Detecting Network Interference Without Endpoint Participation

Authoritarian regimes around the world deploy pervasive censorship apparatuses to restrict free and open communications on the Internet. Extensive censorship measurement efforts have, over the years, shed impressive light on how censors operate. Typically, prior efforts have included recruiting volunteers to run network probes [8, 15], relying on public servers [16, 17, 20, 21], or using remote vantage points (e.g., VPNs) [10, 12, 13]. While each powerful in their own right, these approaches tend to concentrate on large countries that have high Internet penetration, such as China [1, 9, 11], Iran [2, 4], and Russia [18]. Several challenges limit the use of these methods in smaller countries: low Internet penetration rate, small populations, and scarcity of public servers or remote vantage points make it difficult to recruit volunteers or identify safe endpoints to test. Even when one is able to overcome these challenges with a rare vantage point, there may be large periods of no or low measurement. In this extended abstract, we sketch the design of a system that can longitudinally detect Internet censorship without relying on local endpoints or volunteers inside a censoring nation. Our system includes a set of measurement techniques that can be run from vantage points outside a censoring regime with no participating endpoints within. We emphasize that our goal is not to replace existing measurement efforts, but to complement them by providing insight into networks they cannot reach. The central idea behind our approach is to take advantage of the fact that many censoring middleboxes are not TCP compliant [3, 5]. All middleboxes have to assume that they may miss some network packets within a connection. Bock et al. [3] showed that this assumption could be exploited to trick HTTP middleboxes into injecting block pages and other traffic without any communication with a destination, let alone first establishing a TCP connection. In our earlier work, we demonstrated how to apply Bock et al.’s approach of triggering censors with specific packet sequences to measure the censorship infrastructure of Turkmenistan [3, 14]. However, our earlier approach relied on manual effort to discover a packet sequence that could trigger the censor. Such manual efforts will not feasibly scale to other countries, or even to multiple ISPs within a single country with decentralized censorship. The system we present in this paper seeks to operate on a global scale by automating the discovery of censorshiptriggering packet sequences. Our system uses Geneva [6], a genetic algorithm-based tool that trains directly against censors to discover packet sequences that can achieve a given goal. While originally used to discover evasion strategies [5,6,9], we have modified Geneva to discover sequences of network packets that can trick censors to take blocking actions. Critically, our application of Geneva does not rely on any participation from an endpoint inside censoring countries. However, it does require certain properties of the censor itself, which we describe. While we mainly focus on discovering censorship triggering packet sequences for HTTP censorship in this paper, our approach is extensible and applicable for other network protocols as well (e.g., HTTPS). In the remainder of this paper, we discuss the high-level design of this measurement system, and we introduce some preliminary results from detecting censorship in two previously under-explored nations: Brunei and Tajikistan.