Thai Govt' Blocks CNN, Yahoo Finance, Facebook And Other American Sites

[elcent]

There are script injection to websites nowadays. Those in question should rethink their security approach and consult experts. I'm getting "possible attacks" and "attack stopped" every day on a new site with little traffic yet and where the scripts sort out possible attacks and in case it's more serious to stop them. Most of the attacks come via 'bots', fully automated. You can't rely on basic security features any longer.

Additional you can register and add a script from http://projecthoneypot.org which is a service to track down spammers and violaters. It is one of the best free services available and you can become part of the activities by laying out traps on your sites. The bots will fall into the traps and information will be gathered to finally hand them over to law enforcement agencies.

Visit their site for more info.

Edited December 14, 2009 by elcent

[CrossBones]

Ok CNN Facebook etc arent working...

More to the point... WHY is Thailand Immigration site "attacking" its visitors!!!!!!>???

Maybe some funny farangs are taking revenge on Thailand immigration by reporting it as an attack site?

Good one whoever did that!!

Edited December 14, 2009 by CrossBones

[sedeflonga]

I hate mondays...

[bwalker1973]

It's about time the immigration site got blocked, it's been full of viruses since may this year. I use satellite internet from singapore, a hel_l of a lot cheaper than thailand, and have full access to everything. It's amazing twitter does not get stopped as well, because the PM and Takki use it to communicate.

Edited December 14, 2009 by bwalker1973

[A_Traveller]

^ within Thailand?

Regards

[Wolfie]

I've removed a couple of posts speculating as to the reason for this recent glitch and any connection to the Royal Household.

Lets not drive the discussion down that route please guys, thanks

[capt_canada42]

Sunday night I got a notice from Yahoo that suspicious things were going on with my e-mail box, it must be the government trying to go in to people's boxes

[asia_pilot]

True in Bangkok is working fine for me (youtube, hotmail, twitter, CNN ++), no speed issues and IP trace shows no interceptions. can using a proxy be illegal ?? I have been using a proxy to get UK BBC TV and other tv channels for over a year now Ooops...

I would say it would be more illegal to bann those sites. Free speech!!

In Thailand ? Ha ha! Good joke.

[jfchandler]

True DSL connection in BKK

Earlier this morning, my My Yahoo page was hanging and only partly loading, without all the style elements.

But as of 3:45 pm today, everything seems fine, including My Yahoo, CNN, Twitter, Facebook and Google. (I hadn't tried the others earlier in the day).

After reading the posts in this thread, I checked most of the sites variously mentioned as problems...and found none here.

[Steve2UK]

<snip>

5. If a site is blocked here, it usually shows the Royal Thai Police warning, which is a white box of about 5 lines. This comes and goes depending on who is (illegally) enforcing the ban.

<snip>

I used to see that but not for the last few months. More common now is (in Firefox) the less obvious "The connection was reset. The connection to the server was reset while the page was loading" with just the giveaway "w3.mict.go.th" (which itself won't load) tucked away on the bar bottom left of screen.

http://thaicrisis.wordpress.com/ is a blog site I used to access regularly and has been blocked (OK - become inaccessible if that's more accurate) that way for several weeks now. That's on my TOT adsl - though I hear some other ISPs will still connect to it.

[Maestro]

…Anyway, be under no illusions, all internet traffic through Thai ISPs is already proxied, logged and filtered. Some ISP do this better than others, but this is a requirment since 2008. The law (Computer Crimes Act B.E.2550) forces your ISPs need to keep a lot of details about every page you access from Thailand (URL, timestamp, ip source, login ID/phone number/etc.), and retain it for a lot of time.

For anybody interested in reading the Computer Crimes Act B.E. 2550 (2007) I attach an English translation in the PDF format (84KB). It is only nine pages. Source: www.pacific.net.th/inc/download.asp?file=../download/news27_Computer%20Crime%20Act_eng.pdf

--

Maestro

Computer_Crimes_Act_B.E._2550__2007_.PDF

[Wolfie]

Just had to remove another post - please dont post URL's for P0rn sites - thanks

[Teddy3943]

The fact that the government cuts the freedom of mature citizens by blocking websites is a practice one would expect in the former Sovjet Union, North Korea, Birma and China.

Thailand means the country of free people. By no way it is like that! The majority of people in power is very narrow minded and what they don't understand is that in the real free countries the number of crimes, like rape and other crimes the Thai government presumes it's under the influence of internet, is much lower than in the countries where internetsites are blocked.

Why in a beautiful country as Thailand are there so much stupid leaders?

[Jonathanpattaya]

As at 16:15, 14:12:2009 I have no restriction to the sites mentioned although Facebook requested that I review my privacy settings.

Edited December 14, 2009 by Jonathanpattaya

[John]

http://w3.mict.go.th is not supposed to load, it is just where 'banned' sites get redirected to.

Some Thai ISPs run inside their DNS servers a list of banned domain names (mostly porn sites) that the mict gives them, those domains will not resolve and the user sees the browser hang.

Some Thai ISPs redirect port 80 web traffic using a list of banned domains from the mict. This is nothing new, however the sites mentioned in this topic have been added to this list (most likely temporarily).

Thai Immigration's site having malicious scripts and trojans is of course a non-related issue. Because they are running an under construction home page they are aware of the problem, but with browsers still detecting harmful scripts they haven't cleaned their site yet.

[iforget]

Did anyone happen to click on the "Why was this site blocked?" button in the Google warning for the immigration site? It's pretty specific:

What is the current listing status for immigration.go.th?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 10 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 1377 pages we tested on the site over the past 90 days, 134 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-12-13, and the last time suspicious content was found on this site was on 2009-12-13.Malicious software includes 51 exploit(s), 40 scripting exploit(s), 32 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

Malicious software is hosted on 38 domain(s), including

20 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including

This site was hosted on 1 network(s) including AS4750 (CSLOXINFO)

end quote

It wouldn't surprise me if the Immigration site

is

infected. A couple of months ago I went to the Provincial Electricity Authority site (pea.co.th) to sign up for payment by Internet. No Google warning, but my antivirus didn't like it one bit. Alarm bells all over the place. So I'm still schlepping down to the PEA office every month for the privilege of queuing up to give them money.

As to the mict blocking FB etc etc, I'm having no probem at all. But I'm not going to tell you which service I'm using, just in case.....................

[CrossBones]

The fact that the government cuts the freedom of mature citizens by blocking websites is a practice one would expect in the former Sovjet Union, North Korea, Birma and China.

Thailand means the country of free people. By no way it is like that! The majority of people in power is very narrow minded and what they don't understand is that in the real free countries the number of crimes, like rape and other crimes the Thai government presumes it's under the influence of internet, is much lower than in the countries where internetsites are blocked.

Why in a beautiful country as Thailand are there so much stupid leaders?

Why? Because the country is built on an old fashioned class system which rewards people based on their heritage and not on their skills or merits. These people are desperately trying to hang on to their power, by brainwashing their citizens, forcing them to sing national anthem all the time, and spreading propaganda and regulating news. The national curriculum teaches normal Thais that they are a superior race and any thinking outside the box is un patriotic and frowned upon. This gives working class Thais a strong patriotic feeling and a sense of well being.

The rich know this is rubbish since they educate their children overseas.... meanwhile the middle class keep quiet since the only way to survive is to imitate the rich, and enjoy the privileges their mediocre education allows them, the feel respected by the poor and have some power over them.

[elcent]

malicious software also can mean that an infected site downloads cookies to your comp and later on bots will be sent out to visit the cookies to create havoc. I had this issue ones and I was able to trace it back to a dedicated IP address. I blocked the IP, reported to the host, cleared all the cookies and everything was fine then.

I suspect in this particular case a 'black hat SEO' combined with other illegal activities. It's under investigation now.

In other words, suspected hackers looking for carriers of their cookies(normally sites with high traffic) to release their cookies to users' comps ... sending malicious software to their cookies later ... and so the story goes.

The scripts on my site were worked over by security specialists in order to protect the visitors, users and of course ourselves from security attacks. The administrators get detailed info about the attacks and/or attempts and sometime manual correction is required to stop this happening again.

In the cases as reported at the topic it could also be agencies trying to gain access and to sniff you out.

Edited December 14, 2009 by elcent

[taifa]

Amazing journalistic incompetence in merging together two completely unrelated items, and distributing wildly as headline news without any investigation.

Immigration website being blocked by Firefox (and/or Google) is due to hacking that introduced malware to the site. All sites are susceptible to such attacks

Possible blockage of CNN, Yahoo, Facebook, Flickr etc. by Thai authorities is completely unrelated. It may be a technical glitch. Any journalist worth their salt would have called and checked if this is actually censorship by the government

What the heck are you talking about!? None of these sites are 'blocked by the Thai government'. You should edit the headline and story for wildly inaccurate hysterical information.

Reported as an attack site by Firefox? Since when does Firefox report attack websites? Do you understand the difference between your browser and a search engine reporting an attack site?

I would echo that.

What on earth is TV talking about. Certainly a lack of understanding of basics resulting in an hysterical and inaccurate thread heading.

Let me clarify a few things here that are just plainly incorrect, I work in the web publishing industry and have experience with Google's Site Attack Prompts, and web access in general.

1. The warning shown above has got nothing to do with Thailand blocking anything, it is now routinely displayed by new generation browsers based on an extensive database of sites that google has found to contain unusual 'bits' (scripts, links, trojans, malware etc) on the website's server/folder.

^ ditto all the above

[junglist]

Mr. Bones you nailed it on the head. This is why communism spread like wildfire in Asia. If you lack opportunity then you have two courses to fallow. Lie down and die or rise up and change.

[vahack]

It's about time the immigration site got blocked, it's been full of viruses since may this year. I use satellite internet from singapore, a hel_l of a lot cheaper than thailand, and have full access to everything. It's amazing twitter does not get stopped as well, because the PM and Takki use it to communicate.

what company do you use? i need this for the new home we're building. no dsl for many kms.

[asiawatcher]

No problems at all with TOT - all loading as correct, fast and no issue. Seems like a hacker working although MCIT have been known to interfere a lot.

[trogers]

There is an element of truth to infected websites:

http://www.theregister.co.uk/2009/12/10/mass_web_attack/

[thaibkk]

Why? Because the country is built on an old fashioned class system which rewards people based on their heritage and not on their skills or merits. These people are desperately trying to hang on to their power, by brainwashing their citizens, forcing them to sing national anthem all the time, and spreading propaganda and regulating news. The national curriculum teaches normal Thais that they are a superior race and any thinking outside the box is un patriotic and frowned upon. This gives working class Thais a strong patriotic feeling and a sense of well being.

The rich know this is rubbish since they educate their children overseas.... meanwhile the middle class keep quiet since the only way to survive is to imitate the rich, and enjoy the privileges their mediocre education allows them, the feel respected by the poor and have some power over them.

>>> expect the singing (ever been to a football or whatever match, they also sing) USA : thinking they are the best (stupid people who hardly can speak or understand more than 1 language), France (same as US, no need to learn another language as they are the best), Israel - the chosen one's... japanese... etc

[spongeman]

Are the Ladyboy sites ok ?

[xminator]

Anyone that say that THEIR website cant be hacked are at best overconfident. Any sysadmin that aint a shaking coffeeball of paranoia is not doing his/her job. Immigration might have had one of the overconfident types that are still in denial. Using a nix-based system and daily updates are not always a good defence either. I dont know how many times I've seen recent updates full of bugs and open to exploits. The hacker with criminal intent wont be the first to file a bug-report on such things during testing...

Tracert isnt worth much in a situation like this. If an ISP/government is blocking web traffic, the ping (and trace) will most likely get trough. So if trace get trough, but the browser not loading content, you either have a server down or something is blocking web traffic. If multiple sites have this sympthom its either multiple pages sharing the same IP down or blocking. If a range of diffrent hosted websites are down but can trace, you can be 99% sure someone is activly blocking between you and the website. That was the situation today. Accident or on purpose, you'll never get the answer.

If you want to feel safer against man in the middle attacks, and government is to be consideres a man in the middle attack, try to use https:// instead of http. Unfortunatly it looks like most sites these days at best limit the https to login and just redirect to http when you have signed in to for example facebook. Gmail do the same, sign in with https, but you email is not protected. On my companies online email I can use https all the way if I chose to. I guess the government still would have resources to descipher that traffic, but not real time and not close to the volume generated. I would guess certificate costs, the fact that there have been some very widespread exploits on SSL and increased hardware costs is the main reason why so few use https on their websites.

The use of an encrypted connection to a trusted network is the safest way to read your email. Just using opendns will still give mict complete access to read your email if they chose to single you out. You best defence here is the amount of traffic. Your very likely to remain anonymous and get away with most things until someone targets you specificaly. And then the use of mechanism to encrypt your traffic will be viewed as reason for suspicion. Something the average farang in thailand want to stay away from attracting in the first place ...

[BigWheelMan]

Maxnet indy - Chiang Mai.

NO PROBLEMS.

[CrossBones]

Why? Because the country is built on an old fashioned class system which rewards people based on their heritage and not on their skills or merits. These people are desperately trying to hang on to their power, by brainwashing their citizens, forcing them to sing national anthem all the time, and spreading propaganda and regulating news. The national curriculum teaches normal Thais that they are a superior race and any thinking outside the box is un patriotic and frowned upon. This gives working class Thais a strong patriotic feeling and a sense of well being.

The rich know this is rubbish since they educate their children overseas.... meanwhile the middle class keep quiet since the only way to survive is to imitate the rich, and enjoy the privileges their mediocre education allows them, the feel respected by the poor and have some power over them.

>>> expect the singing (ever been to a football or whatever match, they also sing) USA : thinking they are the best (stupid people who hardly can speak or understand more than 1 language), France (same as US, no need to learn another language as they are the best), Israel - the chosen one's... japanese... etc

Yep!

[DegenFarang]

Would be terrible if true, especially Facebook. No better way to meet nice young Thai girls on the internet - thankfully still working for me at the moment.

[ScienceGuy]

Over the past 90 days, immigration.go.th appeared to function as an intermediary for the infection of 3 site(s) including samui-immigration.com/, tkc.go.th/, police.go.th/.