TowardsIlluminatingaCensorshipMonitorsModelto.PDFVIP

Towards Illuminating a Censorship Monitor’s Model to Facilitate Evasion Sheharbano Khattak? Mobin Javed? Philip D. Anderson? Vern Paxson? ?Independent researcher ?U.C. Berkeley International Computer Science Institute Abstract We focus our effort on one widely used technology for censorship systems, an on-path network monitor that Censorship systems that make dynamic blocking decisions passively observes network traf?c and effects censorship must inspect network activity on-the-?y to identify content to disruption by packet injection (e.g., forged RSTs or DNS ?lter. By inferring the analysis models of such monitors we can replies). These systems, which we will refer to simply as identify their vulnerabilities to different forms of evasions that monitors, afford more scalability than in-path elements we can then exploit for circumvention. We leverage the obser- that forward traf?c (and can directly manipulate it), and vation that censorship monitors essentially work on the same this technology underlies much of the functionality used principles as Network Intrusion Detection Systems (NIDS) and by the Great Firewall of China (GFW). therefore inherit the same evasion vulnerabilities already dis- Particularly signi?cant for our purposes, from a cussed in the NIDS context for years. Using this past work technical perspective such monitors function in the as a guide, we illustrate the power of illuminating a monitor’s same manner as Network Intrusion Detection Systems analysis model by conducting extensive probing to test for vul- (NIDS)—and for well over a decade researchers have nerabilities in the Great Firewall of China. We ?nd exploitable studied the problem of the many ways that the analysis ?aws in its TCB creation and destruction, fragment and seg- model of a NIDS renders it vulnerable to evasions, some ment reassembly, packet valida