Censorship Resistance: Decoy Routing Amir Houmansadr CS660: Advanced Information Assurance Spring 2015 Content may be borrowed from other resources. See the last slide for acknowledgements!

Classes of Information Hiding Digital watermarking Steganography Covert channels Anonymous communications Protocol obfuscation CS660 - Advanced Information Assurance - UMassAmherst 2

The Non-Democratic Republic of Repressistan Gateway Traditional circumvention 3 Blocked Proxy User’s AS X X IP Filtering DNS Hijacking DPI Insider attaacks Network identifiers DPI Active probes CS660 - Advanced Information Assurance - UMassAmherst

Decoy routing circumvention An alternative approach for circumvention – It builds circumvention into network infrastructure DR (Karlin et al., FOCI 2011) Cirripede (Houmansadr et al., ACM CCS 2011) Telex (Wustrow et al., USENIX Security 2011) 4 CS660 - Advanced Information Assurance - UMassAmherst

Some background

Internet topology 101 The Internet is composed of Autonomous Systems (ASes) – An Autonomous System is a network operated by a single organization 44,000 ASes are inter-connected based on their business relationships 6 CS660 - Advanced Information Assurance - UMassAmherst

The Internet map of ASes 7 CS660 - Advanced Information Assurance - UMassAmherst

Routing in the Internet 8 User’s AS CNN’s AS Transit AS CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway Decoy Routing Circumvention 9 Blocked Proxy User’s AS Non-blocked X Decoy AS CS660 - Advanced Information Assurance - UMassAmherst

Cirripede

Threat model Warden ISP – Monitor traffic – Block arbitrarily – Constraint: Do not degrade the usability of the Internet TLS is open 11 Client (C) Warden ISP CS660 - Advanced Information Assurance - UMassAmherst

12 Main idea Overt Destination (OD) Covert Destination (CD) C CS660 - Advanced Information Assurance - UMassAmherst

Good ISP Cirripede Architecture Registration Server (RS) 13 Cirripede’s Service Proxy C Deflecting Router (DR) CS660 - Advanced Information Assurance - UMassAmherst

Client Registration Registration Server (RS) Good ISP Client IP 14 C OD CS660 - Advanced Information Assurance - UMassAmherst Uses TCP ISN steganography discussed earlier

Registration 15 Client (C) Cirripede’s RS Collaborating DR CS660 - Advanced Information Assurance - UMassAmherst

Covert communication Client IP RS Cirripede’s Service Proxy 16 OD CD C CS660 - Advanced Information Assurance - UMassAmherst

Routing Around Decoys Schuchard et al., ACM CCS 2012

The Non-Democratic Republic of Repressistan Gateway 18 Blocked Routing Around Decoys (RAD) Decoy AS Non-blocked CS660 - Advanced Information Assurance - UMassAmherst

The Costs of Routing Around Decoys Houmansadr et al., NDSS 2014

This paper Concrete analysis based on real inter-domain routing data – As opposed to relying on the AS graph only While technically feasible, RAD imposes significant costs to censors 20 CS660 - Advanced Information Assurance - UMassAmherst

Main intuition: Internet paths are not equal! – Standard decision making in BGP aims to maximize QoS and minimize costs 21 CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 22 Blocked 1.Degraded Internet reachability Decoy AS Non-blocked Decoy AS CS660 - Advanced Information Assurance - UMassAmherst

Path preference in BGP ASes are inter-connected based on business relationships – Customer-to-provider – Peer-to-peer – Sibling-to-sibling Standard path preference: 1.Customer 2.Peer/Sibling 3.Provider 23 CS660 - Advanced Information Assurance - UMassAmherst

Valley-free routing A valley-free Internet path: each transit AS is paid by at least one neighbor AS in the path ISPs widely practice valley-free routing 24 CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 25 Blocked 2. Non-valley-free routes Decoy AS Non-blocked Provider Customer Provider CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 26 Blocked 3. More expensive paths Decoy AS Non-blocked Customer Provider CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 27 Blocked 4. Longer paths Decoy AS Non-blocked CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 28 Blocked 5. Higher path latencies Decoy AS Non-blocked CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 29 Blocked 6. New transit ASes Decoy AS Non-blocked Edge AS CS660 - Advanced Information Assurance - UMassAmherst

The Non-Democratic Republic of Repressistan Gateway 30 Blocked 7. Massive changes in transit load Decoy AS Non-blocked Transit AS Loses transit traffic Over-loads CS660 - Advanced Information Assurance - UMassAmherst

Simulations Use CBGP simulator for BGP – Python wrapper Datasets: – Geographic location (GeoLite dataset) – AS relations (CAIDA’s inferred AS relations) – AS ranking (CAIDA’s AS rank dataset) – Latency (iPlane’s Inter-PoP links dataset) – Network origin (iPlane’s Origin AS mapping dataset) Analyze RAD for – Various placement strategies – Various placement percentages – Various target/deploying Internet regions 31 CS660 - Advanced Information Assurance - UMassAmherst

Costs for the Great Firewall of China A 2% random decoy placement disconnects China from 4% of the Internet Additionally: – 16% of routes become more expensive – 39% of Internet routes become longer – Latency increases by a factor of 8 – The number of transit ASes increases by 150% – Transit loads change drastically (one AS increases by a factor of 2800, the other decreases by 32%) 32 CS660 - Advanced Information Assurance - UMassAmherst

Strategic placement RAD considers random selection for decoy ASes – This mostly selects edge ASes – Decoys should be deployed in transit ASes instead For better unobservability For better resistance to blocking 33 86% are edge ASes CS660 - Advanced Information Assurance - UMassAmherst

Strategic placement 34 4% unreachability 20% unreachability 43% unreachability CS660 - Advanced Information Assurance - UMassAmherst

Lessons 1.RAD is prohibitively costly to the censors – Monetary costs, as well as collateral damage 2.Strategic placement of decoys significantly increases the costs to the censors 3.The RAD attack is more costly to less-connected state-level censors 4.Even a regional placement is effective 5.Analysis of inter-domain routing requires a fine- grained data-driven approach 35 CS660 - Advanced Information Assurance - UMassAmherst

Acknowledgement Some pictures are obtained through Google search without being referenced 36 CS660 - Advanced Information Assurance - UMassAmherst