Using online scanning services
for censorship circumvention

David Fifield, Gabi Nakibly, Dan Boneh

Privacy Enhancing Technologies Symposium
July 11, 2013

Research paper (20 pages)

Summary

Use services that make HTTP requests to carry data between a censored user and a circumvention bridge.

Insights

  1. There are many services that will retrieve a web page for you.
  2. It’s possible to embed a lot of upstream data in an HTTP request.
  3. There are a variety of ways to cause an HTTP client to download another URL of your choice, after it has requested a page from you.

Model and assumptions

A censor is able to blacklist IP addresses, and is reluctant to cause “collateral damage” by censoring services that have non-circumvention uses.

There is an online scanning service (OSS) outside the firewall, able to make HTTP requests to a circumvention proxy and the client.

One-way circumvention

One-way circumvention

The relay acts as a web server. The client asks an OSS to scan a URL on the relay.

“Dear OSS, please retrieve 

http://relay.com/?data=UGxlYXNlIG5vdGUgdGhhdCB0aGlzIGRvY3VtZW50IGlzIHByb3ZpZGVkIGluIG9yZGVyIHRvIGRvY3VtZW50CkRlYmlhbidzIGhpc3RvcnkuICBXaGlsZSB0aGUgZ2VuZXJhbCBpZGVhcyBzdGlsbCBhcHBseSBzb21lIGRldGFpbHMKY2hhbmdlZC4KCgoqKioqKioqKioqKioqKioqKioqKgpBcHBlbmRpeApUaGUgRGViaWFuIE1hbmlmZXN0bwoqKioqKioqKioqKioqKioqKioqKgoKCgkJCVRoZSBEZWJpYW4gTGludXggTWFuaWZlc3RvCgoJCQlXcml0dGVuIGJ5ICBJYW4gQS4gTXVyZG9jawoJCQkgICAgIFJldmlzZWQgMDEvMDYvOTQKCgpXaGF0IGlzIERlYmlhbiBMaW51eD8KPT09PT09PT09PT09PT09
.”

Bidirectional traffic (1)

Both client and relay act as web servers. The client’s first request embeds a return address. The relay’s response contains a redirect back to the client.

The client’s response to the redirected request is another redirect back to the relay. And so on.

Bidirectional traffic (2)

OSSes (with few exceptions) stop following redirects after a while. The client needs to kick off a new scan (and chain of redirects) after the previous one is exhausted.

The client needs to poll to see if the relay has anything new to send.

Redirect methods

Experimental results

OSS# of HTTP
redirects		# of meta-
refresh
AdSense55
Dr.Web∞0
GoMo15∞
goo.gl1530
NoVirusThanks100
PDFmyURL∞∞
VirusTotal5/200/≈150
vURL200
W3C70
Chromium20∞
Firefox20∞
Internet Explorer120∞
Safari16∞

Experimental results

OSScapacity of
HTTP redirects		capacity of
meta-refresh
AdSense20472047
Dr.Web81810
GoMo∞∞
goo.gl20472047
NoVirusThanks≈1280000
PDFmyURL∞∞
VirusTotal20470/∞
vURL≈1280000
W3C81810
Chromium≈262144∞
Firefox∞∞
Internet Explorer∞∞
Safari∞*∞*

Experimental results

OSSbytes / s
AdSense500
Dr.Web20,000
GoMo22,000
goo.gl350
NoVirusThanks21,000
PDFmyURL220,000
VirusTotal1,000
vURL250
W3C4,600

What’s in a URL

http://relay.com/91a37a20/6fe7703b/123/50/?return=192.0.2.5&data=UGxlYXNlIG5vdGUgdGhh...

Discussion, deployment

flashproxy-reg-url, manual rendezvous for flash proxy.

flashproxy-reg-appspot, rendezvous using a static OSS we control, hidden behind https://www.google.com/.

https://gitweb.torproject.org/user/dcf/oss.git

David Fifield <dcf@cs.stanford.edu>