Detecting and Evading Censorship-in-Depth: A Case Study of Iran’s Protocol Whitelister
summary
Iran’s deployed protocol filter only permits DNS, HTTP, and HTTPS on ports 53, 80, and 443, inspects TCP packets and matches brittle fingerprints (e.g., DNS fingerprint expects a UDP-style header), drops client packets after the first non-matching data packet (it effectively checks the first two data-carrying packets) and remembers offending flows for about 60 seconds. A genetic algorithm Geneva finds client-side fixes (broken-checksum innocuous request, two tiny packets pre-handshake, sending nine ACKs during handshake) with 100% success and a server-side trick (nine bad SYN-ACKs causing nine RSTs) that also works.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:23Iranian Censorship
- 2:24How it fingerprints connections
- 3:15Protocol-specific Fingerprints
- 5:06How the filter censors connections
- 6:00The filter is not bidirectional
- 6:38Other details in the paper
- 7:10Geneva
- 7:51Inject Fingerprint
- 8:47Client-side Evasion Strategies
- 9:41Server-side Evasion Strategies
- 10:25Evading Iran's Protocol Filter
related talks
58mEvasion of High-End IDPS Devices at the IPv6 Era
30mLessons From Defending The Indefensible
26mMisuse of DNS, the Second Most Used Protocol
52mIran's Soft-War for Internet Dominance
45mAll the Ways to Control the Internet and More
01h 04mServer-Side Browsing Considered Harmful
42mCracking the Code: Decoding Anti-Bot Systems!
25mEvasion of High-End IPS Devices in the Age of IPv6