anti-censorship-team April 2021

anti-censorship-team@lists.torproject.org

11 participants
6 discussions

Results of Turbo Tunnel security audit that affect Snowflake
by David Fifield 24 Apr '21

24 Apr '21

There was recently a security audit of Turbo Tunnel software artifacts, including dnstt and Snowflake. I posted the report on the dnstt page: https://www.bamsoftware.com/software/dnstt/cure53-turbotunnel-2021.pdf The report finds three issues that have to do with Snowflake, rated from Informational to Low. UCB-02-001: Memory leak in Handler() routine of Snowflake client library (Low) UCB-02-008: Lack of rate limiting in Snowflake and dnstt (Info) UCB-02-009: Brokers and proxies are not authenticated (Low) For UCB-02-001, I have already opened https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…. UCB-02-008 is not a vulnerability, but only a suggestion that rate-limiting interactions may help mitigate certain kinds of resource-exhaustion attacks. Some related tickets are: "Broker needs better resilience against DoS" https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… "Make it more expensive (CPU wise, or other thing) to make the initial connection to a snowflake" https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… UCB-02-009 is something we have already discussed in the team across various issues. I don't know if we can meaningfully authenticate proxies, but the broker's messages ought to be signed and encrypted. "End-to-end confidentiality for Snowflake client registrations" https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… "Authentication for proxy--bridge connections" https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…

1 0

Next anti-censorship reading group: 29 April 2021
by Cecylia Bocovich 22 Apr '21

22 Apr '21

Hey everyone! We will discuss "Domain Shadowing: Leveraging Content Delivery Networks for Robust Blocking-Resistant Communications" next Thursday at our regular team meeting on 2021-04-29, at 16 UTC. Relevant links: - https://www.usenix.org/system/files/sec21fall-wei.pdf Questions to ask and goals to have: - What can we learn from this work? - Are there immediate actions we can take based on this work? - Are there long-term actions we can take based on this work? - Is there future work that we want to call out, in hopes that others will pick it up? Hope to see you all there! Cecylia

1 0

Crash in Snowflake users since 2021-01-17
by David Fifield 17 Apr '21

17 Apr '21

I happened to look at the Snowflake bridge's bandwidth and user history page, and the counts are close to zero since yesterday. I haven't investigated it at all. https://metrics.torproject.org/rs.html#details/5481936581E23D2D178105D44DB6…

4 8

Throttling: What's old is new again
by Matthew Finkel 07 Apr '21

07 Apr '21

I found the premise of this article [0], that throttling connections (based on SNI) is new, a little amusing. It reminds me of how Iran implemented a very similar technique almost a decade ago [1]. I don't know of earlier uses of throttling as a censorship mechanism, at this scale, before the early-2010's (but I'd be interested in learning about them, if anyone knows). An earlier article about Roskomnadzor's implementation is interesting [2], for those who missed it. [0] https://arstechnica.com/gadgets/2021/04/russias-twitter-throttling-may-give… [1] https://ooni.org/post/iran-internet-censorship/#reported-cases-of-internet-… [2] https://arstechnica.com/gadgets/2021/03/a-russian-isp-confirms-roskomnadzor…

2 2

Microsoft announces shutting down domain fronting attempts in Azure
by Cecylia Bocovich 06 Apr '21

06 Apr '21

It looks like Azure is going to shutdown domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to… There isn't a time frame listed in the article, and I haven't gotten any notifications through my Azure account yet. Cecylia

6 8

Plans for Orbot and OnionBrowser domain fronting update
by Nathan of Guardian 02 Apr '21

02 Apr '21

It seems like Azure Domain Fronting may already be going offline, according to some reports. Our own testing from US and EU show that it is still working for now. That said, here is our plan for updating Orbot and Onion Browser in response to what may come at any moment: 1) Move to Fastly for Snowflake and Moat as soon as they are ready. Please keep us posted on this. 2) Remove Meek as a built-in option. 3) Promote "social distribution" of bridge URLs via links and QR codes through communities that need them 4) Work on setting up our own additional pool of CDN front addresses for Moat and the Snowflake broker(s) that we can round-robin/cat-and-mouse through for both Snowflake and Moat. These would be compiled into our apps, or provided through some kind of S3/hard to block bootstrap URL. 5) Continue our own work in mobile-specific bridge distribution (push messages, SMS, chat bots, social etc) options we can employ in the future. .... any other things to know, that we missed, that we are being naive about? Thanks! +n

3 4

2024

2023

2022

2021

2020

2019

anti-censorship-team April 2021