1. CSE 592 INTERNET CENSORSHIP (FALL 2015) LECTURE 09 PHILLIPA GILL – STONY BROOK UNIVERSITY

2. WHERE WE ARE Administrative note: - no class next week - week after Tuesday lecture given by Nick Weaver! Last time: Different censorship measurement platforms Questions?

3. HANDS ON ACTIVITY FROM LAST TIME Installing/testing OONI Trying differentiation detector app Any successes? Questions?

4. TODAY Case Study: Iran Background on filtering in Iran (ONI report) Private addresses used within Iran (Anderson 2012) Dimming the Internet (Anderson 2013) Web censorship in Iran (Pseudonymous + Halderman 2013) Case Study: Pakistan Background (ONI report) https://opennet.net/research/profiles/pakistan Pakistan YouTube hijacking (Renesys) http://www.renesys.com/2008/02/pakistan-hijacks-youtube-1/ Web censorship in Pakistan (Nabi, 2013) http://0b4af6cdc2f0c5998459- c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12387-foci13- nabi.pdfhttp://0b4af6cdc2f0c5998459- c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12387-foci13- nabi.pdf Netsweeper in Pakistan (Citizen Lab report) https://citizenlab.org/wp-content/uploads/2013/07/18-2013-opakistan.pdf

5. BACKGROUND Limited freedom of speech in Iran grounded in their constitution Limits on topics ranging from religion, immorality, and politics State has well established mechanisms for policing traditional media (e.g., print, radio, TV) Internet, initially offered a place for people to express their viewpoints away from the state controls 2000-2008 Internet use in Iran grows from <1M users to ~23M users Fastest growth in the middle east at that time As early as 2001 government began asserting control over Internet access in the country Commercial ISPs in Iran are required to connect via the state- controlled Telecommunication Company of Iran (TCI)

6. CONFLICTING GOALS Desire to encourage economic IT developments … … but also rein in free speech Fourth Five Year Development Plan called for 1.5 M high speed Internet connections worldwide … but in 2006 Ministry of Communication and Information Technology issues an order forbidding home Internet connectivity of > 128 kbps  There were oppositions to the 128kbps rule but it remains in place Researchers, faculty and university students are exempt from the restrictions upon providing documentation Initially censorship implemented via IP blocking by individual ISPs, gradually replaced by centralized censorship by TCI Redirects users to 10.10.34.34 (an address owned by the censor)

7. MORE RECENTLY 2012: Supreme leader establishes Supreme Council of Cyberspace which controls three government bodies associated with censorship: Committee for determining offensive contents, located at internet.ir and peyvandha.ir which controls censorship policies. They are responsible for updating lists of censored Web sites and enforcing Internet communication policies Iran cyber police (FATA police) Responsible for prosecuting users involved in illegal Internet activities Revolutionary guard cyber defense command, (Iran Cyber Army) responsible for defending Iran against cyber attacks and implementing countermeasures Also, the “Fifth Five Year Development Plan” mandates development of national information network Many fears of complete blocking of external content

8. CAMPAIGN FOR NATIONAL INTERNET Head of MICT and other gov’t officials create public campaign extolling virtues of creating such a network: A genuinely halal network aimed at Muslims on an ethical and moral level – Ali Agha-Mohammadi A national internet can be very effective to protect the country’s information and the people’s security – Esmail Ahmadi Moghaddam Usage of private IPs within the country could indicate a desire to go in this direction But usage of these addresses is not particularly new Observed as far back as 2010 (Anderson 2012)

9. FILTERING IN IRAN AT A GLANCE http://www3.cs.stonybrook.edu/~phillipa/papers/TWeb.pdf

10. NETWORKING 101: RFC 1918 IP addresses on the Internet need to be globally unique IANA: Internet Assigned Numbers Authority is responsible for ensuring this Since IP addresses are finite and not all hosts need to be globally accessible, three blocks of IP addresses were reserved for local/private use 10.0.0.0/8 (16 M addresses) 172.16.0.0/12 (1 M addresses) 192.168.0.0/16 (65 K addresses) These IP addresses/routing information for them should not be propagated between networks ISPs should filter them (according to RFC) Commonly used for NAT (ie., multiplexing a single public IP address across many clients)

11. THE HIDDEN INTERNET OF IRAN Anderson 2012 – Reading on Web page Points of observation: 2 hosts in Tehran (1 connecting via AS 12880 ITC and 1 connecting via Institute for Research in Fundamental Sciences (AS 6736)) Collection of Web proxies within the country that these hosts connect to to test accessibility Proxies with both internal + external IP addresses Potential shortcomings The two hosts may be subject to localized censorship by network owners Testing of censorship could lead to reactions from the censor

12. ILLUSTRATION OF ABNORMAL TRACEROUTES

13. MEASURING THE INTERNAL NETWORK Many techniques… DNS (fig 6); 10.143.177.18 says it is an email server with hostname Webmail.isfidc.com. Running dig on this address gives us the external address for this server Can use regional Internet registries to figure out which organization is using the 10.143 address Another way to figure out internal IP ownership: Spoof a ping to the internal address from an external host When the external host receives the reply the external address mapped to the internal host will be revealed

14. RESULTS OF MAPPING

15. DIMMING THE INTERNET Anderson 2013 (Reading on Web page) http://arxiv.org/abs/1306.4361 Performance degradation to limit free flow of information Relation to network neutrality discussions? Data reused from NDT tool (client initiated network performance tests run against servers hosted by Measurement Lab (MLab)). NDT integrated into uTorrent Focus on: RTT Packet Loss Network-limited time ratio (where client has sent as much traffic as it can and needs to wait for ACKs before sending more) Network throughput

16. AGGREGATING MEASUREMENTS National ISP/AS + IP prefixes Control groups (grouping users with similar performance) Using median country-level throughput (based on highest performing measurement for each client on a given day) they find two extended periods of degradation Nov. 30 2011 – Aug. 15 2012 (77% decrease) Oct 4 2012 – Nov 22 2012 (69% decrease) Corroboration with reports: “The Internet in Iran is Crawling, Conveniently, Right Before Planned Protests” Suspected events around holidays, protests, disruption of Google services

17. EXAMPLE PLOT

18. READING PRESENTATION Pseudonymous + Halderman

19. TODAY Case Study: Iran Background on filtering in Iran (ONI report) Private addresses used within Iran (Anderson 2012) Dimming the Internet (Anderson 2013) Web censorship in Iran (Pseudonymous + Halderman 2013) Case Study: Pakistan Background (ONI report) https://opennet.net/research/profiles/pakistan Pakistan YouTube hijacking (Renesys) http://www.renesys.com/2008/02/pakistan-hijacks-youtube-1/ Web censorship in Pakistan (Nabi, 2013) http://0b4af6cdc2f0c5998459- c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12387-foci13- nabi.pdfhttp://0b4af6cdc2f0c5998459- c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12387-foci13- nabi.pdf Netsweeper in Pakistan (Citizen Lab report) https://citizenlab.org/wp-content/uploads/2013/07/18-2013-opakistan.pdf

20. INTERNET IN PAKISTAN ~130 ISPs: Wateen, Paknet, Linkdotnet, Comsats, Cybernet Wateen roll out of WiMAX in 2007 made Pakistan the first country with nationwide WiMAX coverage Largest Internet eXchange Point (IXP) in the country (as of 2009) was the Pakistan Internet Exchange (PIE) subsidiary of PTCL (gov’t owned ISP) PIE has three main nodes: Karachi, Lahore and Islamabad + operates two submarine cables (South East Asia – Middle East – Western Europe: SEA-ME-WE 3 and SEA-ME-WE 4) In 2009, ISPs no longer had to connect via PTCL and could choose third party providers Second major company in Pakistan Internet market is TransWorld Owns and operates Pakistan’s first and only privately owned submarine fiber optic cable system (TW1) TW1 has capacity of 1.28 TB more than necessary for the nation

21. INTERNET FILTERING IN PAKISTAN Filtering regulated by the Pakistan Telecom Authority (PTA) and Federal Investigation Agency (FIA) directed by the government, supreme court, and Ministry of IT (MoIT). 2006 – MoIT created the Inter Ministerial Committee for the Evaluation of Web sites (IMCEW) responsible for monitoring and blocking Web pages Directives about what to block pass from these government agencies to ISPs for implementation Wide publicity of censorship in Pakistan because of collateral damage 2006: attempt to block 12 sites with cartoons of Mohammad resulted in blocking the entire Blogspot domain for 2 months 2008: accidentally taking YouTube offline for hours 2010: blocking of Facebook, YouTube, Flickr, Wikipedia on “Draw Mohammad Day”

22. INTERNET FILTERING IN PAKISTAN (2) 2012: Gov’t solicits proposals for a country-wide URL filtering and blocking system including: Filtering at domain level, subfolder level, individual files Blocking individual IPs or whole address ranges Remote network monitoring via SNMP, configuration via HTTP/HTTPS Operation at L2 and L3 Modularity: stand alone hardware that can block up to 50M URLs with <1ms latency Later in 2012: indefinite ban on YouTube in response to a movie. Impact felt on other Google services with common IP addresses

23. HISTORY LESSON YouTube Pakistan Telecom Pakistan Telecom “The Internet” Telnor Pakistan Telnor Pakistan Aga Khan University Aga Khan University Multinet Pakistan Multinet Pakistan I’m YouTube: IP 208.65.153.0 / 22 I’m YouTube: IP 208.65.153.0 / 22 2008: Pakistan uses BGP messages to filter traffic February 2008 : Pakistan Telecom hijacks YouTube

24. HISTORY LESSON Here’s what should have happened…. YouTube Pakistan Telecom Pakistan Telecom “The Internet” Telnor Pakistan Telnor Pakistan Aga Khan University Aga Khan University Multinet Pakistan Multinet Pakistan I’m YouTube: IP 208.65.153.0 / 22 I’m YouTube: IP 208.65.153.0 / 22 X Hijack + drop packets going to YouTube Block your own customers.

25. HISTORY LESSON But here’s what Pakistan ended up doing… YouTube Pakistan Telecom Pakistan Telecom “The Internet” Telnor Pakistan Telnor Pakistan Aga Khan University Aga Khan University Multinet Pakistan Multinet Pakistan I’m YouTube: IP 208.65.153.0 / 22 I’m YouTube: IP 208.65.153.0 / 22 Pakistan Telecom Pakistan Telecom No, I’m YouTube! IP 208.65.153.0 / 24 No, I’m YouTube! IP 208.65.153.0 / 24

26. HOW IS THIS POSSIBLE? Pakistan Telecom connected to the rest of the Internet via the PCCW network This network did not validate the message sent by Pakistan Telecom …and proceeded to pass it on to its neighbors who also accepted it Worse yet, the route announced by Pakistan was more specific than the route announced by YouTube Pakistan announced 208.65.153.0/24 YouTube announced 208.65.152.0/22 No easy way for networks on the Internet to validate messages Direct provider has more of a chance since they should know the prefixes that their customers will be announcing (in theory)

27. THE ANATOMY OF WEB CENSORSHIP IN PAKISTAN Testing a list of blocked sites which is publicly available ~300 URLs Whittled down from 500 because some sites were offline, duplicates etc. VPN terminating in the US was used to ensure that the sites were indeed up and were being blocked in Pakistan Procedure (for each URL) Perform DNS lookup on local + 3 rd party DNS server Try to open a connection to the IP Test for URL-keyword filtering (append the URL to Google.com). Expected result is a 404 not found if not -> censorship HTTP request to the site Tests performed on 5 networks (2 University, 2 Home, 1 cellular)

28. RESULTS

29. O PAKISTAN, WE STAND ON GUARD FOR THEE Citizen Lab report on Netsweeper being used in Pakistan (title is reference to a line in the Canadian national anthem) After Pakistan solicited proposals for their filtering system an advocacy group (Access) started a petition calling on technology companies to announce that they would not bid on the project. Several major IT companies supported the petition 5 declined to comment: Huawei, ZTE, Blue Coat, McAfee, & Netsweeper In previous ONI research block pages with company logos were common, but over time this decreased

30. BACKGROUND: NETSWEEPER Canadian-based provider of Web content filtering + threat management products Used for state-sanctioned censorship in several countries: Qatar, UAE, Kuwait, and Yemen Enables bulk filtering on specific categories (e.g., Adult, Entertainment, Information) + specific URLs and custom categories These URL lists are central to their business Web site boards 5B categorized URLs and 10M URL categorization requests per day

31. HOW CITIZEN LAB LOCATED NETSWEEPER Searched using www.shodanhq.com to find the IP of Netsweeper installations in Pakistanwww.shodanhq.com E.g., search for URL paths like /webadmindeny Located the IP: 202.125.134.154 http://202.125.134.154/webadmin/deny/index.php

32. ON THE SAME IP… http://202.125.134.154/webadmin/start

33. OK … BUT IS THIS CENSORSHIP? Netsweeper could be used in a corporate setting as opposed to at the national level Many user reports of seeing the same block page that Netsweeper generates on multiple ISPs More IPs in PTCL found hosting Netsweeper

34. IN COUNTRY TESTING To validate online reports The Citizen Lab ran tests to confirm Web page accessed in Pakistan + Toronto, results manually compared List of 1465 URLs tested Observed a mix of DNS and blockpage blocking <iframe src="http://202.125.134.154/webadmin/deny/ ?dpid=1&dpruleid=78&cat=104&ttl=0&groupname=PTCL2&policyname=PTCL2- policy&username=MMBB-9-WLL &userip=X.X.X.X&connectionip=127.0.0.1&nsphostname=X& protocol=policyprocessor&dplanguage=-&url=X"width="100%"height="100%" frameborder=0>

35. HANDS ON ACTIVITY Look at the Netsweeper testing page: http://denypagetests.netsweeper.com/ Run wireshark while doing the “test” Look at the HTTP connections it makes How might we use a page like this to measure censorship? What might make this hard? Search www.shodanhq.com for webadmin/deny to find Netsweeper devices around the world.www.shodanhq.com

36. HANDS ON ACTIVITY RIPEstat page for AS 12880: https://stat.ripe.net/AS12880#tabId=at-a-glance Try looking up other Iranian networks NDT data in Google http://www.google.com/publicdata/explore?ds=e9krd11m38onf_& ctype=l&strail=false&bcs=d&nselm=h&met_y=download_through put&scale_y=lin&ind_y=false&rdim=country&idim=country:364&i fdim=country&ind=false OOKLA Speed test: http://www.google.com/publicdata/explore?ds=z8ii06k9csels2_&c type=l&met_y=avg_download_speed