Quack: Scalable Remote Measurement of Application-Layer Censorship
summary
Quack is a remote measurement system that uses the RFC 862 echo servers (port 7) as reflectors to detect application‑layer blocking, operating on ~47,000 responsive servers across 34,000 ASes in 167 countries. It runs timed trials with retries, controls and a delay heuristic to infer keyword/domain blocking, tests 100,000 keywords and the Alexa top 100k, discovers thousands of additional blocked domains including a surprising shopping-site category, and functions with low false positives while trading off coverage and being vulnerable to simple port filters.
AI-written summary · about
chapters (18)
- 0:00Start
- 1:09Censorship Measurement
- 3:07Application-Layer Censorship
- 3:42Echo Behavior
- 4:20Protocol Selection
- 5:09Design Goals
- 5:51A Single Trial
- 6:32A Single Test
- 7:59Classification
- 9:56Ethical Considerations
- 10:40Upholding our Principles
- 12:37Discovering Echo Servers
- 13:11What are Echo servers?
- 14:32Citizen Lab List HTTP Experiments
- 15:18Validating Detected Disruption
- 17:42Alexa Top 100,000 Blocking Experiments
- 19:26Limitations
- 20:24Conclusions
related talks
12mTriplet Censors: Demystifying Great Firewall’s DNS Censorship Behavior
51mHTTP/2 & Quic - Teaching Good Protocols to Do Bad Things
54mQUIC illustrated
05mHow to Analyse a DDoS Quackly
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
49mSpooky Action at a Distance: Generating Waves over the Wire for Novel C2
11mDetecting and Evading Censorship-in-Depth: A Case Study of Iran’s Protocol Whitelister
17mSidekick: In-Network Assistance for Secure End-to-End Transport Protocols