Upload File

genevacensorship evasion research evade 1 understand how censors operate 2 apply insight to create...

  • Home
  • Documents
  • GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage
112
Kevin Bock Geneva: Evolving Censorship Evasion

Upload: others

Post on 10-Aug-2020

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Kevin Bock

Geneva: Evolving Censorship Evasion

Page 2: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 3: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 4: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 5: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 6: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 7: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 8: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 9: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Page 10: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Spoofed tear-down packets

Page 11: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Spoofed tear-down packets

Page 12: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Spoofed tear-down packets

Page 13: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Spoofed tear-down packets

Page 14: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

The client terminated

The server terminated

Spoofed tear-down packets

Page 15: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

The client terminated

The server terminated

Requires per-flow state

Spoofed tear-down packets

Page 16: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

The client terminated

The server terminated

Requires per-flow state

Censors necessarily take shortcuts

Spoofed tear-down packets

Page 17: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 18: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

TTL=2

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 19: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

TTL=1

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 20: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

TTL=1

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 21: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

TTL=0

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 22: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 23: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

In-network censorship by nation-states

Client Server

Still good

The client terminated

Requires per-flow state

Censors necessarily take shortcuts

Evasion can take advantage of these shortcuts

Page 24: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Censorship evasion research

EvadeMeasureHypothesize

Page 25: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Censorship evasion research

Evade

Understand how censors operate1

MeasureHypothesize

Page 26: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Censorship evasion research

Evade

Understand how censors operate1

Apply insight to create evasion strategies2

MeasureHypothesize

Page 27: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Censorship evasion research

Evade

Understand how censors operate1

Apply insight to create evasion strategies2

Largely manual efforts give censors the advantage

MeasureHypothesize

Page 28: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Censorship evasion research

Evade

Understand how censors operate1

Apply insight to create evasion strategies2

Largely manual efforts give censors the advantage

MeasureHypothesize

Our work gives evasion the advantage

Page 29: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

AI-assisted censorship evasion research

Evade MeasureHypothesize

Page 30: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

AI-assisted censorship evasion research

Evade

Use AI to automatically learn new evasion strategies1

MeasureHypothesize

Page 31: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

AI-assisted censorship evasion research

Evade

Use AI to automatically learn new evasion strategies1

Use the strategies the AI finds to understand how the censor works

2

MeasureHypothesize

Page 32: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Evade

Use AI to automatically learn new evasion strategies1

Use the strategies the AI finds to understand how the censor works

2

MeasureHypothesize

Page 33: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

TA

CG

Composition MutationBuilding Blocks Fitness

Page 34: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Client Server

Page 35: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva runs strictly at one side

GenevaGenetic Evasion

Building Blocks

Client Server

Manipulates packets to and from the client

Page 36: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Manipulates packets to and from the client

Duplicate

Tamper

Fragment

Drop

Page 37: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Manipulates packets to and from the client

Duplicate

Tamper

Fragment

Drop

Alter or corrupt any TCP/IP header field

No semantic understanding of what the fields mean

Page 38: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Manipulates packets to and from the client

Duplicate

Tamper

Fragment

Drop

Fragment (IP) or Segment (TCP)

Alter or corrupt any TCP/IP header field

No semantic understanding of what the fields mean

Page 39: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

Composition Mutation Fitness

Page 40: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

Composition Mutation Fitness

Page 41: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Genetic Evasion

Geneva

Composition

Page 42: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 43: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 44: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 45: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 46: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 47: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

TTL=8

TTL=2

Page 48: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

TTL=2

Page 49: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

TTL=2

Page 50: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 51: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Running a Strategy

Client Server

Composition

Page 52: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

Composition Mutation FitnessActions compose

to form trees

Tampertcp.flags = R

Tamperip.ttl = 2

Duplicate

out:tcp.flags=A

Page 53: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

Composition Mutation FitnessActions compose

to form trees

Tampertcp.flags = R

Tamperip.ttl = 2

Duplicate

out:tcp.flags=A

Page 54: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

CompositionActions compose

to form trees

MutationRandomly alter types,

values, and trees

Fitness

Tampertcp.flags = R

Tamperip.ttl = 2

Duplicate

out:tcp.flags=A

Page 55: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

FitnessBuilding Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

CompositionActions compose

to form trees

MutationRandomly alter types,

values, and trees

Tampertcp.flags = R

Tamperip.ttl = 2

Duplicate

out:tcp.flags=A

Page 56: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Fitness

Which individuals should survive to the next generation?

Page 57: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Fitness

Which individuals should survive to the next generation?

Page 58: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Fitness

Which individuals should survive to the next generation?

Page 59: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Fitness

Which individuals should survive to the next generation?

Successfully obtaining forbidden content

Not triggering on any packets

Breaking the TCP connection

Conciseness

Page 60: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

GenevaGenetic Evasion

Building Blocks

Duplicate

Tamper

Fragment

Drop

Actions manipulate individual packets

CompositionActions compose

to form trees

MutationRandomly alter types,

values, and trees

FitnessGoal: Fewest actions needed to succeed

No trigger

Break TCP

Successful

Concise

Tampertcp.flags = R

Tamperip.ttl = 2

Duplicate

out:tcp.flags=A

Page 61: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Injects & blackholesIran

*

Geneva’s results – Real censor experiments

HTTP HTTPS DNS FTP SMTP

Injects TCP RSTsChina

Injects a block pageIndia

Injects & blackholesKazakhstan

Page 62: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Injects & blackholesIran

*

Geneva’s results – Real censor experiments

HTTP HTTPS DNS FTP SMTP

Injects TCP RSTsChina

Injects a block pageIndia

Injects & blackholesKazakhstan

Diversity of censors

Page 63: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Injects & blackholesIran

*

Geneva’s results – Real censor experiments

HTTP HTTPS DNS FTP SMTP

Injects TCP RSTsChina

Injects a block pageIndia

Injects & blackholesKazakhstan

Diversity of protocolsDiversity of censors

Page 64: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva’s results – Real censor experiments

China India KazakhstanIran

Page 65: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva’s results – Real censor experiments

China India Kazakhstan

Species

Sub-species

6 13

Variants36

Iran

Page 66: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva’s results – Real censor experiments

China India Kazakhstan

Species

Sub-species

6 13

The underlying bug

How Geneva exploits it

Variants36 Functionally distinct

Iran

Page 67: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva’s results – Real censor experiments

China India Kazakhstan

Species

Sub-species

6 13

The underlying bug

How Geneva exploits it

Variants36 Functionally distinct

Iran

Page 68: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva’s results – Real censor experiments

China India Kazakhstan

Species

Sub-species

6 13

The underlying bug

How Geneva exploits it

Variants36 Functionally distinct

Iran

31 136 9

Page 69: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Trick the censor into thinking the client is the server

Turnaround species

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

Page 70: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Segmentation species

Fragmenttcp:8:inorder

Fragmenttcp:4:inorder

out:tcp.flags=PA

Trick the censor into thinking the client is the server

Turnaround species

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

Segment the request

Page 71: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Segmentation species

Fragmenttcp:8:inorder

Fragmenttcp:4:inorder

out:tcp.flags=PA

Trick the censor into thinking the client is the server

Turnaround species

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

Segment the request

archGET /?se =ultrasurf

Page 72: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Trick the censor into thinking the client is the server Segment the request

Segmentation speciesTurnaround species

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

Fragmenttcp:8:inorder

Fragmenttcp:4:inorder

out:tcp.flags=PA

archGET /?se =ultrasurf

Page 73: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Remainder8 4

Trick the censor into thinking the client is the server

Segment the request,but not the keyword

Segmentation speciesTurnaround species

Fragmenttcp:8:inorder

Fragmenttcp:4:inorder

out:tcp.flags=PA

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

archGET /?se =ultrasurf

Page 74: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Segment the request, but not the keyword

Trick the censor into thinking the client is the server

Segmentation speciesTurnaround species

Fragmenttcp:8:inorder

Fragmenttcp:4:inorder

out:tcp.flags=PA

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

arch

GET /?se

=ultrasurf

Page 75: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

≤ 8

≥ 12

Segment the request, but not the keyword

Trick the censor into thinking the client is the server

Segmentation speciesTurnaround species

Fragmenttcp:8:inorder

Fragmenttcp:4:inorder

out:tcp.flags=PA

Tampertcp.flags = SA

Duplicate

out:tcp.flags=S

arch

GET /?se

=ultrasurf

Page 76: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Client Server

Geneva

Censoring regime

Page 77: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion

Geneva

Client Server

Censoring regime

Page 78: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion

Potentially broadens reachability without any client-side deployment

Clients

Censoring regime

Geneva

Server

Page 79: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK

SYN

ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

Server-side evasion “shouldn’t” work

Page 80: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK

SYN

ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

Censored keyword

Server-side evasion “shouldn’t” work

Page 81: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK

SYN

ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

All a server does before client is censored

Censored keyword

Server-side evasion “shouldn’t” work

Page 82: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK

SYN

ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

All a server does before client is censored

Fortunately, the AI doesn’t know it “shouldn’t” work

Censored keyword

Server-side evasion “shouldn’t” work

Page 83: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion “shouldn’t” workServer-side results

Page 84: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion “shouldn’t” workServer-side results

China8 strategies

Page 85: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion “shouldn’t” workServer-side results

China8 strategies

1 strategyIran/India

Page 86: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion “shouldn’t” workServer-side results

China8 strategies

1 strategyIran/India Kazakhstan

3 strategies

Page 87: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion “shouldn’t” workServer-side results

China8 strategies

1 strategyIran/India Kazakhstan

3 strategies

None of these require any client-side deployment

Page 88: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK

SYN

ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

All a server does before client is censored

Censored keyword

Server-side evasion “shouldn’t” work

Page 89: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion results

SYN/ACK(benign GET)

SYN/ACK(benign GET)

Double benign-GETs

Page 90: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK(benign GET)

SYN/ACK(benign GET) Server sends uncensored GETs

inside two SYN/ACKs

Server-side evasion resultsDouble benign-GETs

Page 91: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN/ACK(benign GET)

SYN/ACK(benign GET) Server sends uncensored GETs

inside two SYN/ACKsCensor confuses

connection direction

Server-side evasion resultsDouble benign-GETs

Page 92: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Server-side evasion results

SYN

SYN

SYN/ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

SYN (corrupted)

ACK

ACK

Simultaneous-open-based desynchronization

Page 93: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN

SYN

SYN/ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

SYN (corrupted)

ACK

ACK

TCP simultaneous open

Server-side evasion resultsSimultaneous-open-based desynchronization

Page 94: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN

SYN

SYN/ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

SYN (corrupted)

ACK

ACK

TCP simultaneous open

Client sends a SYN/ACK

Server-side evasion resultsSimultaneous-open-based desynchronization

Page 95: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

SYN

SYN

SYN/ACK

(query)PSH/ACK

(query)

ACK

Client Server

PSH/ACK (response)

SYN (corrupted)

ACK

ACK

TCP simultaneous open

Client sends a SYN/ACKCensor de-synchronizes

Server-side evasion resultsSimultaneous-open-based desynchronization

Page 96: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Demo

Page 97: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

New Model for Chinese Censorship

All of the server-side strategies operate strictly during

the TCP 3-way handshake

Page 98: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

New Model for Chinese Censorship

All of the server-side strategies operate strictly during

the TCP 3-way handshake

So why are different applications affected differently in China?

Page 99: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

New Model for Chinese Censorship

IP

TCP

DNS HTTP FTP

Sane

Page 100: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

New Model for Chinese Censorship

IP

TCP

DNS HTTP FTP

Sane

IP

TCP

DNS

Apparently what’s happening

HTTP

TCP

IP

FTP

TCP

IP

They appear to be running multiple censoring middleboxes

in parallel

Page 101: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

New Model for Chinese Censorship

IP

TCP

DNS HTTP FTP

Sane

IP

TCP

DNS

Apparently what’s happening

HTTP

TCP

IP

FTP

TCP

IP

They appear to be running multiple censoring middleboxes

in parallel

Page 102: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

New Model for Chinese Censorship

IP

TCP

DNS

Apparently what’s happening

HTTP

TCP

IP

FTP

TCP

IP

They appear to be running multiple censoring middleboxes

in parallel

How does the censor know which one to apply to a connection?

Not port number

They appear to apply protocol fingerprinting

Basic protocol confusion could be highly effective

Page 103: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva defeats censorship-in-depthFebruary 2020: Iran launched a new system: a protocol filter

Page 104: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva defeats censorship-in-depthFebruary 2020: Iran launched a new system: a protocol filter

Censors connections that do not match protocol fingerprints

Page 105: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva defeats censorship-in-depthFebruary 2020: Iran launched a new system: a protocol filter

Censors connections that do not match protocol fingerprints

Those that do match are then subjected to standard censorship

Page 106: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva defeats censorship-in-depthFebruary 2020: Iran launched a new system: a protocol filter

Censors connections that do not match protocol fingerprints

Those that do match are then subjected to standard censorship

Geneva discovered 3 strategies to evade Iran’s filter

Page 107: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Automating the arms race

AI has the potential to fast-forward the arms race for both sides

Page 108: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Automating the arms race

AI has the potential to fast-forward the arms race for both sides

Bugs in implementation

Gaps in logic

Easy for censors to fix the low-hanging fruit

Harder for censors to fix systemic issues

Page 109: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Automating the arms race

AI has the potential to fast-forward the arms race for both sides

Bugs in implementation

Gaps in logic

Easy for censors to fix the low-hanging fruit

Harder for censors to fix systemic issues

What is the logical conclusion of the arms race?

Page 110: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Geneva Team

Kevin BockLouis-Henri Merino Tania AryaDaniel LiscinskyRegina PogosianYair Fax

George HugheyKyle ReeseJasraj SinghKyle HurleyMichael Harrity

Dave Levin Xiao Qiang

Page 111: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Evolving censorship evasion

Geneva code and website geneva.cs.umd.edu

Genetic Evasion

Geneva

Client-side & Server-side

Has found dozens of strategies

Quickly discovers new strategiesGives the advantage to evaders

Page 112: GenevaCensorship evasion research Evade 1 Understand how censors operate 2 Apply insight to create evasion strategies Largely manual efforts give censors the advantage

Attempts to Evade or Defeat Tax

The Censors' - Weebly

EAVCITROEN EVASION

Evade- emma bec ella

Attack Transformation to Evade Intrusion Detection

Foreclosure Madness: Using Mortgage Deceleration to Evade

Evasion Brazil

of the Immune · Mechanisms of T u:mor CeH Evasion of the Immune Response Possibte Sunriv•I Mechanisms Used by the Cancer Cellto Evade the Immune System from what has been presented

Wilderness Evasion

Evasion 2010

The Power of Procrastination: Detection and Mitigation of Execution-Stalling Malicious ... · 2011-11-04 · malicious code that can evade dynamic analysis. One recent form of evasion

How Censors Killed the Weird . Muy Bueno. Usar . Padid 2014

Col.legi de Censors Jurats de Comptes de Catalunya ... · Present i futur Col.legi de Censors Jurats de Comptes de Catalunya Setembre 2019 Oriol Amat BSM Universitat Pompeu Fabra

Porcine Adenoviral Vectors Evade Preexisting … · Porcine adenoviral vectors evade preexisting humoral immunity to ... Virus Res. 105:127-136. Porcine Adenoviral Vectors Evade Preexisting

Baltic Sea Report - Cisionmb.cision.com/Main/67/9877642/451937.pdf · to reduce tax evasion. For example, the taxation of residential real estate is impossible to evade (i.e., property

Piazzolla Evasion

Evading the censors: Critical journalism in authoritarian states · 2018-03-29 · Evading the censors: Critical journalism in authoritarian states By Mikal Hem ... Ord Foundation

Leishmania donovani Promastigotes Evade the Antimicrobial

NATIONAL FILM AND VIDEO CENSORS BOARD ACT · Censorship of films . 33. Censorship certificate. 34. Exempted exhibition. 35. Establishment of Zonal Film Censors Committees. 36. Censors

Burmaâ•Žs Pop Music Industry: Creators, Distributors, Censors

Hungarian Cyber Security Package - Óbudai Egyetemusers.nik.uni-obuda.hu/poserne/ibst/Frissitett_anyagok_2013/201305… · Mendax – Tool to evade an IDS SideStep – IDS evasion

The Censors by Luisa Valenzuela - …danielleharms.wikispaces.com/file/view/%22The+Censors%22.pdf · serious, steady, or conservative in character. Vocabulary albeý (ôl bë' it)

POLITICAL CONNECTIONS AND TARIFF EVASION - …erf.org.eg/wp-content/uploads/2015/12/961.pdf ·  · 2015-12-21Are politically connected firms more likely to evade taxes? ... offshore

Minerva Anti-Evasion Platform...Minerva is focused on preventing unknown threats that are designed to evade existing defenses without attempting to seek and identify malware. This

Gran Evasion

ΚΑΤΑ ΚΗΝΣΟΡΩΝ (AGAINST CENSORS)

SURVIVAL,EVASION, RESISTANCEAND ESCAPE …rageuniversity.com/PRISONESCAPE/EVASION OUTSIDE PRISON/SERE.Manual.pdfSURVIVAL,EVASION, RESISTANCEAND ESCAPE ... Use evasion movement techniques

Tax evasion

Tolerance of tax evasion · on individuals’ incentives to evade taxes has been developed. ... tolerance of tax evasion. We do not analyze the political ... focusses on individuals

Tax Evasion and Tax Fraud - 1ShoppingCart.com€¦ ·  · 2013-10-27Tax Evasion and Tax Fraud Presenter: Maleka Ali, CAMs ... helped them evade U.S. taxes. ... •And Why Do I care?

Internet Archive...EVASION INTRODUCTION 1. This precis is designed as an aide to Evasioa, It does not constitute rules. The necessity to evade in the present day could occur from:

Under Armour, Inc. v. Evade, LLC - finnegan.com

Apolipoprotein E Mediates Evasion From Hepatitis C Virus … · 2018-04-05 · immune system lags behind the continuous evolution of HCV, allowing the virus to evade humoral immunity.3,4

malWASH: Washing malware to evade dynamic analysis

Evade Many Attacks