchy.com/

Brief Introduction to Tor and Why it's important

The Problem:
Iranian citizens cannot reach certain Web sites to share election news or otherwise communicate with the rest of the World. This is because the government has set up filters that block those certain Web sites (twitter, facebook, youtube, etc.).

The filters work by dropping connections that are bound for certain IP addresses or hostnames. Let's say that someone in Iran wants to connect to www.twitter.com. Their computer will figure out the IP address of Twitter, which is 168.143.162.100, and then will attempt to connect to that IP address. However the Iranian government's Web filter has a rule that says traffic to 168.143.162.100 is not allowed.

The Solution:
The way around this filtering is to allow that person in Iran to connect to a different IP address that is not blocked by the government filter. The computer that hosts this different IP address is what we call a Web proxy. The proxy, which is not in Iran, makes a connection to twitter on behalf of the user in Iran. The proxy allows the user in Iran to freely use Twitter or some other Web site until the government realizes they need to block the proxy IP address. This is why we constantly need new proxy IP addresses.

Where Tor fits in and why it's better than a conventional proxy:
Tor is a special kind of network that offers proxy services that are distributed around the globe with many computers sharing the load. This allows for great performance, efficiency, and anonymity. There are three roles that members or "nodes" in the Tor network can play. Entry nodes to which users connect, relays that forward traffic from node to node, and exit nodes that connect to the destination Web sites. When you set up a regular Web proxy and send someone in Iran the IP address, you act as all three, entry point, relay, and exit point. As soon as the Iranian government learns your IP address the whole operation is ruined. But with Tor, you can act as a relay or as an exit node (or both) without the Iranian governement ever knowing your IP address, and even if they did, they still couldn't filter the traffic. The entry nodes require publishing their IP addresses so those can be filtered, and that's why we need new Tor bridges all the time (a Tor bridge is a special type of entry node).

What you can do:
You can run a Tor relay or a Tor bridge on your computer. We need relays because the more relays we have, the more resilient the network becomes. We need bridges because these are the entry points for the citizens in Iran so that they can get around the filters. We must constantly set up new bridges to replace the ones that the Iranian government blocks.

How to do it:
Instructions are posted here:
http://anonygreen.wordpress.com/2009/06/18/how-to-setup-a-tor-relay-or-tor-bridge/

NOTE: If you set up a Tor bridge I recommend you e-mail the IP address, port number and key to "vanhavaris (at) gmail dot com", "tor (at) austinheap dot com" and "irancurtain (at) iansbrain dot com" Be sure to note in the e-mail that it is a Tor bridge and not a regular proxy. Don't under any circumstances post it publicly anywhere, including Twitter or a Web page.

I hope this is more helpful than it is confusing. The bottom line is that Web proxies are absolutely critical to help Iranians share their struggles with the World. The best sort of Web proxy for this purpose is Tor. It's very easy for almost anyone with a computer to take part in the Tor network.

DDoS attacks against targets inside Iran damage the opposition

If you support the opposition movement in Iran, you must stop DDoS attacks immediately. Here are just a few of the many reasons why:

• DDoS attacks give the government an excuse to censor even more
• DDoS attacks help the government propaganda machine portray the opposition negatively, as troublemakers
• There is a finite amount of network resources in Iran. Think of Iran like a house and network devices such as routers are the doors to the house. If a bunch of people try to go in the doors at the same time. How can anyone get out?
• These DDoS attacks offer no strategic advantage because the assets targeted are not critical for the government. However, the Internet resources of Iran, which these DDoS attacks degrade, are critical for the opposition.
• You've probably noticed less communication (tweets, videos, pics) coming from members of the opposition recently. DDoS is contributing to the difficulty they are facing with getting their message out.
• The government has already throttled bandwidth for access points that they control. DDoS attacks waste what little precious bandwidth is left.
• DDoS attacks disturb the operations of upstream service providers that manage the routers which lead to the routers in Iran, which may prompt them to filter traffic destined for Iran or remove routes to/from Iranian routers. This hurts the opposition much more than it hurts the government.

So, take all of those resources you're spending on DDoS attacks and rechannel them to proxies. The opposition needs proxies to get the message out.

Protesters need Web proxies. A tor relay is a special type of Web proxy. Encourage everyone to set up Tor relays and set one up yourself: http://bit.ly/1agCMj Yes, there are other ways to get around the government filters, but we're concentrating our efforts on Tor.