Censored Planet: Measuring Internet Censorship Globally and Continuously Roya Ensafi AIMS 2018 1
Measuring Internet Censorship Globally PROBLEM: - How can we detect whether pairs of hosts around the world can talk to each other? user ? Site 2
Measuring Internet Censorship Globally PROBLEM: - How can we detect whether pairs of hosts around the world can talk to each other? user STATE OF THE ART : ? Deploy hardware or software at hosts - (RIPE Atlas, OONI probe) Ask people on the ground, or use VPNs, or research networks - (PlanetLab) THREE KEY CHALLENGES: Site Coverage, ethics, and continuity 3
Thinking Like an “Attacker” … These machines blindly follow Thinking Like an Attacker... Internet protocol rules such as TCP/IP. How can we leverage standard protocol behaviors to detect whether two distant hosts can communicate? 140 million public live IPv4 addresses 4
Measuring Internet Censorship Globally … Remotely! PROBLEM: - How can we detect whether pairs of hosts around the world can talk to each other? user … from somewhere else in the world?. ? Impossible! Site 5
Spooky Scan Spooky Scan uses TCP/IP side channels to detect whether a user and a site can communicate (and in which direction packets are blocked) user ? Goal: Detect blocking from off-path ? * TCP Idle Scan Antirez, (Bugtraq 1998) Site * Detecting Intentional Packet Drops on the Internet via TCP/IP Side Channels Roya Ensafi, Knockel, Alexander, and Crandall (PAM ’14) * Idle Port Scanning and Non-interference Analysis of Network Protocol Stacks Using Model Checking 6 Roya Ensafi , Park, Kapur, and Crandall (Usenix Security 2010)
Augur Augur Augur is a follow up system that uses the same TCP/IP side channels to detect blocking from off-path. user ? Goal: Scalable, ethical, and statistically ? robust system to continuously detect blocking. Site * Augur: Internet-Wide Detection of Connectivity Disruption P. Pearce*, R. Ensafi*, F. Li, N. Feamster, V. Paxson (* joint first authors) 7
TCP/IP TCP Handshake: SYN-ACK RST SYN [IP ID:X] Port status is open/closed SYN/ACK [IP ID: Y] ACK [IP ID:X+1] SYN SYN/ACK SYN/ACK SYN/ACK Port status is open 8
Spooky Scan Requirements Site “User” (Reflector) Must maintain a Open port and global value for IP ID retransmitting SYN-ACKs Measurement Machine Must be able to spoof packets 9
Spooky Scan Reflector IP ID Measurement Reflector machine Site 10
Spooky Scan No direction blocked Reflector IP ID: SYN/ACK 1 7000 Measurement Reflector machine Site 11
Spooky Scan Spooky Scan No direction blocked No direction blocked Reflector IP ID: SYN/ACK 1 7000 RST [IP ID: 7000] 2 Measurement Reflector machine Site 12
Spooky Scan Spooky Scan No direction blocked Reflector IP ID: SYN/ACK 1 7000 RST [IP ID: 7000] 2 Measurement Reflector machine 3 Spoofed SYN [src: Reflector IP] Site 13
Spooky Scan Spooky Scan No direction blocked Reflector IP ID: SYN/ACK 1 7000 RST [IP ID: 7000] 2 Measurement Reflector machine 3 Spoofed SYN [src: Reflector IP] SYN/ACK 4 Site 14
Spooky Scan Spooky Scan No direction blocked Reflector IP ID: SYN/ACK 1 7000 RST [IP ID: 7000] 2 7001 Measurement Reflector machine 3 Spoofed SYN [src: Reflector IP] SYN/ACK 4 RST 5 [IP ID: 7001] Site 15
Spooky Scan SYN/ACK 6 RST [IP ID: 7002] 7 No direction blocked Reflector IP ID: SYN/ACK 1 7000 RST [IP ID: 7000] 2 7001 7002 Measurement Reflector machine 3 Spoofed SYN [src: Reflector IP] SYN/ACK 4 RST 5 [IP ID: 7001] Site 16
Probe [IP ID: 7003] Spooky Scan SYN/ACK 6 RST [IP ID: 7002] 7 No direction blocked Reflector IP ID: SYN/ACK 1 7000 RST [IP ID: 7000] 2 7001 7002 7003 Measurement Reflector machine 3 Spoofed SYN [src: Reflector IP] SYN/ACK 4 RST 5 [IP ID: 7001] Site 17
Probe [IP ID: 7002] Spooky Scan SYN/ACK 5 RST [IP ID: 7001] 6 Site-to-Reflector Reflector IP ID: SYN/ACK 1 7000 Blocked RST [IP ID: 7000] 2 7001 7002 Measurement Reflector machine 3 S p o [ o s r f e c d : C S l Y i e N SYN/ACK n t I 4 P ] Site 18
Spooky Scan SYN/ACK 6 RST [IP ID: 7002] 7 Reflector-to-Site Reflector IP ID: SYN/ACK 1 7000 Blocked RST [IP ID: 7000] 2 7001 7002 Measurement machine 3 5 RST S p o [ o s r f e c d : C S l Y i SYN/ACK e N n t I 4 P ] Site 19
Probe [IP ID: 7004] Spooky Scan SYN/ACK 6 RST [IP ID: 7002] 7 Reflector-to-Site Reflector IP ID: SYN/ACK 1 7000 Blocked RST [IP ID: 7000] 2 7001 7002 7003 Measurement 7004 machine 3 5 RST S p o [ o s r f e c d : C S l Y i SYN/ACK e N n t I 4 P ] Site 20
Spooky Scan Site-to-Reflector No Direction Reflector-to-Site Blocked Blocked Blocked � IP ID1 = 1 � IP ID1 = 2 � IP ID1 = 2 � IP ID2 = 1 � IP ID2 = 1 � IP ID2 = 2 21
Coping with Reflector IP ID Noise Reflector Amplifying the signal Effect of sending N spoofed SYNs: Site-to-Reflector Blocked No Direction Blocked Reflector-to-Site Blocked � IP ID1 = (1 + noise) � IP ID1 = (1 + N + noise) � IP ID1 = (1 + N + noise) � IP ID2 = noise � IP ID2 = noise � IP ID2 = (1 + N + noise) 22
Coping with Reflector IP ID Noise Reflector Amplifying the signal Effect of sending N spoofed SYNs: Site-to-Reflector Blocked No Direction Blocked Reflector-to-Site Blocked � IP ID1 = (1 + noise) � IP ID1 = (1 + N + noise) � IP ID1 = (1 + N + noise) � IP ID2 = noise � IP ID2 = noise � IP ID2 = (1 + N + noise) Repeating the experiment To eliminate the effects of packet loss, sudden bursts of packets, ... 23
Augur for Continuous Scanning Insight: Some measurements much noisier than others. 24
Augur for Continuous Scanning Insight: Some measurements much noisier than others. Probing Methodology: Until we have high enough confidence (or up to): - For first 4s, query IPID every sec Run Send 10 spoofed SYNs - Query IPID - Query IPID 25
Augur for Continuous Scanning Insight: Some measurements much noisier than others. Probing Methodology: Until we have high enough confidence (or up to): Repeat runs and - For first 4s, query IPID every sec use Seq. Hypothesis Testing Run Send 10 spoofed SYNs - Query IPID to gradually build confidence. - Query IPID 26
Augur: Sequential Hypothesis Testing Defining a random variable: if no IPID acceleration occurs if IPID acceleration occurs 27
Augur: Sequential Hypothesis Testing Defining a random variable: if no IPID acceleration occurs if IPID acceleration occurs Calculate known outcome probabilities (priors): Prior 1 : Prob. of no IPID acceleration when there is blocking Prior 2: Prob. of IPID acceleration when there is no blocking 28
Augur: Sequential Hypothesis Testing Trial Update Maximum Likelihood Ratio Site-to-Ref blocking Based on , can we decide No Blocking the blocking case? Ref-to-Site blocking No Yes No Output Unknown 29
Augur Framework 30
Augur Framework All responsive Reflector IPs selection User input Detection Target Reflector Characterization countries 31
Augur Framework All responsive Reflector IPs selection User input Detection Target Reflector Characterization countries Site Site address characterization 32
Augur Framework All responsive Reflector IPs selection User input Detection Target Reflector Characterization countries Probing Site Site address Scheduler characterization 33
Augur Framework All System output responsive Reflector IPs selection Detection/ Ref-to-Site User input Validation blocking — OR — Detection Site-to-Ref Target Reflector blocking Characterization countries — OR — Probing No blocking — OR — Site Error Site address Scheduler characterization 34
THREE KEY CHALLENGES: Coverage, ethics, and continuity Scanning IPv4 on port 80: Coverage - 22.7 million potential reflectors! Compare: 10,000 in prior work (RIPE Atlas) Challenge : Need global vantage points from which to measure 35
Ethics Reflector IP ID: 1000 1001 1002 Reflector SYN/ACK 4 Challenge : Probing RST 5 banned sites from [IP ID: 1001] users’ machines creates risk Site 36
THREE KEY CHALLENGES: Coverage, ethics, and continuity Ethics Use only infrastructure devices to source probes Internet Challenge : Probing User banned sites from users’ machines Global IP ID 22.7 million 236 countries (and creates risk dependent territories) Two hops back from end user 53,000 180 countries 37
THREE KEY CHALLENGES: Coverage, ethics, and continuity Continuity Augur doesn’t depend on end users’ availability, and routers have less downtime, allowing us to collect measurements continuously. Challenge : Need to repeat measurements over time 38
Running Augur Reflectors: 2,050 In the Wild Sites: 2,134 (Citizen Lab list + Alexa Top-10K) Mix of sensitive and popular sites Duration : 17 days Measurements per reflector-site : 47 Overall # of measurements: 207.6 million 39
Top Site-to-Reflector blocking Blocked Sites Reflector Site-to-Reflector Blocked Site Interesting example: - amtrak.com was blocked for 21% of reflectors, 57% of countries (ranked 6) → Collateral damage 40
Recommend
More recommend
