Is it really possible?

In order to understand whether the encrypted internet traffic can be decrypted by someone who sniffed your ISP's network, we should first understand how cryptography works with internet communications. So, let's dig.

If you're interested in the cryptography part only, then head to lesson no. 3 directly.

Lesson no. 1 — Transmission Control Protocol (TCP)

Two weeks ago I published a blog post explaining about Internet Protocol (IP) addresses and network packets. I explained how every file transmitted on the internet is first broken into pieces called packets and each packet has a header and payload.

Internet Protocol (IP) packet headers contain the source and destination addresses. When all the units of a packet reach their destination and are reconstructed into one data packet, the receiving device needs to know what application should handle this packet. This is what the Transmission Control Protocol (TCP) does.

TCP's role is to ensure reliable transmission of packets. TCP is used on top of the Internet Protocol and they are commonly referred to as the TCP/IP suite. When a packet is sent over the internet, the data portion of an IP packet is wrapped in a TCP segment.

Thus, the data packet now has the additional information about source port number and destination port number. Before we understand what is the meaning of these two additional source/destination values, let's have a look at how a TCP connection is made between two devices.

Because packets can sometimes get lost in a network, TCP has to establish a reliable connection between two devices. These two devices can be a smartphone and the facebook.com server for example. TCP ensures the reliable connection by doing a three-way handshake. What does that mean?

The above image shows the TCP header with the ACK and SYN bits in red. These two bits are turned on and off to start the three-way handshake. The smartphone sends a packet to facebook.com with the SYN bit on. This basically means that the smartphone wants to synchronise with the facebook.com server. The server will respond by sending back a packet with both the SYN and ACK bits on. Upon receiving this, the smartphone will send another packet to the facebook.com server with the ACK bit on. The successful delivery of these packets concludes that each of them are able to establish a reliable communication and thus a TCP session starts between the two devices.

SYN means synchronise, ACK means acknowledge and when I say the bit is turned on, I mean the value of this bit is 1 instead of zero.

Once a TCP session is established, data packets can be sent back and forth for communication.

Lesson no.2 — Application Layer Protocols

Quick recap, the IP header contains the source IP address and the destination IP address, while the TCP header contains the source port number and the destination port number.

These port numbers refer to application layer protocols. A web server, like Apache, serves webpages using the Hypertext Transfer Protocol (HTTP) over the TCP port 80. The same web server will use the Hypertext Transfer Protocol Secure (HTTPS) protocol over the TCP port 443.

Therefore, when the smartphone establishes a TCP session with facebook.com and sends a request to visit https://facebook.com, the TCP packet will check the destination port and deliver the packet to the web server listening on TCP port 443.

However, in order for Apache to deliver a secure transmission it makes use of another protocol called the Transport Layer Security (TLS). Here comes encryption!

Lesson no. 3 — Transport Layer Security (TLS) Protocol

The Transport Layer Security (TLS) is a cryptographic protocol designed to render our internet communication secure. It does so by encrypting our internet traffic.

Encryption is the process of converting human readable plain text to completely incomprehensible text.

The above diagram depicts a symmetric encryption process and perhaps a lot of people are thinking that encryption of messages on the internet occurs this way. Thus, someone getting the « key » could basically decrypt all encrypted messages. Encryption of internet communication is a lot more complex that this.

TLS 1.0 was defined in RFC 2446 back in 1999. Currently, the latest recommendation for TLS is to implement version 1.2 and 1.3 and to completely drop the use of the Secure Sockets Layer (SSL) protocol, the predecessor of TLS.

Despite the deprecation of SSL, it still lives in the security jargon and is found in the names of major security-related applications, e.g OpenSSL, SSL certificate providers etc.

An RFC is a document that contains technical specifications for the internet. RFC documents are produced by the Internet Engineering Task Force.

Let's talk about TLS encryption now.

Encryption of internet communication over HTTPS is achieved by applying the TLS protocol using a combination of symmetric and public-key cryptography.

In symmetric cryptography the key to encrypt and the key to decrypt is the same, whereas in public-key cryptography the encryption and decryption keys are different.

To better understand public-key cryptography, have a look at the above diagram. Then, imagine someone communicating on Facebook. The way the encryption works here is that Facebook has two keys – a public key and a private key. The private key is stored on the Facebook servers and it is never shared or transmitted on the Internet while communicating with Facebook.

Facebook sends its public key to a user, using which the latter can encrypt a piece of information and send back to the Facebook servers. This encrypted information cannot be decrypted using the public key again. It can only be decrypted using the private key that only Facebook holds.

If someone intercepts the internet traffic and gets a copy of the encrypted information intended for Facebook, then that person cannot read the actual information. The captured data will be useless.

Symmetric vs Public-key cryptography

Symmetric cryptography is fast. It can complete an operation within nanoseconds. Public-key cryptography is slower, taking microseconds to milliseconds per operation.

Therefore, TLS uses both to ensure that data transmission is secure, reliable, cannot be decrypted in trasit and at the same time transmission is fast.

It does so by initiating a public-key exchange to securely share a secret key. That secret key is then known only to the user and the receiver, e.g Facebook. The use of public-key cryptography for sharing session secrets (keys) ensures that the secret won't be captured and decrypted while in transit. Thus, further communication between the user and Facebook can be done using symmetric cryptography once the shared secret is exchanged using public-key cryptography.

Ciphers

The strength of encryption depends on the cipher user. A cipher is an algorithm that performs that actual encryption. A cipher itself is based on mathematical formulae. For example, the Diffie-Hellman key agreement algorithm is considered a major breakthrough in cryptography. It is widely used in public-key cryptography. Weak ciphers can be broken using fast computers. It's very common for organisations to carry out a vulnerability assessment of their IT infrastructure to find such weaknesses and apply the industry best practices.

Lesson no. 4 — SSL/TLS Certificates

So far we've seen how TLS sessions ensure secure communication. But what about trust? How can we be sure that the server presenting itself as facebook.com is actually Facebook's server and not a cybercriminal diverting the internet traffic to another server that pretends to be Facebook.

This is achieved by establishing a chain of trust through a Public Key Infrastructure (PKI).

A Public Key Infrastructure governs the issuance and management of digital certificates. These certificates follow the X.509 standard for public-key certificates defined by the International Telecommunication Union (ITU).

What you should know about this is that there are organisations called Certificate Authorities (CA) and they issue certificates to other organisations who need to certify their domain names as secure. These CAs are recognised by the operating systems (e.g Microsoft Windows, Apple macOS, Linux distributions) and browser makers. Therefore, when a certificate is presented by a web server to a browser, ascertaining a domain name, the browser looks at who issued the certificate first. If that Certificate Authority is in its trusted list then only it'll trust the website and display the secure padlock in the address bar.

Otherwise, the website or application throws an error and complains about untrusted connection.

In Google Chrome, if you click on the padlock, then click Connection is secure > Certificate is valid, a window pops up showing the details of the certificate, like when it expires and which Certificate Authority issued the certificate.

In the above screenshot, you can see that the certificate was issued by DigiCert intermediary CA for the facebook.com domain. DigiCert is also the Root CA in this chain. Google Chrome trusts the DigiCert Root CA and hence trusts the chain that follows.

DigiCert verifies the domain ownership before issuing certificates. It's not like anyone can just buy a certificate for any domain on the internet.

Therefore, if someone else generates a certificate for facebook.com and presents itself as facebook.com to Google Chrome, then the latter will prompt the user that the website cannot be trusted.

Conclusion

Finally, in this blog post, if you read the whole of it and the one I wrote about network sniffing, then by now you must know how secure internet communications occur and why it is not just something that one can break or decrypt.

Therefore, summarising it, remember that the Internet Protocol (IP) is responsible for addressing on the internet. It specifies the source and destination address of packets. These packets are able to travel the world and reach their intended destination reliably thanks to the three-way-handshake defined in the Transmission Control Protocol (TCP). To secure the communication over TCP, web servers use the Hypertext Transfer Protocol Secure (HTTPS) and Transport Layer Security (TLS) to encrypt information using a combination of symmetric and public-key cryptography. The strength of the encryption depends on the cipher that is used. Lastly, X.509 formatted certificates are used to help browsers and mobile applications trust the domains that host the websites and other content on the internet.

I created the cryptography diagrams using Figma and images from flaticon.com.

Last Tuesday, the Prime Minister of Mauritius, P. K. Jugnauth, was replying to a question asked by a Member of Parliament, E. Juman, during the first session of the parliamentary debate.

P. K. Jugnauth confirmed that the Security Division of his office had requested the former CEO of Mauritius Telecom, S. Singh, to extend all necessary assistance to a three-member technical team from India who would field a survey mission at the South Africa Far East (SAFE) Submarine Landing Station at Baie Jacotet, Bel Ombre.

P. K. Jugnauth stated that in the morning of 15 April 2022, he was informed that Mauritius Telecom had not made the necessary arrangements for the team to have access at the Landing Station. Therefore, he telephoned the former CEO of Mauritius Telecom, S. Singh, and asked him to make arrangements for the survey to be carried out.

The SAFE Submarine Cable Landing Station at Baie Jacotet was declared a restricted area through Government Notice 183 of 2004. The decision was taken by the cabinet on 8 October 2004 and the SAFE SCLS at Baie Jacotet has been a restricted area since 11 November 2004 in accordance with Section 13B of the Police Act.

What is a restricted area?

Section 13B of the Police Act defines the meaning of a restricted area in Mauritius. It states that —

(1) The Commissioner may, where he considers it necessary or expedient 
    in the interest of public safety or public order, order that 
    special measures be taken to control the movement and conduct of 
    persons in any area, and, by Order, declare that area to be a 
    restricted area.

(2) (a) The Commissioner may issue to a person a permit authorising
        him to enter and leave a restricted area.
    (b) The permit may be issued subject to such conditions as the
        Commissioner thinks fit to impose and may be cancelled.

What do we know about conditions to access the landing station?

Until now, neither S. Singh nor P. K. Jugnauth, has provided any information regarding the conditions set by the Commissioner of Police in order to access the SAFE Submarine Cable Landing Station.

Thus, we do not know whether the staff personnel of Mauritius Telecom can access the landing station at any day and any time, whether they need to inform the Commissioner of Police of such access, whether they can bring people who are not personnel of Mauritius Telecom along with them, whether the identity of the people should be disclosed to the Commissioner of Police, etc.

Context

30 June 2022 — Sherry Singh resigns as CEO of Mauritius Telecom.

1 July 2022 — Nawaz Noorbux of Téléplus, Défi Media, interviews Sherry Singh. The latter discloses the reason behind his resignation. He says that the Prime Minister, P. K. Jugnauth had phoned him to ask him to do something which is illegal, against the interests of Mauritius Telecom, against the interests of the citizens of Mauritius, against the country and against certain friendly states. Nawaz asks him what is it exactly. Singh says that P. K. Jugnauth phoned him to give him instructions to allow a third-party to install equipments in Mauritius Telecom which will sniff all incoming and outgoing Internet traffic in Mauritius.

6 July 2022 — P. K. Jugnauth confirms that he had a phone conversation with the S. Singh and that he had asked him to give a technical team access to the Baie Jacotet Landing Station. He says that at no moment during the conversation he mentioned a sniffing equipment. While answering a journalist regarding the third-party, he says that there was a matter of security and that there was a need for the survey. He says that in Mauritius we do not have the technicians that can do such a survey, or even if there are, he decided to hire foreign technicians. He says that he spoke to the Prime Minister of India, N. Modi, to get a team of technicians that can do the survey.

12 July 2022 — Prime Minister, P. K. Jugnauth, while replying to a question in the National Assembly, confirms that he has lodged a police complaint against S. Singh.

12 July 2022 — Axcel Chenney of l'express interviews Sherry Singh who promised further revelations. Singh described chronologically what led to his resignation. Axcel says that the Prime Minister has denied any attempt for surveillance and questions Singh that he is saying the opposite. Singh confirms that it was about surveillance. Singh also confirms that the technical team did several « interventions » in the network and that he has proof. He does not show any proof during the interview. He says he will provide all proofs to the authorities when the time comes.

Update

S. Moonesamy replied to my tweet about this article and indicated that companies who have to maintain their equipment at the Baie Jacotet SCLS have to designate the persons who should be granted access to the site and the identity of the persons would be in a log book.

The document that S. Moonesamy referred to in his tweet is Mauritius Telecom's Master Agreement for Inter-Connection at the Submarine Cable Landing Station.

An explanatory memorandum to Cross-Connection at the Submarine Cable Landing Station (SCLS), published by the Information & Communication Technologies Authority (ICTA) provides details about the Baie Jacotet SCLS and includes a copy of Mauritius Telecom's Master Agreement.

Page 13 of the document includes a site plan of the Baie Jacotet SCLS.

The site plan provides a layout of the building and which section the building contains Consortium's infrastructure and which section contains Mauritius Telecom's infrastructure.

In an interview given to Sunday Times, R. Valayden, the Chief Editor of Capital Media provided some details about the persons who had access to the Baie Jacotet SCLS on 15 April. Details that no other media outlet has published so far. I quote what he said in the interview —

Selon mes recoupements, vers 12h58, trois véhicules sont arrivés. La première voiture, une Mercedes, était conduite par Girish Guddoy, ‘Chief Technical Officer’ (CTO) de MT. Le ‘Manager’ de MT était au volant de la deuxième voiture, une Hyundai. Et la dernière voiture, une Honda Vezel, avait, à son bord, trois ressortissants étrangers. Les agents de la SMF ont été informés par le CTO que tous les occupants du véhicule sont des employés de MT et que leur visite ne devait pas figurer sur le registre. Les deux cadres de MT ont ensuite introduit les étrangers dans la salle des opérations. Le CTO de MT a demandé au personnel sur place de se retirer et a prononcé les mots « Top Secret ». Les techniciens étrangers n’ont pas accédé au câble SAFE mais se sont concentrés sur le panel en utilisant un logiciel médiateur (‘middleware’). L’intervention sur chaque connexion nécessite d’abord un court-circuitage occasionnant une panne de 30 secondes lors de la connexion du logiciel et idem lors de la déconnexion. Le ballotage de 60 secondes est inévitablement répercuté dans les rapports techniques. L’équipe est partie vers 19h15. C’est le ‘Manager’, un des cadres les plus aguerris de MT, qui a assisté les techniciens étrangers alors que son chef hiérarchique se rongeait les ongles à l’extérieur.

R. Valayden, for obvious reasons, did not reveal his source of information, but one could imagine that it must be coming from one of the MT employees present during the visit.

R. Valayden said that S. Singh had both moral and legal responsibilities to refuse such a request coming from the Prime Minister, since Singh had all executive powers to do so.

He also casts doubts on the claims of S. Singh, saying that in spite of Singh not receiving a formal request for the survey by the Prime Minister, Singh could still follow up by an email the same day to keep it on record.

These directions require Data Centers, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers to:

• synchronise their ICT systems clocks with the Network Time Protocol (NTP) server of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL),
• report cyber incidents within 6 hours to CERT-In,
• designate a Point of Contact to interface with CERT-In,
• maintain logs for a period of 180 days,
• register the following information accurately and maintain them for a period of 5 years:
  a) validated names of subscribers / customers hiring the services,
  b) period of hire including dates,
  c) IPs allotted to / being used by the members,
  d) email address and IP address and time stamp used at the time of registration / on-boarding,
  e) purpose for hiring services,
  f) validated address and contact numbers,
  g) ownership pattern of subscribers / customers hiring services.

As a result of these privacy-shattering instructions, NordVPN has shut down its servers in India since 26 June 2022. However, NordVPN services are still available in India.

ExpressVPN says that it refuses to participate in the Indian government's attempts to limit Internet freedom.

They have removed their servers from India and instead they are providing VPN servers located in Singapore and the UK with Indian IP addresses. Users may select the VPN server location "India (via Singapore)" or "India (via UK)".

I replied to her that it is not «swindler» but network sniffer.

In this blog post I try to explain what is a network sniffer device or software? But before we understand that there a few things we should become familiar with.

I think most of the Internet users today know that every device connected to the Internet is identified by a string of numbers called the IP address. A phone number is the identifier of a physical telephone. Phone numbers allow calls to be made among fixed telephones and mobile phones. Similarly, devices connected to the Internet are able to find each other and initiate communication protocols using the IP address of each device.

Lesson no. 1 — Internet Protocol (IP) addresses

Your computer, mobile phone and Smart TV in your house, each one is assigned a private IP address by your router (which is usually given to you by your Internet Service Provider, e.g Mauritius Telecom or Emtel).

An example of a private IP address is 192.168.100.10. All devices connected to the WiFi of your home router will have IP addresses in that range (192.168.100.11, 192.168.100.12, etc). These addresses are assigned to your home devices by the ISP router and they allow your devices to communicate with each other. The IP addresses are not reachable from the Internet. Therefore, if I need to communicate with your smartphone at your place, which has an IP address of let's say, 192.168.100.10, then I won't be able to do so from the comfort of my home, because that address is not reachable from the Internet.

For communication to happen on the Internet, public IP addresses are required. Your ISP provides you a router which is also a modem. The modem connects to your ISP network and a public IP address is assigned to it which is unique on the Internet. This IP address allows you to communicate on the Internet.

When you open Netflix on your Smart TV, the request is sent to your router first and from there it is the router that sends the request on the Internet, to the Netflix server. Your router knows which of your devices made the request and therefore when a response is received from Netflix, it forwards that information to your Smart TV.

The range of IP addresses 197.224.0.0 – 197.225.255.255 is allocated to Mauritius Telecom by AFRINIC (the Regional Internet Registry for Africa & the Indian Ocean region). Many such IP address ranges are allocated to Mauritius Telecom and other Internet Service Providers in Mauritius. There are five Regional Internet Registries in the world that allocate the use of the IP addresses to organisations such as ISPs, universities, cloud companies, etc.

Lesson no. 2 — Network Packets

Okay, now we know how the Smart TV sends a request to Netflix on the Internet and it receives a response. Let's see what are the requests and responses made of.

When someone needs to send a picture to somebody over the Internet, let's say using WhatsApp, that picture isn't sent as single item over the network. It is broken down into many pieces before it is sent over. The pieces travel from one router to another, across the world, until they reach the intended destination (which is another device, e.g a smartphone). At the destination device, all the pieces are reassembled to make up the picture like it was on the sender's device.

These small pieces are called packets. One may rightly ask, how many packets is a single JPEG file broken into before sending over the network?

The number of packets may vary depending on how network devices are configured. Network devices such as routers are configured to allow a maximum size for a single packet. This is referred to as the Maximum Transmission Unit (MTU) and it's usually 1500 bytes. Therefore, we could say that a 1 MB JPEG file would be broken into about 665 pieces of ~1500 bytes each before it is sent to someone on the Internet.

It is that single piece of 1500 bytes data that is called a packet.

A packet itself is composed of two parts.

• a header
• a payload (also referred as data)

Header

The header part contains information about the source, destination, protocol and packet number. This information is important for the routers to know where to send the packet and upon reaching its destination how the packets needs to be reassembled. The header part is not encrypted because this information should be readable by all networking devices that will carry the packet until its final destination.

Payload

The payload is the actual data that needs to be sent. In the example of the 1 MB JPEG file, the payload of the packet will contain part of the image data. If an encrypted communication is established on the Internet, then this payload will contain part of that encrypted data.

If the payload is not encrypted, then the packets can be captured by a network analysis tool (a sniffer) and the complete file reconstructed, e.g a 1 MB JPEG file can be reconstructed and viewed in any image application.

If the payload is encrypted, then the packets can be still be captured by the tool and the reconstructed file will be an encrypted JPEG file.

Network Sniffer

The former CEO of Mauritius Telecom, S. Singh, stated in a radio programme on Friday 1st July 2022 at 17h00, that the Prime Minister of Mauritius, asked him to allow a third-party to install a network sniffer in the premises of the ISP.

The statement by S. Singh shook many people and it sends chills down the spine thinking that the biggest Internet Service Provider could be breaching the privacy of hundreds of thousands of Internet users in Mauritius.

But, wait a minute? In his statement, S. Singh did not reveal the name of the third-party and the actual device or software that intended to sniff the Internet traffic. Unless those information are revealed, one can only speculate on sinister possibilities.

That being said, now let's look at what does a Network Sniffer do.

A network sniffer is a tool that can capture network packets and analyse them. Some network sniffers can even reconstruct whole files if the payload is not encrypted or do signature-based Deep Packet Inspection (DPI) on the payload to identify its nature if the payload is encrypted.

There are network sniffers that are also capable of man-in-the-middle (MITM) attacks. Therefore, they can decrypt the network traffic and give a complete view of everything that a person does on the Internet.

How are network packets captured?

A network sniffer can be installed on any device to capture the traffic of that particular device. For example, if someone wants to analyse his/her own incoming & outgoing traffic on a laptop, a sniffer can be instructed to capture the traffic from a network interface, which can be an ethernet (cable) port or a WiFi.

Some routers also allow packet capturing from the router's ports and the file produced during the capture can be analysed using other tools.

Enterprise-grade firewalls are often equipped with advanced network packet capturing and Deep Packet Inspection (DPI) capabilities.

Clearing confusions

In 2021, the Information and Communication Technologies Authority (ICTA) proposed amendments to the ICT Act, which would have allowed the authority to apply an MITM approach and control the Internet traffic in Mauritius.

It had also become public knowledge, that ICTA intended to use Netsweeper which had the MITM capabilities to decrypt HTTPS traffic.

Many organisations, including international privacy-focussed organisations, browser makers, and the citizens of Mauritius strongly opposed the proposal and condemned the authority to even think of such an approach.

At that time, I made a proof-of-concept using a web proxy called Fiddler Everywhere, to demonstrate how HTTPS traffic can be decrypted on the fly.

It's been a week since S. Singh's statement on radio and we still do not have any information regarding which software maker and what type of «sniffer» was the subject of discussion between Singh and the Prime Minister.

Therefore, what we can retain here is that if Mauritius Telecom would have installed a sniffer without doing any MITM attack, then it would have to rely on signature-based Deep Packet Inspection. That approach would not have given MT employees access to your email messages, listen to your WhatsApp calls or read your Facebook messages, etc. It would have allowed the tool to reconstruct your browsing history partly.

Can an ISP monitor the Internet traffic of all its subscribers?

An ISP could decide whether to monitor and capture the traffic of all its subscribers, some of them or a just a few.

Is it not costly to monitor such amount of Internet traffic?

Deep Packet Inspection on a high traffic network is costly, indeed. However, using a network tap, the ISP can copy the traffic of a specific network segment or specific IP addresses, for analysis, without impeding the actual traffic. There are several approaches that can reduce the cost of operation.

Can a third-party have access to the network traffic?

If a third-party operates the network device or the «sniffer» then yes, it can have access.

Erratum

I initially described the packet as being composed of three parts – header, payload (data) and footer. After S. Moonesamy pointed out on the Mauritius Internet Users mailing list to check whether the footer part is incorrect, I read Section 3.1 of the RFC 791 – Internet Protocol to cross-verify. Section 1.3 of the same RFC describes an example where a TCP module would call on the internet module to take a TCP segment (including the TCP header and user data) as the data portion of an internet datagram. These information provide clarity on the packet composition as having a header and the data.

There are articles online that refer to the packet as a frame and then mention the frame as having a "trailer" part. The trailer is mentioned in RFC 1661 – Point-to-Point Protocol (PPP).

RFCs are documents that contain technical specifications for the Internet. They are produced by the Internet Engineering Task Force. Software developers, hardware manufacturers, and network operators around the world voluntarily implement and adopt the technical specifications described by RFCs.

The Indian Cyber Crime Coordination Centre recommended that the apps should be blocked. The Computer Emergency Response Team (CERT-IN) received complaints from citizens regarding security of data and breach of privacy.

Below is the list of apps as published by the Press Information Bureau of the Government of India.

TikTok
Shareit
Kwai
UC Browser
Baidu map
Shein
Clash of Kings
DU battery saver
Helo
Likee
YouCam makeup
Mi Community
CM Browers
Virus Cleaner
APUS Browser
ROMWE
Club Factory
Newsdog
Beutry Plus
WeChat
UC News
QQ Mail
Weibo
Xender
QQ Music
QQ Newsfeed
Bigo Live
SelfieCity
Mail Master
Parallel Space
Mi Video Call – Xiaomi
WeSync
ES File Explorer
Viva Video – QU Video Inc
Meitu
Vigo Video
New Video Status
DU Recorder
Vault- Hide
Cache Cleaner DU App studio
DU Cleaner
DU Browser
Hago Play With New Friends
Cam Scanner
Clean Master – Cheetah Mobile
Wonder Camera
Photo Wonder
QQ Player
We Meet
Sweet Selfie
Baidu Translate
Vmate
QQ International
QQ Security Center
QQ Launcher
U Video
V fly Status Video
Mobile Legends
DU Privacy