Your State is Not Mine: A Closer Look at Evading Stateful Internet - PowerPoint PPT Presentation

Your State is Not Mine: A Closer Look at Evading Stateful Internet Censorship Zhongjie Wang , Yue Cao, Zhiyun Qian, Chengyu Song, Srikanth V Krishnamurthy University of California, Riverside 1

Internet Censorship • Key technology: Deep Packet Inspection (DPI) • Reconstruct TCP data flow • Examine application protocol fields AS AS AS TCB Alice Web Server IP Connection State Client SEQ num TCP (Stateful) Payload Data … HTTP GET /badword HTTP/1.1\r\nHost: … 2

Internet Censorship • Similar to Network Intrusion Detection System (NIDS), it is inherently vulnerable: • Network reason (small TTL, middleboxes) • End-host reason (di ff erent TCP impl., local firewall) AS AS AS RST RST TCB Alice Web Server IP Connection State Client SEQ num TCP (Stateful) Payload Data … HTTP GET /badword HTTP/1.1\r\nHost: … 3

Our Study • The Great Firewall of China (GFW) • a sophisticated censorship system performing stateful DPI • has a long history of keyword-based content filtering on HTTP/DNS/IMAP/Tor/etc • sends forged TCP RST packets to terminates the connection upon detection of sensitive keyword • Goal : Measure the e ff ectiveness of TCP-layer censorship evasion techniques on the GFW in practical situation 4

Prior Studies • NIDS • Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Ptacek et al. 1998. • GFW • Ignoring the Great Firewall of China. Clayton et al. 2006. • Towards Illuminating a Censorship Monitor’s Model to Facilitate Evasion. Khattak et al. 2013. 5

Our Contributions • First extensive measurement of the TCP-layer evasion technique on the GFW • Discovered new behaviors of the GFW • Our new evasion strategies achieve >95% success rate , tested e ff ective with HTTP/DNS/VPN/Tor tra ffi c • INTANG, a open-source censorship evasion tool 6

Agenda • Overview • Background • Evaluation of Existing Evasion Strategies • Evolved GFW Behaviors • Evaluation of New Evasion Strategies • Discussion and Conclusion 7

Insertion/Evasion Packet • Insertion Packets: accepted by the GFW but dropped by the server • Evasion Packets: accepted by the server but dropped by the GFW • Basic Idea: De-synchronization • TCP states (LISTEN, ESTABLISHED) • Program states (SEQ num, win size) 8

Existing Evasion Strategies Creating false TCB (bad SEQ) Creating false TCB TCB Creation TCB Teardown 9

Agenda • Overview • Background • Evaluation of Existing Evasion Strategies • Evolved GFW Behaviors • Evaluation of New Evasion Strategies • Discussion and Conclusion 10

Measurement Setup • Alibaba Cloud • HTTP censorship • Tencent Cloud • 77 Alexa top global sites • China Unicom Beijing • 11 vantage points • 9 cities, 3 ISPs Shanghai • 50 times per test • Controlled experiments Guangzhou • Sensitive keyword: ultrasurf Shenzhen 11

Evaluation of Existing Strategies • Failure 1 - no resp. from server; Failure 2 - RST from GFW 12

Why 13

Failure Analysis Interference on Insertion Packets Client-side Server-side Server Middlebox Middlebox Failure 1 Failure 1 
 Failure 1 Accept (No resp. from svr) (No resp. from svr) (No resp. from svr) Failure 2 Drop No Interference No Interference (RST from GFW) Read Inject Win Linux macOS 14

However, there are still a large portion of failure cases left unresolved 15

Agenda • Overview • Background • Evaluation of Existing Evasion Strategies • Evolved GFW Behaviors • Evaluation of New Evasion Strategies • Discussion and Conclusion 16

TCB Creation on SYN/ACK • TCB Creation SYN/ACK SYN SEQ:123, ACK:456 SEQ:123, ACK:456 1.1.1.1:5555 2.2.2.2:6666 1.1.1.1:5555 2.2.2.2:6666 TCB TCB Client: 2.2.2.2:6666 Client: 1.1.1.1:5555 Server: 1.1.1.1:5555 Server: 2.2.2.2:6666 Client SEQ: 456 Client SEQ: 123 … … Prior New 17

Re-synchronization • GFW now becomes “smarter” • GFW enters “re-sync” state upon seeing • Multiple SYN or • Multiple SYN/ACK or • SYN/ACK with incorrect ACK num 18

Re-synchronization • When in “re-sync” state, the GFW updates its client SEQ num using the next • SEQ num in data packet from “client” to “server” • ACK num in SYN/ACK packet from “server” to “client” Data SYN/ACK 19

Combined strategy: TCB Creation + Resync/Desync 20

Combined strategy: TCB Teardown + TCB Reversal 21

New Insertion Packets Expanding the arsenal 22

How to Find More Insertion Packets? • “Ignore” path analysis in TCP receiving logic and di ff erential testing with the GFW • “Ignore” path: an program execution path doesn’t change any TCP related states, i.e. packet ignored. e.g. wrong checksum • Testing if the GFW also ignores the packet, otherwise, it could be an insertion packet 23

Analyzing Linux TCP Implementation • Analysis on Linux kernel version 4.4, found the following candidate insertion packets • New e ff ective insertion packet: MD5 optional header • Future work: automated discovery of insertion packets 24

Agenda • Overview • Background • Evaluation of Existing Evasion Strategies • Evolved GFW Behaviors • Evaluation of New Evasion Strategies • Discussion and Conclusion 25

INTANG - Extensible Measurement Tool UDP DNS <-> TCP DNS INTANG and its components 26

INTANG - Extensible Measurement Tool Callbacks for each strategy: • setup() • teardown() • process_syn() • process_synack() • process_request() INTANG and its components 27

Evaluation • Evaluation in both directions (inbound & outbound China) (Outbound) (Inbound) • High success rate of >95% for outbound; low inbound success rate due to close distance between server and GFW • INTANG performance: automatically choose the best strategy based on historical results, success rate 98% 28

Case Study - DNS/Tor/VPN • Public DNS resolvers outside China • Google DNS: IP-blocked • OpenDNS: not censored • Dyn DNS: censored, 98%+ success rate with INTANG • Private Tor relay: 100% success rate with INTANG • Private OpenVPN server: occasionally censored, can be bypassed with INTANG when censored 29

Agenda • Overview • Background • Evaluation of Existing Evasion Strategies • Evolved GFW Behaviors • Evaluation of New Evasion Strategies • Discussion and Conclusion 30

Discussion & Limitation • GFW Countermeasures • Hard to be fully immune to insertion packet • May use server’s ACK as a feedback, but still vulnerable to data reassembly strategies • Limitation • Unable to fully understand some of the failure cases due to blackbox nature of the GFW • Complexity and inconsistency of the GFW behaviors 31

Conclusion • We conduct an extensive measurement on the e ff ectiveness of existing TCP-layer evasion techniques against the GFW, and find most of them are no longer working • Middleboxes (including NATs and firewalls) have significant interference on the insertion packets • We discover new behaviors of the GFW and propose new evasion strategies that can bypass these behaviors • We evaluate our new strategies and demonstrate a high success rate of 95%+ 32

Q&A • Zhongjie Wang <zwang048@ucr.edu> • Github: https://github.com/seclab-ucr/INTANG 33