1. CS590/690B Detecting network interference (Fall 2016)
Lecture 09
Phillipa Gill – Umass -- Amherst

2. Where we are Administrative note: - Assignment 2 has been released. -
Last time:
Different censorship measurement platforms
Questions?

3. Hands on activity from last time
Installing/testing OONI
Trying differentiation detector app
Any successes?
Questions?

4. Today Case Study: Iran Background on filtering in Iran (ONI report)
Private addresses used within Iran (Anderson 2012)
Dimming the Internet (Anderson 2013)
Web censorship in Iran (Pseudonymous + Halderman 2013)
Case Study: Pakistan
ISP Lens
Pakistan Hijack
Pakistan Web censorship
ONI report
Netsweeper in Pakistan

5. Background
Limited freedom of speech in Iran grounded in their constitution
Limits on topics ranging from religion, immorality, and politics
State has well established mechanisms for policing traditional media (e.g., print, radio, TV)
Internet, initially offered a place for people to express their viewpoints away from the state controls
Internet use in Iran grows from <1M users to ~23M users
Fastest growth in the middle east at that time
As early as 2001 government began asserting control over Internet access in the country
Commercial ISPs in Iran are required to connect via the state-controlled Telecommunication Company of Iran (TCI)
The order to restrict speeds was met with opposition but remained in place as of the 2009 ONI report.

6. Conflicting goals Desire to encourage economic IT developments …
… but also rein in free speech
Fourth Five Year Development Plan called for 1.5 M high speed Internet connections worldwide
… but in 2006 Ministry of Communication and Information Technology issues an order forbidding home Internet connectivity of > 128 kbps 
There were oppositions to the 128kbps rule but it remains in place
Researchers, faculty and university students are exempt from the restrictions upon providing documentation
Initially censorship implemented via IP blocking by individual ISPs, gradually replaced by centralized censorship by TCI
Redirects users to (an address owned by the censor)

7. More recently
2012: Supreme leader establishes Supreme Council of Cyberspace which controls three government bodies associated with censorship:
Committee for determining offensive contents, located at internet.ir and peyvandha.ir which controls censorship policies. They are responsible for updating lists of censored Web sites and enforcing Internet communication policies
Iran cyber police (FATA police) Responsible for prosecuting users involved in illegal Internet activities
Revolutionary guard cyber defense command, (Iran Cyber Army) responsible for defending Iran against cyber attacks and implementing countermeasures
Also, the “Fifth Five Year Development Plan” mandates development of national information network
Many fears of complete blocking of external content

8. Campaign for national internet
Head of MICT and other gov’t officials create public campaign extolling virtues of creating such a network:
A genuinely halal network aimed at Muslims on an ethical and moral level – Ali Agha-Mohammadi
A national internet can be very effective to protect the country’s information and the people’s security – Esmail Ahmadi Moghaddam
Usage of private IPs within the country could indicate a desire to go in this direction
But usage of these addresses is not particularly new
Observed as far back as 2010 (Anderson 2012)

9. Filtering in Iran at a glance

10. Networking 101: RFC 1918
IP addresses on the Internet need to be globally unique
IANA: Internet Assigned Numbers Authority is responsible for ensuring this
Since IP addresses are finite and not all hosts need to be globally accessible, three blocks of IP addresses were reserved for local/private use
/8 (16 M addresses)
/12 (1 M addresses)
/16 (65 K addresses)
These IP addresses/routing information for them should not be propagated between networks
ISPs should filter them (according to RFC)
Commonly used for NAT (ie., multiplexing a single public IP address across many clients)

11. The hidden Internet of iran
Anderson 2012 – Reading on Web page
Points of observation:
2 hosts in Tehran (1 connecting via AS ITC and 1 connecting via Institute for Research in Fundamental Sciences (AS 6736))
Collection of Web proxies within the country that these hosts connect to to test accessibility
Proxies with both internal + external IP addresses
Potential shortcomings
The two hosts may be subject to localized censorship by network owners
Testing of censorship could lead to reactions from the censor

12. Illustration of abnormal traceroutes

13. Measuring the internal network
Many techniques…
DNS (fig 6); says
it is an server with hostname
Webmail.isfidc.com. Running dig on this address gives us the external address for this server
Can use regional Internet registries to figure out which organization is using the address
Another way to figure out internal IP ownership:
Spoof a ping to the internal address from an external host
When the external host receives the reply the external address mapped to the internal host will be revealed

14. Results of mapping

15. Dimming the internet Anderson 2013 (Reading on Web page)
Performance degradation to limit free flow of information
Relation to network neutrality discussions?
Data reused from NDT tool (client initiated network performance tests run against servers hosted by Measurement Lab (MLab)). NDT integrated into uTorrent
Focus on:
RTT
Packet Loss
Network-limited time ratio (where client has sent as much traffic as it can and needs to wait for ACKs before sending more)
Network throughput

16. Aggregating measurements
National
ISP/AS + IP prefixes
Control groups (grouping users with similar performance)
Using median country-level throughput (based on highest performing measurement for each client on a given day) they find two extended periods of degradation
Nov – Aug (77% decrease)
Oct – Nov (69% decrease)
Corroboration with reports:
“The Internet in Iran is Crawling, Conveniently, Right Before Planned Protests”
Suspected events around holidays, protests, disruption of Google services

17. Example plot

18. Today Case Study: Iran Background on filtering in Iran (ONI report)
Private addresses used within Iran (Anderson 2012)
Dimming the Internet (Anderson 2013)
Web censorship in Iran (Pseudonymous + Halderman 2013)
Case Study: Pakistan
Background (ONI report)
Pakistan YouTube hijacking (Renesys)
Web censorship in Pakistan (Nabi, 2013)
Netsweeper in Pakistan (Citizen Lab report)

19. Internet in pakistan
~130 ISPs: Wateen, Paknet, Linkdotnet, Comsats, Cybernet
Wateen roll out of WiMAX in 2007 made Pakistan the first country with nationwide WiMAX coverage
Largest Internet eXchange Point (IXP) in the country (as of 2009) was the Pakistan Internet Exchange (PIE) subsidiary of PTCL (gov’t owned ISP)
PIE has three main nodes: Karachi, Lahore and Islamabad
+ operates two submarine cables (South East Asia – Middle East – Western Europe: SEA-ME-WE 3 and SEA-ME-WE 4)
In 2009, ISPs no longer had to connect via PTCL and could choose third party providers
Second major company in Pakistan Internet market is TransWorld
Owns and operates Pakistan’s first and only privately owned submarine fiber optic cable system (TW1)
TW1 has capacity of 1.28 TB more than necessary for the nation

20. Internet filtering in pakistan
Filtering regulated by the Pakistan Telecom Authority (PTA) and Federal Investigation Agency (FIA) directed by the government, supreme court, and Ministry of IT (MoIT).
2006 – MoIT created the Inter Ministerial Committee for the Evaluation of Web sites (IMCEW) responsible for monitoring and blocking Web pages
Directives about what to block pass from these government agencies to ISPs for implementation
Wide publicity of censorship in Pakistan because of collateral damage
2006: attempt to block 12 sites with cartoons of Mohammad resulted in blocking the entire Blogspot domain for 2 months
2008: accidentally taking YouTube offline for hours
2010: blocking of Facebook, YouTube, Flickr, Wikipedia on “Draw Mohammad Day”

21. Internet filtering in pakistan (2)
2012: Gov’t solicits proposals for a country-wide URL filtering and blocking system including:
Filtering at domain level, subfolder level, individual files
Blocking individual IPs or whole address ranges
Remote network monitoring via SNMP, configuration via HTTP/HTTPS
Operation at L2 and L3
Modularity: stand alone hardware that can block up to 50M URLs with <1ms latency
Later in 2012: indefinite ban on YouTube in response to a movie.
Impact felt on other Google services with common IP addresses

22. February 2008 : Pakistan Telecom hijacks YouTube
History lesson
2008: Pakistan uses BGP messages to filter traffic
February 2008 : Pakistan Telecom hijacks YouTube
YouTube
Pakistan
Telecom
“The Internet”
Telnor
Aga Khan
University
Multinet
I’m YouTube:
IP / 22
-level of autonomous systems
-e.g., YouTube, AT&T, pakistan telecom
-routing is done on IP addresses, so when someone wants to go to YouTube they get YouTube’s IP address and YouTube announces to the world that they have the ip address and traffic is forwarded towards them. So here multinet would route to it’s provider pakistan telecom that then forwards the traffic on to youtube.
-these networks chosen for a specific reason which is that there was an incident in february 2008 pakistan telecom actually high jacked traffic going to youtube (misconfiguration).
-they announced to the world that they’re youtube and traffic destined to youtube was routed to them
-youtube was unavailable for a couple of hours as operators phone each other to figure out what was going on.

23. X History lesson Here’s what should have happened….
YouTube
Pakistan
Telecom
“The Internet”
Telnor
Aga Khan
University
Multinet
Hijack + drop packets going to YouTube X
I’m YouTube:
IP / 22
Block your own customers.

24. But here’s what Pakistan ended up doing…
History lesson
But here’s what Pakistan ended up doing…
YouTube
Pakistan
Telecom
“The Internet”
Telnor
Aga Khan
University
Multinet
No, I’m YouTube!
IP / 24
Pakistan
Telecom
I’m YouTube:
IP / 22
Our works focuses on attacks of this flavor..

25. How is this possible?
Pakistan Telecom connected to the rest of the Internet via the PCCW network
This network did not validate the message sent by Pakistan Telecom
…and proceeded to pass it on to its neighbors who also accepted it
Worse yet, the route announced by Pakistan was more specific than the route announced by YouTube
Pakistan announced /24
YouTube announced /22
No easy way for networks on the Internet to validate messages
Direct provider has more of a chance since they should know the prefixes that their customers will be announcing (in theory)

26. The anatomy of web censorship in pakistan
Testing a list of blocked sites which is publicly available ~300 URLs
Whittled down from 500 because some sites were offline, duplicates etc.
VPN terminating in the US was used to ensure that the sites were indeed up and were being blocked in Pakistan
Procedure (for each URL)
Perform DNS lookup on local + 3rd party DNS server
Try to open a connection to the IP
Test for URL-keyword filtering (append the URL to Google.com). Expected result is a 404 not found if not -> censorship
HTTP request to the site
Tests performed on 5 networks (2 University, 2 Home, 1 cellular)

27. Results

28. O Pakistan, we stand on guard for thee
Citizen Lab report on Netsweeper being used in Pakistan
(title is reference to a line in the Canadian national anthem)
After Pakistan solicited proposals for their filtering system an advocacy group (Access) started a petition calling on technology companies to announce that they would not bid on the project.
Several major IT companies supported the petition
5 declined to comment: Huawei, ZTE, Blue Coat, McAfee, & Netsweeper
In previous ONI research block pages with company logos were common, but over time this decreased

29. Background: netsweeper
Canadian-based provider of Web content filtering + threat management products
Used for state-sanctioned censorship in several countries:
Qatar, UAE, Kuwait, and Yemen
Enables bulk filtering on specific categories (e.g., Adult, Entertainment, Information)
+ specific URLs and custom categories
These URL lists are central to their business
Web site boards 5B categorized URLs and 10M URL categorization requests per day

30. How Citizen Lab located netsweeper
Searched using to find the IP of Netsweeper installations in Pakistan
E.g., search for URL paths like /webadmindeny
Located the IP:

31. On the same IP…

32. Ok … but is this censorship?
Netsweeper could be used in a corporate setting as opposed to at the national level
Many user reports of seeing the same block page that Netsweeper generates on multiple ISPs
More IPs in PTCL found hosting Netsweeper

33. In country testing
To validate online reports The Citizen Lab ran tests to confirm
Web page accessed in Pakistan + Toronto, results manually compared
List of 1465 URLs tested
Observed a mix of DNS and blockpage blocking
<iframe src="
?dpid=1&dpruleid=78&cat=104&ttl=0&groupname=PTCL2&policyname=PTCL2-policy&username=MMBB-9-WLL &userip=X.X.X.X&connectionip= &nsphostname=X& protocol=policyprocessor&dplanguage=-&url=X"width="100%"height="100%" frameborder=0></iframe>

34. Hands on activity
Look at the Netsweeper testing page: Run wireshark while doing the “test” Look at the HTTP connections it makes How might we use a page like this to measure censorship? What might make this hard? Search for webadmin/deny to find Netsweeper devices around the world.

35. Hands on activity
RIPEstat page for AS 12880: Try looking up other Iranian networks NDT data in Google ctype=l&strail=false&bcs=d&nselm=h&met_y=download_through put&scale_y=lin&ind_y=false&rdim=country&idim=country:364&i fdim=country&ind=false OOKLA Speed test: type=l&met_y=avg_download_speed