Carmen Kwan, P. Janiszewski, Shela Qiu, Cathy Wang, Cecylia Bocovich
{"title":"Exploring Simple Detection Techniques for DNS-over-HTTPS Tunnels","authors":"Carmen Kwan, P. Janiszewski, Shela Qiu, Cathy Wang, Cecylia Bocovich","doi":"10.1145/3473604.3474563","DOIUrl":"https://doi.org/10.1145/3473604.3474563","url":null,"abstract":"While DNS tunneling has shown promise as a censorship circumvention technique, it is limited by the plaintext nature of the DNS protocol, which renders it easily detectable to censors. DNS-over-HTTPS (DoH) [16] resolves this detectability obstacle, by encrypting the entire DNS protocol inside HTTPS. DoH tunneling shows promise as a medium for circumvention as its adoption increases in everyday usage, but it may still be vulnerable to flow-based attacks. This paper explores the design space of threshold-based attacks and defences on encrypted DNS tunnels. We identify thresholds separating tunnel traffic from browser-generated DoH traffic using packet size, packet rate, and throughput. We further propose modifications for encrypted DNS tunnels to evade flow-based detection and measure the reduction in usability. Notably, throughput is decreased by at least 27x and page load time is increased by at least 23x. However, despite the cutback in usability, we outline the potential for DNS tunnels to work in conjunction with, and obfuscate the registration traffic of, other anti-censorship tools.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"86 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116745206","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Measuring QQMail's automated email censorship in China","authors":"Jeffrey Knockel, Lotus Ruan","doi":"10.1145/3473604.3474560","DOIUrl":"https://doi.org/10.1145/3473604.3474560","url":null,"abstract":"Desiring to control political ideas shared within its borders, China fosters its own domestic Internet communications platforms where it can better enforce its laws and more tightly control political expression. Access to foreign platforms failing to comply with China's requirements on speech restrictions are often wholesale blocked by the country's national firewall. However, some technologies, such as the Web and email, are too universal to wholesale block and are restricted discriminately. While China's restrictions to Web access have been extensively studied, our work provides a look into email censorship in China. In this work, we study censorship on Tencent's QQMail, the most popular email platform in China. We introduce a technique to test whether QQMail automatically censors a message, without requiring control of any Internet endpoints in China or any accounts on the QQMail platform, finding 173 combinations of keywords that trigger automated censorship of multiple political topics. We also discover that some censored keyword combinations have extenuating keyword combinations, any of whose presence disables the corresponding censored combination's censorship. Many of these extenuating terms are as politically sensitive as the censored combinations they are extenuating. We find that the motivation behind such extenuating terms is puzzling, defying easy explanation.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134436160","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"BlindTLS: Circumventing TLS-based HTTPS censorship","authors":"Sambhav Satija, Rahul Chatterjee","doi":"10.1145/3473604.3474564","DOIUrl":"https://doi.org/10.1145/3473604.3474564","url":null,"abstract":"Governments across the globe limit which sites their citizens can visit by employing multiple kinds of censorship techniques for different types of traffic. ISPs have been able to effectively censor HTTPS traffic by inspecting the TLS handshake which leaks the domain being visited. TLS1.3 attempts to solve this with a proposed ESNI extension which encrypts the SNI (server name indication) value. Since ESNI is optional, ISPs have been known to simply drop handshakes that attempt to use it; SNI based censorship is therefore still a problem even in TLS1.3. We present BlindTLS, a technique that hides the true SNI value in TLS1.2. BlindTLS requires no server modifications and expects only minimal (existing) external infrastructure to circumvent TLS-based censorship. We evaluate and show that BlindTLS is able to successfully provide access to a majority of websites blocked by a real-world ISP with minimal performance overhead.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116784809","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"On the state of V3 onion services","authors":"Tobias Hoeller, Michael Roland, R. Mayrhofer","doi":"10.1145/3473604.3474565","DOIUrl":"https://doi.org/10.1145/3473604.3474565","url":null,"abstract":"Tor onion services are a challenging research topic because they were designed to reveal as little metadata as possible which makes it difficult to collect information about them. In order to improve and extend privacy protecting technologies, it is important to understand how they are used in real world scenarios. We discuss the difficulties associated with obtaining statistics about V3 onion services and present a way to monitor V3 onion services in the current Tor network that enables us to derive statistically significant information about them without compromising the privacy of individual Tor users. This allows us to estimate the number of currently deployed V3 onion services along with interesting conclusions on how and why onion services are used.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130264136","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Interactions with Potential Mis/Disinformation URLs Among U.S. Users on Facebook, 2017-2019","authors":"Aydan Bailey, Theo Gregersen, Franziska Roesner","doi":"10.1145/3473604.3474561","DOIUrl":"https://doi.org/10.1145/3473604.3474561","url":null,"abstract":"Misinformation and disinformation online---and on social media in particular--- have become a topic of widespread concern. Recently, Facebook and Social Science One released a large, unique, privacy-preserving dataset to researchers that contains data on URLs shared on Facebook in 2017-2019, including how users interacted with posts and demographic data from those users. We conduct an exploratory analysis of this data through the lens of mis/disinformation, finding that posts containing potential and known mis/disinformation URLs drew substantial user engagement. We also find that older and more politically conservative U.S. users were more likely to be exposed to (and ultimately re-share) potential mis/disinformation, but that those users who were exposed were roughly equally likely to click regardless of demographics. We discuss the implications of our findings for platform interventions and further study towards understanding and reducing the spread of mis/disinformation on social media.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"177 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116210455","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Even Censors Have a Backup: Examining China's Double HTTPS Censorship Middleboxes","authors":"Kevin Bock, Gabriel Naval, Kyle Reese, Dave Levin","doi":"10.1145/3473604.3474559","DOIUrl":"https://doi.org/10.1145/3473604.3474559","url":null,"abstract":"The Great Firewall of China (GFW) has long censored HTTPS (via the Server Name Indication field, or SNI). Its mechanism for doing so has been studied, with various evasion strategies discovered in recent years. In this paper, we have evidence that suggests the GFW has deployed a second HTTPS censorship middlebox that runs in parallel to the first. We present a detailed analysis of this secondary censorship middlebox---how it operates, the content it blocks, and how it interacts with the primary middlebox---and present evidence that this has been in operation since at least September 2019. We also present several packet-based evasion strategies for the secondary middlebox and demonstrate that the primary censorship middlebox can be defeated independently from the secondary. Our code is publicly available.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"29 3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115990299","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ramakrishna Padmanabhan, Arturo Filastò, Marianna Xynou, R. Raman, Kennedy Middleton, Mingwei Zhang, Doug Madory, Molly Roberts, A. Dainotti
{"title":"A multi-perspective view of Internet censorship in Myanmar","authors":"Ramakrishna Padmanabhan, Arturo Filastò, Marianna Xynou, R. Raman, Kennedy Middleton, Mingwei Zhang, Doug Madory, Molly Roberts, A. Dainotti","doi":"10.1145/3473604.3474562","DOIUrl":"https://doi.org/10.1145/3473604.3474562","url":null,"abstract":"In the wake of a military coup in February 2021, Myanmar experienced unprecedented levels of Internet censorship. Beginning with haphazard blocking of social media and intermittent Internet connectivity outages, controls proceeded to stricter blocking of websites, the shutdown of cellular data in several networks, and nearly complete disconnection from the Internet every night. In this study, we use diverse datasets and measurement methods to offer a holistic view into the censorship events in Myanmar that occurred since the coup and show how Internet censorship evolved during this time.","PeriodicalId":400223,"journal":{"name":"Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet","volume":"337 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115422777","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}