Internet Filtering
CC Attribution - NonCommercial - NoDerivatives 3.0 Unported:
You are free to use, copy, distribute and transmit the work or content in unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Appelbaum, Jacob
Many countries in the world perform extensive network surveillance, filtering in the form of website blocking or protocol specific censorship; recently many networked authoritarian events in the Middle East/North Africa and across most of the world have come to light. During some specific political uprisings came increased invasive filtering events. I've run a series of tests in many of these countries, during these events with the specific purpose of identifying specific hardware and software in use. Some of the technical details are not novel but their application certainly makes a positive contribution. In some contexts, it's possible to identify specific network links that flag, drop, or inject data at the country level. I intend to show real world data such as block pages, network traces, scans of filters, interesting network blocks and I will discuss techniques for gathering useful data.
 So, this is a work in progress. So I don't want you to think that this is like finished. I've been for the last couple of years, like I've had access to like a large number of pretty interesting networks. And often it's by just traveling to this place. Like I like in some cases for months at a time like live out of a suitcase and just plug into every network I can get my hands on, which is like a pretty fascinating experience in itself. So when I talk about filtering, I'm actually talking about network filtering in the context of censorship. So net neutrality sort of comes into play here in that, you know, net neutrality is part of this bigger taxonomy. So you can know, for example, that your traffic is being delayed or that you're being packet shaped and that might actually be part of detecting where a filter is. But I'm not really going to talk about the network neutrality stuff. People from Georgia Tech and the UC Berkeley, they actually have some really fantastic monitoring devices and actual like tests to do this. And the Tor project is working with Georgia Tech as well as in the future I suspect we might do some work with UC Berkeley. Although I don't know about that for sure. We just got some funding actually to do this type of research for the next couple of years. So in theory, the goal of this project and the point of this talk is to show some very like interesting things and some commonalities and to build the taxonomy and then to build the tool and then to release the tool as free software and also to share all the data. So one of the key things that I want to drive home here is this idea that censorship is actually a second order effect. So you have wiretapping and you have some kind of monitoring of some kind. Maybe it's like a switch fabric where you can inject or something like that. But censorship is actually the second order effect. So it's not actually the most important part. What we want to try to do is detect the actual wiretapping in different ways. And there's all kinds of different ways to find wiretaps. So there's like legal stuff. There's technical means. There's like information that people pass down. Like I was just told today that Canada has the equivalent of the NSA wiretapping room that's run by CSE. So that's like a totally fascinating thing, which is very difficult to detect with technology, but it's really easy to detect with like a person who leaks that information. So we want to sort of correlate all this together, but we also want to build a technical tool that will be a useful metric for measuring networks. And so that's sort of the overall gist of it. And to give sort of an idea here, I put a lot more information into these slides than is necessary. So you can like read them if you want. Or you can skip them and I'll put them online. I have like 72 slides or something like that. But basically in this case, when we talk about censorship, we are usually talking about authoritarian governments and they generally like to block information. Like depending on which country you happen to be in or what network you're on, the authoritarian scale is sort of, you know, you can think about it as like having two sides. And on one side, you have like supposed free countries like Canada. And then on the other side, you have places like North Korea or something like that. And it is true that they're not the same. And it's a, you know, there's a graduated scale there. But at the end of the day, like almost every country in the world is on that scale. There are very few countries that are not on the censorship scale. So, you know, if you go a little further, you have places like Christianity, which is a micro nation in Denmark. They don't have internet censorship to the best of my knowledge, but their upstream is Denmark. So that means they have internet censorship because they buy transit from kind of a fascist country, right? So an interesting thing here is the threat model is best described by this Iranian police chief whose name I'm not even going to try to pronounce. And the thing that's really fascinating about this is how he sees the internet. So first of all, these guys have like incredible, they have almost total internet surveillance capabilities in Iran. The exception being with satellite devices, though they do have access, my understanding is they do have access to some equipment that allows them to monitor some of the satellite downlink. It's pretty easy to monitor satellite downlinks. I also have heard some things that say that they actually can monitor some of the satellite uplinks, which is like, you know, that's pretty good. They're doing better than a kid at a Starbucks. So, but what they actually say is fascinating. And I'll read this quote, and I'll try not to read too many other things from the slides, but these people should know where they are sending the SMS and email as these systems are under control. They should not think using proxies will prevent their identification. If they continue, those who organize or issue appeals about opposition protests have committed a crime worse than those who take to the streets. So if you just like let that sink in for a second, there are people on the streets that are protesting the government that are getting like shot without any due process, just like summary executions. And they're basically saying if you're using a proxy, you're actually like, you know, worse than them. That's pretty crazy, right? And it's interesting because if you look at their proxy systems, you realize they have like a lot of log data. They collect a lot of information. And in fact, what they do with that information is they go to people's houses, they kick down their doors, and they kidnap them, and they arrest them. They just like straight up stuff you see out of like a movie, like a Stozy movie or something like that. And that's exactly what's happening in Iran with a lot of people. So it's incredibly important to be able to know the edges of these filters if we can, because we want to be able to maybe send traffic between peers inside of a country, but we don't want it to cross a boundary where there is perhaps some kind of monitoring taking place. But it's pretty scary when you think about this, because there are people that make some snake oil crypto systems, and they just declare them to be secure. Has anyone here heard of a thing called Haystack, for example? Okay, so Haystack was this tool written by some guys that meant very well, I think. And the tool we reversed it, myself and a couple other people here. We reversed it, and we found that it was a tool that, assuming these logs were available or that they were constantly logging, that basically they would be able to retroactively find all of these users. And the way that they presented the tool was by saying it's only for super secret, high profile, extremely important people. So when you combine those things together, you can really create a sense of danger that I think is important to maybe avoid. Like, it might be a better idea to not use snake oil crypto, but it's also probably a good idea to not say anyone who does use your product is a spy. That's pretty obvious. You'd think that that would be obvious, but those people often have a financial incentive to get funding, so they want to look super cool. So they're like, hey, we help these people that are really important, give us a bunch of money. And then, of course, the US government, in that case, did in some way boost that project, and boy did they look stupid when we owned up their product. Oh, well. The thing is that we owned it to show people that it was not safe. It was important to do that. So we used our skills in order to protect people, because those people who were using the tool potentially were in some serious trouble. So this is some of the context here. This is very different than the United States or Canada or so-called liberal democracies. And I think that it's hard to even comprehend that. It's very difficult. Unless you've been to a place like this, this kind of authoritarianism is something that is hard to believe, especially if you're a Canadian, right? Peace order, good governance. You're just like totally cool. You've got a monarchy. Everything's great. I don't know. There's a reason the Americans shot the British. But at the same time, I want to make it perfectly clear, which is that, so this is a billboard liberation front. Modification in San Francisco just happened to take place outside my office. And I was really surprised by this. I walked outside. Boom. There's the photo. And this is the reality here, right? The total surveillance the Iranians have is actually not that different than the total surveillance we're pretty sure that the United States has. And that's really bad news for Canada because you don't really have fiber that runs horizontally. So if we pretend that the Earth is like Canada's here and America's here, you don't really have fiber that runs that way, except through the internet two links. So when you go to the Canadian Hockey Hall of Fame in Toronto, because I know everybody here likes maple syrup, hockey, and moose. But basically, if you go to the Canadian Hockey Hall of Fame website in Toronto, you actually transit through Chicago. So you want to go and look at hockey and you get surveilled by Chicago's wiretapping system. Because the NSA definitely has wiretapping rooms in Chicago. There's no question about it. But there isn't exact proof. Mark Klein revealed in San Francisco at Second and Folsom that there definitely were NSA wiretapping rooms. You produce pictures, network diagrams, and all that stuff. So there's absolutely no question that they were doing warrantless wiretapping. Everybody goes through AT&T or a similar provider. So it's important to note that I'm not going to bash on the United States, but I'm not also going to pretend that we're perfect. We've got some serious shit here. The US government said, we can do this. The Constitution says you can't do this. And the court ruled, yeah, well, so since everybody in the United States is harmed, really nobody was harmed. So that'll be fine. We don't need to do anything about this. And they dismissed the cases or they rule against them. And that's very serious. Because it's like saying, as long as we like harm everyone, it's totally cool that the state totally dominates and breaks all the rules and everything. And it's weird because it's a so-called conservative government. It's like, what are they conserving if not the Constitution? Obviously, they're on power. So it's important to note that the NSA is everywhere. They've got a lot of stuff. And I think that they're really good. I've met a lot of guys from the NSA. And they're the best cryptographers that you'll ever find. And they have really good hackers there as well. Some of them leave Charlie Miller left and he's pretty good. And there are people that are there that are maybe even better, especially the guys that do the wiretapping. They have optical taps that are very hard to detect. You need someone like a Mark Klein. So if any of you guys happen to work in data centers or happen to know about these types of things, I really encourage you to tell the world about it. Because there's no reason to keep this a secret. It's important to show that and to have as part of a democratic society to have discussions about this. Because maybe this is the world we want to create. We want to create a world where we have total surveillance all the time with everything we do. Great. I didn't vote for that. Just like Canada didn't vote for the monarchy. And so the thing is that maybe that's not the world you want to create. But maybe you do. I don't know. If you want to create that world, then I think we have to have a dialogue about it. And we can't have a dialogue without facts. So that's what this talk is about. Creating facts all around the world. There's this idea that you don't have anything to hide. But there's this other idea, which is this concept called the captive mind. And the idea of the captive mind is that when you know that you're being monitored all the time, you know you're being watched, you actually do generally behave differently. There are studies about this from the Stasi era where people talk about what it is when you know that maybe your neighbor is a secret police officer. And so to give an idea about how this is a fallacy that you have nothing to hide, if you're wearing pants right now, you have this concept that maybe you want to cover yourself up, or you want to have the autonomy to decide when you take your pants off. This is privacy. And this is part of having individual freedom. You get to choose when those pants come off. And hopefully they stay on for the whole talk. But this is important. Because the thing is, you might not have anything to hide, except that maybe you're going to go and work at a job. And maybe at that job, they want to have your genetic information. Or maybe they want to know whether or not you have ever associated with me at a conference, for example. You might not have something to hide, but you might not want to reveal that, because it could be damaging when your data trail tells a story about you that isn't necessarily true. And so this I think is really important to think about when you consider the total surveillance state that exists. They have incredible logs. Full packet captures definitely exist for certain individuals. And like for example, the NSA had an intern that looked at Bill Clinton's emails after he was out of office. Well, how did they have that? Why did the NSA have that? Because they were like dumping all this data. So they had full packet captures for this. And they have a database where you can query it and ask information. It's like on the one hand, great, let's go get jobs as NSA interns. And then on the other hand, that's pretty horrifying that even the former president of the United States is not able to get away from this. It's like really total. And that's pretty scary stuff. So part of the reason that I came to be interested in this is that I work on Tor, of course, which I think probably, does anybody here not know what Tor is? Raise your hand if you don't know what Tor is. OK, one person. Great. Kresh Kursen Tor. It's an anonymity network. There you go. So basically if you try to download Tor, it's a program you install on your computer. A bunch of different countries actually, and not just countries, lots of corporations, many corporations that take government funding, which is kind of weird. We're a legitimate company. So we're a nonprofit in the United States. And people try to block this all the time. And they're successful. So you go to torproject.org and you get a block page. In fact, in the last five years, every place I've worked has been blocked by every internet sensor I've encountered. So I'll go to my work webpage to try to do something. And it's like, sorry, you can't do that. It's weird that they let me into the country, but then they won't let me onto my own network. So we decided that we're going to solve getting onto our overlay network by using another overlay network, which is that we just wrote a, do you guys remember, like, where's email bots where you would send wares via email? So we did the same thing. I wrote another thing in Python. And you just send it. And we'll deliver source code signatures, binaries. You can get a whole Firefox and Tor and everything all preconfigured. So you don't have to download anything and just drop it that way. And so it's interesting because this shows a lot of people actually use this. I think somewhere between 600,000 and 1,000 people a day actually download Tor via email, which is crazy, right? But the reason this is happening is because people are trying to find a way to get a signal in or out of wherever they are. And this is one of the ways. There are tons of other ways. Like, as I understand it, people also post binaries to Usenet. And you can get it through IRC. I used to run an IRC bot, and you can get it this way. So their filtering might be total in some cases, but it's interesting because depending on how you stack all the protocols together, you might end up in a situation where they've decided that a thing is something other than it actually is. So it's cool to have, like, a binary in an email. Like, they can't solve that problem, so they just pumped on it. Which means, of course, that in almost all places where you can download Tor via email, we could make, like, a plug-in for Tor that used SMTP as, like, the, you know, communications channel or something. And in fact, we're working on a pluggable architecture to do exactly this. So at some point, you'll have total, you'll have to have, like, full inspection of all the packets in a meaningful way to be able to understand that. And even then, like, there are tons of protocols which are necessary that nobody understands really very well and they don't get filtered. So unfortunately, the directory design, this is for, like, the one person that doesn't know what Tor is, all the relays, they publish to directories. So the directory authorities are trusted authorities. There's eight of them in the world right now. Some of them are in the U.S. Some of them are in other countries. And basically, the relays published to the directory authority, you get a big list of all the Tor relays. So this is a big problem. On the 60th anniversary of some dude coming to power in China, they decided that, like, they were done with having Tor in their country right before they went. We had been expecting this to happen, but we didn't expect exactly how it would happen to happen. But essentially, they downloaded the list of all the Tor relays and then they just put them in the firewall and they blocked it. So this is really funny for two reasons. The first reason is that means they, like, use us as a source for their filter, which is great. And then two, it's like, depending on how they vet that, there could be some, like, really, like, quite strange situations here. Like you could accidentally publish a bunch of Tor relay descriptors that are, like, all the IP addresses and port numbers of web servers that serve up visa application websites, for example, to leave the country. And then they would maybe filter it. So, I don't know, is that cyber war? But I'm not sure. But in any case, this happened. And an unintended consequence of this is that all these Tor relays that you could no longer reach from inside China, you couldn't, from the Tor relays, reach back into China either. So like, if you would try to go to a particular website inside of China, it would actually drop your packets. So now, you not only can get yourself inserted into the filter list, you can get yourself inserted into the filter list, and then you can test your filter from the other side. And if you can get inside, you can do bi-directional tests. And I'll talk a little bit about this. So if one side is lying to you because it has, like, some pretty good packet inspection stuff, it can only lie to you to the point in which the network reaches it. So of course, it can lie for an entire side inside a country, like Syria. Syria has very serious internet filtering, and I'll get to that. But basically, once you get to Syria, there's like a series of hops to get there. And that list is not going to be tampered with by Syria up to a point, right? Interestingly enough, most of the countries in the world that have really oppressive internet filtering, and not just in terms of economic oppression, but actually, like, sprayed up, like, these packets are dropped into a black hole, they generally don't have BGP-looking glasses. So like, you know, if you want to look at a network, you know, you look at the looking glass and you see what's going on there, you see what's routed there. And it's actually, you know, like, it's difficult to find it. You will not find a BGP-looking glass for Syria. In fact, you won't find almost any TCP ports open in that country at all from the outside. And from inside, if you can get it, if you can get a box, however you get a box, instead of Syria, you can reposition. And then from that, you can scan different networks all the way up. But basically, everything is filtered, like, crazy, crazy filtering. And I'll show some of these. And so I talked about how the, you know, second order effect of wiretapping is censorship. So a lot of people, what they do is they say, well, I'll use a VPN. And then they use a VPN to go to a so-called free country. But it's fascinating because if censorship is the second order effect, the first order thing that is actually taking place is wiretapping. So you've used a VPN. You've hopped over to the censorship. You feel like you're totally safe. And what do you do? You reveal all your packets to someone else. Now, like, it's pretty clear to me with things like Lulsec that if they really had all the data all the time, that they would be able to catch a lot more people, in theory, right? But I think in practice, it's the John Gilmore quote, right? If you're watching everybody, you're watching nobody. So what happens is when they find a person they're interested in, they try to link all that information back up. And so it's possible you can do a thing that's unlinked from that. But if they ever find a way to link that, the data is there. And there are some cases, and there are some evidence in the news, and there are some legal cases where this is pretty clearly the case. We obviously don't have solid information because these guys aren't exactly talking about their systems. And in a so-called democratic country, it makes you wonder how that's happening. And so using a VPN, great for getting past some kinds of censorship, except you're tagged as using a VPN. And depending on which country you're VPNing from or to, they might have an agreement between each other for exporting data. Like, if you VPN to Holland, well, they legalized and have an open discussion about all this internet wiretapping and censorship, right? And so there was an interview with the head of the Dutch police where he actually said, yeah, I don't understand the Americans. Like, you know, they're just doing all this stuff, and they're doing it in secret, and it's causing a controversy. Here, we just made it all legal, and so no one even talks about it, and no one cares. And so there's something to be said, right? And if Holland will excite their own citizens to the United States for anything at all, they'll probably give up your data to the United States, too, or to another country. And maybe that's the world we want to live in. I don't know. But maybe using a VPN isn't a good idea. So I got to say, the filter detection tools that exist right now for people to detect internet censorship are pretty weak. If you've ever used a Windows device, it says, like, partial internet connection, full internet connection, right? The way that that works is pretty simple. Windows uses what we'll call a known good test and another known good test. And so it uses an HTTP request to go to a particular hostname, which is configurable. It downloads a file. It looks at the contents of the file. They're not signed, right? So there's like a kind of weird thing there. I had an argument with someone about this, and they're like, oh, it's great that it's not signed. It's like, well, I guess, depends what you're doing with the data. If you're trying to do a known good result and then you're going to behave differently afterwards, you probably won't sign data. They also do a DNS request. If the, you know, a record for the DNS request results to what they think, then they say, partial internet or not. So they use DNS because sometimes networks allow for DNS packets to pass but not HTTP. We all know this isn't very special. But that's how Windows does it. iOS does something similar to that. Only it touches a little bit more data. Android has something similar. Google Chrome actually uses an inversion. So Google Chrome looks and it tries to resolve five random names that are 10 bytes wide, and it says these 10 byte records should never have an IP address if they do were being DNS poisoned, right? So you've detected open DNS or something like that. So I implemented those, like I wrote a little emulator that implements those. So if you've ever wondered like, hey, I've like gotten onto this network. Does this network work? You've got all these like, you know, patchwork tools. Well, we have a framework now for detecting this. And it's written in Python. So you can just say like, oh, I have this Python code. I want to actually like test this. Okay. So that's great, but it's not like particularly interesting. There's another tool that the OpenNet initiative developed. Has anybody here ever seen an OpenNet report where they talk about political, like the political science context, and then they talk about, you know, moderate political filtering, articles are filtered, you know, like science and religion articles are heavily filtered, and they have like this box and they like fill in dots to tell you where it is. Has anybody seen any of these reports? The guy that works at the OpenNet initiative raises hand. Okay. Well, you are relevant. So, I mean, seriously, oh, and I is amazing. They have done some interesting stuff. But my criticism of oh, and I is perhaps not important to anybody because it's inside baseball. But for me, it's important that we have open methodology and open data so that we can actually talk about things like in a factual way. So when oh, and I produces a report and it has, you know, this moderate political content, well, what does that mean when it's filtered that way? Well, we don't know because their methodology isn't really open. So our turtle is an interesting tool. It's written in Python and it is essentially a tool that connects to the University of Toronto, which runs a proxy with SSL. It uses Python's SSL libraries, which means I don't believe, I'm not going to admit to having looked at the code, but I don't believe that it verifies the SSL certificate. And so there's two problems. One, it's completely fingerprintable by its behavior, right? It downloads a list of all the things that are suspect URLs and then it loads them over a proxy, which is the University of Toronto's proxy, and then it loads them directly. So you sequentially load a bunch of super questionable URLs and you do it while also sequentially loading a bunch of super questionable URLs over a proxy, which connects back to a known IP, like a slash 24, of the people that test the Internet. This tool is only handed out to super special hands like the people. I asked them for a copy. They refused to give it to me for like three or four years. Eventually I did get a copy. I don't know if they ever knew that, but I looked at it and what I found was that this is not a good methodology because, first of all, a filter can detect that you're an ONI tester. And so that's bad news because then they can skew the results. And another thing is that because the tool is a special tool and not a generic tool and not a generic framework, it might be the case that having a copy of that tool on your hard drive is like, no bueno, right? You don't want that. You don't want to be the super special spy that has this special R-turtle tool, I think. I think that could be very dangerous. And in fact, there's some other issues with it. For example, you can't stop on a resume test or at least you couldn't at one point. So it's like you have to sit in the Internet cafe and wait for it to load every single URL. So maybe you're loading a bunch of political sites which happen to trigger a filter, which depending on how serious their Internet filtering is, they might dispatch someone. So that could be very bad. So I think that's a bad idea because it also requires like a graphical user interface and you basically need to be there. I would prefer to have a probe you could deploy on a system, probably with the system owner's consent because of what could happen to them. I think this is probably like a pretty good thing to drive home. So for example, if you happen to find a proxy in a country, that might be a useful way to deploy this stuff. Herdict is an example where they tried to fix a bunch of the R-turtle stuff. And I think Herdict is a great idea, but it's very limited. So what Herdict is, is it's like a Firefox plugin and it just tries to load URLs and when it doesn't work, it kind of automates the process of submitting it to their website. It's great except it does the same connect back stuff that R-turtle does. So people know you're using this tool and I don't think that it's going to be able to get a lot of information. So you might know that a site is potentially blocked, but you really don't know a lot more than that. I suggested that they should bundle a copy of Tor and then they can use Tor as a control channel to send data, but also to fetch data and then compare it. And yeah, well, they didn't do it. So the academic research by Georgia Tech and UC Berkeley is also totally awesome. So UC Berkeley has a bunch of stuff they put up and they do like known good tests against stuff. It's incredible how easy to do this. Basically almost no man in the middle protocol devices that I found in the wild with the exception of blue code devices really are very smart. Blue code is very, very smart. And I've met some people from blue code and some of them are really impressive guys. They just work towards really unimpressive things. And so all of these things here, I had to either reverse engineer or I had to like, I don't know, other stuff, but to understand the way that it worked. Because the methodology and the tools and the data are basically closed. Herdict is sort of the exception to that. But what it does is basically the same thing as you go to a website, it's blocked, you like let somebody know. So it's not really that interesting. It's good though because the data correlation on their website is awesome, right? You can go and look at all the URLs that are blocked and when they're submitted you get to see the data point analysis. I think that's really useful. Okay. So each different country has different kinds of filtering, which is of course obvious, but it's interesting because in the case of China, someone here said like, oh, I don't want to go to that internet filtering talk. It's just going to be China bad, Iran bad, USA good. And that's not the case at all, right? I hope that's clear. But China is not, people like to talk about the Great Wall of China or in Iran, they call it the potato wall. And the basic issue here is that it's actually not one wall. Like yes, the country has border routers. There is a point where the fiber leaves the country. There is the point where a satellite uplinks out of the country. It is true that those routers do have some extra special stuff. If you don't know this, is anybody here in the audience from Cisco? Anybody? Cisco employees? I guess I'm not too surprised, but Cisco has a nice marketing department and they actually had some slides that talked about how using their special products that they could help custom design as part of this greater thing called the Golden Shield project, that they could build the Great Firewall of China to help track down like, what did they call them? Evil religious cults, the Falun Gong. I'm not really a big fan of the Falun Gong. They write some earpieces about me in their newspapers, which is totally awful. But nonetheless, I think it's fucked up that Cisco is like, yeah, you want to hunt down those people and really harm them? Well, we'll sell you the products to do that. And in fact, we'll help design them so they do it better. They're being sued right now. The lawsuit was just filed on the last month against Cisco by some Falun Gong people in the United States. So there's something to be said about doing that, because the end result of that is not just that someone gets their internet taken away. It's like they get executed potentially. Definitely their life is destroyed. So let's call China profit over people by Cisco. It's a Cisco-powered network. The USA has different tactics. The DMCA is used for taking down stuff and centering stuff, but they also use ICE, the Immigration Customs Enforcement people. They've decided they want to go into the domain seizure business. You've probably seen this. So they claim legal authority. It's pretty weak, in my opinion, because what they do is they just take a domain. So first of all, if you host a domain in the United States, super sketchy, right? Because one day someone can just pull your shit and you're done. So that's bad news. And the illegal tactics are the ones I talked about before with the NSA, AT, and Treason people. So basically, NARIS devices deployed across AT&T networks, and then they sniff them, right? So I think this is a grand strategy towards a total internet surveillance plan, which it's not clear to me how to prove that, but it seems pretty obvious that when you wire tap the whole internet, you're not doing it just for the sake of wiretapping. You have something beyond that you want to do. And that's really scary stuff. Even if you know you're politically neutral, which I don't know how you can do that on a moving train, but if you're politically neutral on this, it should still be scary that they aren't consulting you, especially if you're a citizen of this country, or if you have bilateral treaty agreements and your traffic flows through this country. Lebanon is really interesting to actually use free software. I was like, oh, cool. They use free software here in this country. Oh, look at that. Damn. So Syria actually uses off-the-shelf commercial products. And this is really fascinating because they're off-the-shelf commercial products are, well, supposedly they have some embargoes, right? Where the government and corporations aren't supposed to be able to buy some tools. And I don't know if I agree with them, but it's fascinating to note that they are ineffective. So each network is, of course, different. So if this seems familiar, it's because if you do black box testing and reverse engineering, like if you saw Sodorov's talk about XSS filtering, I think this is maybe a little weaker than his talk. I don't know. But basically, it's a black box, right? All these network devices are black box devices. And you can model them. And you can say, I know that the network is supposed to behave like X, Y, and Z, but it actually behaves like ABC instead. I know the latency is supposed to be Y, but actually it's the Z, right? And so that's kind of a fascinating thing because it means you can build unit tests for the internet, right? You can say, how fucked up is my internet connection? And then you can answer that question. So we have a taxonomy, right? So if you have the ability to do wiretapping, an active wiretapping where you can write data back to the network, you can, of course, log data, right? That's something that flows out of it. So passive wiretapping, we're not even going to really talk about that. Just assume that in almost every place, there is passive wiretapping because there's evidence of in almost every place, there being passive wiretapping. And in fact, in some cases, the network administrators want that. And it just gets misused. So once they, of course, can wiretapping, they can do injection, they can do interception, they can drop packets, they can spoof packets. So if you've ever seen Evil Grade, for example, there's a deep packet inspection company in the United Kingdom where one of their guys went on to Reddit and talked about how, you know, if you use lateral thinking, you can always take out the bad guys. So he implied, he didn't say which company he was from, but it was obvious to figure out which one he was from. It sort of implied that they have tools, that they deploy on the network, and then when they find a bad guy, like even if they're using Tor or SSL or something like that, they have a way to get data into their computer or to inject code into their computer. And it's fascinating if you think about it. If you can man in the middle of the whole internet, does every computer that you've ever seen stand up to that? Probably not, right? So this wiretapping goes a long way because you can basically understand that those people that are running those devices, they're human beings with needs and families, right? So that means that you can probably get them to do what you want if you're willing to go pretty far. And so having this ability to wiretap leads to a pretty serious situation where you can do really nasty stuff to a lot of people. And I think that's kind of a little bit scary. So we've got this filtering taxonomy. And here's some techniques that I've used. So I'll sort of explain each one. Like TTL, walking and probing, we can call that trace route. It's a little bit more than trace route. But basically, you can use a bunch of different protocols, and then you can expire things, and you can measure things at each one. So like, for example, you could take like an IP where you're in one position, you want to go to another position, and you can walk all the routes in between, and you can look at the latency. Obviously, any hop along the way can lie to you, right? If you've seen Moxie Marlin, Spike's, TCP, or his trace route spoofing tool, I don't think it still works, but maybe it does. Some people use a tool like that against the Scientologists many years ago, where when the Scientologists did trace routes to the Operation Clam Bacon Network, they made it spoof the trace route back to the Scientologists upstream. So when the Scientologists would call to pull their uplink or to get mad at them, it was their own ISP. So like, oh my god, it's going from inside the network. So basically that's a pretty useful thing. Keyword injection is awesome. So combining TTL walking and keyword injection, you can stick in the payload of a packet, a keyword. I'm going to go faster here. But basically, the keyword injection here is pretty awesome because you can walk each router and know when you hit a router, which one has triggered it. If you make a request and you don't get the result you expect, basically you're getting like tampered with. And you can do a bunch of other stuff, but you can just literally detect tons of different tampering in a bad way. Now, HTTP request tampering is pretty awesome. So you can say get space, e space, t, and filters will let that pass, even if the website was blocked. Testing known bad URLs. Like last night, I downloaded extremely questionable URLs, and since my hotel room is on Hugo's name, and I downloaded all these things, I didn't download any of the images, so tree falls in the forest. And Hugo gets the call from the police. So you can download this bad list of URLs and check it against a control. And never-clientancy is, of course, something also really awesome. Let's say you don't know how many hops a thing is. If you get a request in one millisecond, you can be pretty damn sure that it's not the upstream host that's like 20 hops away. They gave it to you. And of course, every single application has different heuristic content length and this header. Like for example, the Pirate Bay is Blanc show this in a particular country, and you wouldn't necessarily know it without downloading the content. But just by looking at the HTTP headers themselves, you can pretty much instantly tell that you're being man in the middle, and you can always find out that these proxies, well, people that run the networks generally don't patch them, and the reason they don't patch them is because they're not the kind of people that visit those bad sites. Whoops. So that creates some weird stuff. So let's talk about keywords for a second. Like gosh, how would you do that? Well, you can use a language dictionary, right? Or you can own up TomSkype. So that's what I did. And TomSkype is this awesome backdoor deployed against the Chinese people. And I'm pretty sure that this is the case, but this web site, which has like hilarious things on that URL too, e2.skype.tom.glesh installr. And the way that this works is that someone says to the TomSkype, embarrass us. This keyword is very serious. So make sure that's filtered. And so then they push that out, right? So these sensors are like outsourced, right? So it's really fascist. And it's the marriage of the corporation and the state, really, right? So they send, there's your keyword. So for China, it's like this. Every country has weird shit like this. So you just have to find the weird shit you're interested in or every network. Like in Canada, it's all about child porn, right? So that is a little sketchy. I admit that. So you might not want to tread there unless you're in Hugo's room. But this is a project I really wanted to share. There's a guy named Andrew Clement from the University of Toronto who's totally amazing. So he's this old guy. If he's watching this, like lots of respect to you. You're like an old Unix beard, you know? And he built a tool that's IX Maps. And basically you visit it and you say, I want to go to the Hockey Hall of Fame. Tell me. What happens? And it shows you like a Google Smash app with all the possible NSA listening sites that they've inferred that exist. Because yeah, your packets, we pass through an NSA listening point. I'm pretty sure actually to go to IXMaps.ca from some place you have to go through an NSA wiretapping point, which is like hilarious, right? So when they give you Google KML files, so it's not just like in theory. It secures the address of the wiretapping point. You go through Second Man San Francisco, therefore we know that that's the case. So that's awesome. It visualizes this and lets people know and lets people check this URL and say, oh, hey, how about that? So I see quick, but this is not very quick. China, I mentioned the Baidu problem where they filter your IP. Now you can't connect the sites in China. Well, you just like everything about building this into Tor, actually. Want to know if the Tor bridge has been discovered by the Chinese? Well, then like load the Baidu web page. And if we can't load it, it's because they have put us into their filter. So we can do automatic. So we can build an API basically of their filter. Their DNS move is awesome. Pick an IP address in China. I've told Block Finder, which is this simple thing for parsing LAR and RAR allocation data and GIP data. And just say, like, give me all the IP addresses for China. Pick one at random. Pick an IP address. It doesn't have to be up. Craft with Scapey, DNS packet, a query, and then do CL walk all the way through. And before you hit that IP address, as long as it's routed, you'll actually get a DNS response when you cross their border routers that do DNS booping. You have the right request. So if you ask for a super secret Falun Gong, you know, church, then you get that, right? So that's awesome because it means that you can also note a couple of things about it. Like you can use them for DNS amplification attacks because you can, you know, make a bunch of spoof requests and then they send a whole bunch more spoof responses. So their censorship is actually, you can use it as an attack tool, which is hilarious. Like, so you spoof from Iran and you spoof a bunch of stuff and then they start packeting Iran or they spoof like a country that has a very small link and that really small uplink can be flooded by the Chinese, which have like a much larger uplink and you, like, have multiple layers of indirection. And anyway, don't do that. But just an interesting thing, which is that, like, when they're tampering on things on the Internet, you know, you can have that. Okay. So the other thing is timing of TCP resets. If you do a trace route and I see and P trace route from say California to, um, this and Shenzhen, you're going to have, uh, you're going to have like a certain latency for ISM P knowing the number of hops and knowing the latency allows you to guess a range and you can visualize this and I don't do very good visualizations, but you can visualize this as a sort of line and here's, you know, zero milliseconds and here's 20 milliseconds and here's a hundred. And you trace route with ICMP and you see that you're a hundred milliseconds from Shenzhen, but you actually get a response, um, say a TCP reset at five seconds. You could be pretty sure it didn't get all the way to Shenzhen twice as fast. Right. And so then you can say, well, I'm going to do a bunch of network exploration and I can say, okay, well, I did a bunch of network exploration and I found these five hops that I always pass through. And so you can change the TTL again and you can see that when you've done, you do in Shenzhen, you're acting this stuff back and forth and you can actually change the TTL and so you never hit the host. So you can actually probe systems in this country without ever sending packets to them as long as you know the general dense. So you can like, of course, just take a guess. Once you cross the border, you're good. So you just need a routable IP and now you have a metric that allows you to calibrate all of your tests. So you can say, I know that if I get a TCP in 30 milliseconds, I'm definitely getting a reset from the outer, I'm going to drop that reset. I don't care about it, but I'm going to note that I got it. And so now you've like just like taken their millions of dollars worth of censorship and you just thrown it in the trash. Except that in some cases, some stuff doesn't get TCP reset, it just gets dropped on the floor. And when that happens, you can know that it's happening, but you can't really do a lot about it. You need to find a new path. Denmark, for example, so here's the pirate bay in Denmark. How does this work? This word is filtering, right? And taking over their entire country's DNS filter is hard as owning a bind. So that's maybe not so great. But anybody that goes to the pirate bay on that particular network, this one, full rate, a bind that they have. I didn't check again last night, but I'm pretty sure it was buying. So they just like spoofed their response. Okay, Bahrain is awesome. I didn't know they were part of Anonymous, but if you notice, it's anonymous.com.bh. So like I thought that was cool that they did that. Like who knew that they were in support? So they have a pretty familiar block page, like this aesthetic, this like English, Arabic, mirror. You'll see this a lot in the next coming pages. I forget exactly how this is triggered. The reason I had this in here is I met a guy that does network engineering for Bahrain, and I taught him how to use Tor. And he said, yeah, the office next to me is through the internet in Bahrain. Check out our censorship block page. So it's like he works on building the internet, and the guys, I'm a fuck it up. And he was really, really, really not happy about that. He thought it was like kind of a bummer. It's like very self-defeating. Like every day you go into work to make the internet better, and then the guys next to you, their whole job is to make people think the internet is broken when they try to do stuff. He's like very unhappy about that. So United States has an interesting thing, which is that anybody here of Amtrak, I guess, you've probably heard of Amtrak. So it's like a train system, but it doesn't really run on time. That's how you know that America is not too far away from being a good place. Our trains don't run on time. So you'll notice that this is for Amtrak Cascades. So what is this? Well, it's a captive portal system, and it depends on the region. When I was at Akaleta, I think how you say it, in DC, they used Barracuda internet filtering devices, and on the WICOS, which I thought was more interesting, they had some Hodgepodge free software crap basic portal where depending on you, you would actually like, you'd hit Apache, or you'd hit Lighty, or you'd hit Squid. And you could also make RPC calls against these boxes, which was kind of weird. So you could, in theory, mount NFS and stuff like that. So I think you might even be able to mount the NFS partitions where their filters, rules are stored and then change them. But I didn't do that. I just looked at the fact that they had RPC open in general. An interesting question here is a legal question, which is if Amtrak takes US government federal money and they block access to a website, which is a legitimate company in the United States, and it's not in the same state, is that interfering with interstate commerce? I think it might be. And I think it's interesting when they take federal government money to do that, because that's something a little bit questionable. So forward that on to a lawyer or something, I guess, if anybody cares. Like I said, all the places I've worked, like Tours in non-profit in Massachusetts, and I go to the tour website and it wasn't blocked, but I used to work at a small industrial film company in California that specialized in online rehabilitation videos. And those videos, of course, are blocked. And the website is blocked and everything relating to it is blocked. And it's a legit company. So in Washington going to this, it's blocked. I don't know. That's a little questionable. Anyway, you can detect it and it is a danger to everybody on the train, of course, because like, you know, squid. So the United States has a different tactic, which I mentioned before. This is the domain seizure tactic. All it is is they take NS records and they just point them somewhere else. It's like no big deal. So Lebanon is interesting. Here we are trying to go to tour project and we see access denied. So if you're noticing something about the block pages, you're probably noticing that the content is regular. And so in this case, content underscore filter denied, access denied, whatever, you can be pretty sure that's squid. So you know that Lebanon routes all their ATV traffic on this network through squid. So Ogero, there are the IP addresses of their squid machines, 2.5 stable 11. I don't know if that's actually very stable. They were unpatched like at the time years ago. I don't think they've upgraded them at all. An interesting thing is if you try to scan them from the outside, you don't actually get the same results. But here's where it gets interesting. We know it and we see that it says it's like four hops away. So now we know the distance. Prop ups. Prop up. There come any milliseconds away. And if you look at that, it's like 169 milliseconds away. Gosh, that could plant it. Why is that number so high? Well, the reason it's so high is everybody is going through these proxies. That number, day. It's so over them, like it doesn't have a lot of RAM in the machine, I would imagine. I don't know for sure. But that's like maybe not so great. And if we look, we can compare. So now we have a way to create a delta. So port 443 is not hijacked. It's not the same. So that's great. So we have the ability to calculate a delta between things that we are pretty sure about and things we aren't sure about. And you can use different networks to test this, but it's actually kind of difficult. One thing that you can do if you're in a really heavily filtered network but a proxy will work is that you can identify your IP address and do a trace route in return with multiple protocols or from routeviews.org. Really awesome that you can do trace routes from that. So you would do like a trace route and you would go back and you can actually see the actual latency from the host to the router. And so you can take that off and you can know how much was actually added by everything up in between. And so you can say there was like 50 milliseconds of latency added by the first hop and 150 or 1200 milliseconds of latency added. And so you can do some really basic math and you can say these fucking guys are totally screwing up my internet connection on hop 4. So worst ISP in the world, Interference of Names. I mean if I was a Middle Eastern ISP I would not call myself Keranet. Fucking horrible, right? Like they want to be Earthlink, that's what they're trying to say, but like I, whoa. You know just from a public perception standpoint I might not call myself that. They shut you through 85, 112, 95.11. That whole slash 24 is full of super sketch man in the middle stuff. They do mask ICMP trace routes. So they have an engineer there that does understand a little bit about TCPIP, which was surprising to me. I met a couple of guys that started these ISPs and they have really interesting ideas about running networks like from patching to whatever. Like I think there's some people in the audience here that have spent some time in Lebanon and they know that like the computer systems in the Lebanon are like, well, you know, bad news for them. So you can see that it's the same thing. So two hops here. So we can easily know that that host is absolutely not two hops away. And we can know by the latency that, you know, the proxy is probably a little overloaded too. Two hops away, 167. I don't know. That's so great. Syria is interesting and I'm a little hesitant to talk about it because I don't want the Syrian government to just fucking kill me basically. They're super scary. They're really scary. They are like in this moment right now where we're all sitting comfortably in this place and I'm standing slightly uncomfortably. You know, the Syrian government is like shooting people in the streets that are protesting in the major cities. Like I have a friend who's like in a protest with his father yesterday and like saw like something like five or something people get shot and killed. So they are serious. Like when they want to harm you, they do. And now I think this is the first time anyone's ever talked about this. So I'm going to, well, we'll see how this goes. So imagine for a second that you have some uplinks and then you have a cluster. You have a bunch of different machines in the cluster and each one is a group. So you have a series of filters and in these groups, you essentially have like cell phones. They go through one group. The government, they go through another one. Commercial ISPs, they go through another one. Well, so what are those groups? They have a packet tier for a packet shaping. They use a Debian box, I believe maybe one Debian box for all of it. They might have it for everything or for each cluster and they use snort. So snort on an old Debian box. Sounds good. Any ingress and ingress filtering. So like if you try to connect in or out, you see like a black hole. You can actually make a map of the Syrian internet from inside and from outside and you can say, okay, here are the edges of the Syrian internet as far as the free world is concerned, which is just everybody outside of Syria. And we have this map and then it's like a black hole. It just like falls in. And then you don't really know a lot about it, but from the inside, you can start to discover the structures inside up to the edge of the black hole. So you can actually draw a picture and it looks like a moat around a castle. And there are a couple of ways to like cross the moat, but essentially you can't. And they have really, really nasty filtering. I mean, there are some things that you can do, but it's really, really sketch. There is not a unified block page. There is the fear of God. What they do is that when you go to certain websites, you get a visit from the secret police. No joking. They just come to your house and they seriously will mess you up. And there was one major ISP that was reported to have done man in the middle attacks against Facebook. Someone actually contacted me and gave me the factored RSA key, which I thought was really cool. So we had the cert and we had it. So like we were just like the attackers. I thought that was, that was pretty funny. So because they generated their Facebook certificate with like 512 bits. It's like, oh yeah. So you're not even signed by a CA and like you can recover. Weird. So also if you try to go to Israeli sites, like obviously there's some shit going on in the Middle East that's pretty serious. So they don't like each other. And if you try to go to those sites, you can block it. But that means if you were to write a Syrian module for, if you were to write a Syrian module for the tool that I'm about to talk about, you would know that you could run some tests to test whether or not Israel was blocked or whether or not Israel got a like police visit, you know, like if you're going to one of those sites. I was really sad to find out that actually there is a blue code device in this country. There's the IP address, 82137192.206. You're not going to be able to reach it from the outside, which is a little annoying. But it is a blue code filter without question. It has some administrative ports open when you're on the inside, inside Syria, you reposition and you look at it. That is I think pretty crazy stuff. It actually is able to fingerprint Tor by protocol and it blocks it. Even Tor bridges. And we've never seen this anywhere in the world before on a like country wide network. We've seen it at like a bank or something like that. We were working on fixing the Tor protocol to be significantly less fingerprintable. We try to look like Firefox, like HTTPS connections. Obviously we have some differences here. We have some people that were red teaming Tor with us and we know what the problem is. We think we need to deploy some fixes. We want to make general fixes though. It's not meant to fix Syria. It's meant to fix a little more, just everything. And we can of course see that five hops up from a place where I was repositioned. I'm pretty sure MIT is not 89 milliseconds away from Damascus. We can be pretty sure about that. Another interesting thing here is that we can be pretty sure that the network latency there is not exactly like other networks because as you see the third hop is 99 milliseconds and the fifth hop is 89 milliseconds. So you don't get the same amount of information there because you don't have a bunch of close together links that are not saturated. You have a bunch of who knows how far away, who knows how close links that are probably saturated. We don't know for sure. You'd have to run some more tests on them. Just from this you can just see though that it can't be shorter. It can't possibly be shorter for that fifth hop. Now Qatar has something kind of similar. We see this blocking page. What do we see? Well, Canadian Net Sweeper. Those guys. These guys are selling information and selling hardware to these people. Maybe that's okay. Maybe that's a world we want to live in. I don't know. But if you look at that URL, proxy1.isp.qa.port8080, we see that the URL is heavily fingerprintable. We also noticed that the user's IP, in this case it was like an IP address for me in a hotel, and the filter. So we can actually see filter rules and all this stuff. If their logging system is connected to these URLs, that means that we can change the values in the URLs and get somebody else to get a visit. Just change the IP address. Oh yeah, someone tried to visit this website from 1.2.3.4. There you go. They actually inject. So they take your TCP connection once it's open and they actually inject an HTTP 302 redirect. So you could write a Firefox plug-in, for example, that just ignored 302 redirects, or you could install NoScript or request policy or something like that and just ignore it. And it'll keep injecting, but you won't actually care. I mean, it will change the page, obviously. You can find the exact location of these devices because you know when you trigger it. And you can, of course, once you open the TCP connection, then you can change the TTL on the actual packet for sending the payload. So once you have an open connection, you can try to see what it is when you send the payload, where it is that you trigger it, and then you can find the logging. They also need to patch their networks. It's pretty lulz-y. I highly recommend you scan this up. Centered.qa, proxy1.isp.qa, 82, 148, 98, 52, 82, 148, 100, 101. They are interesting. You can find Canadian devices all over these networks. Seems interesting to me. You know, maybe that's the world we want to create, maybe not. I don't know. If you don't feel like that's the world you want to create, feel free to contact their executive team. There they are. So I wanted to make this relevant to Canada. And I think these people probably have children, and they probably sleep at night. And I don't know how they do that, right? Because they sell devices that are used to de facto harm people. And I think that is fucking bullshit. And we should use our skills to do stuff like this, I think. So these people, if you're a journalist in Canada here, like this guy in the front, maybe it would be good to talk about that. So okay. Iran is really interesting. There's a guy here in the audience who built a filter testing tool. He didn't want to own any boxes in Iran, and he didn't want to make friends with anybody in Iran. So he wrote an FTP bounce scanning tool. It's really fucking awesome. It works very well. You can use it to find the DPI devices that way, which I think is really cool. This will eventually be part of the toolkit that I'm working on. But it's going to be re-implemented probably. An interesting thing is that Nokia said, oh, it's okay that we're doing this. And the reason it's okay that we're doing this is because the West made us put in this wiretapping. Kalea forces us. So there's a legitimate trickle down effect here, which is that you have a legitimate authority in some countries, supposedly, let's say the United States. Let's pretend that's legitimate. And then that trickles down to these guys. And these guys are definitely not legitimate, in my view. And they do some pretty bad stuff. And Nokia sells them these devices and says, yeah, it's cool, whatever. We have to. So anyway, if you want to see the gear, 80, 191, 2DZ0 slash 24 is the Iran Telecommunications Research Center, or the ITRC. I'm not really a big fan of them, to be honest. This is a girl, Netta. She was walking with her father, not even going to a protest, shot in the heart by the besieged militia. So this is actually the byproduct of some of the things that Nokia is doing in Iran. And I think it's important to recognize that just because we like to dick around with bits and bytes, that actually there's a wider impact for it. That's why a lot of people get pretty good salaries to do this kind of stuff. But that's the result. So Nokia can say that, and she's still dead. Those people also deploy, like I said, filters that don't really work very well. In fact, the green anti-sec group, which is just hilarious, they released a local request proxy where you set it as your proxy, and it just takes to get requests and adds two spaces. And that was enough to get past it. But only the sensor, that obviously don't get past the wiretapping part. I mean, we don't know exactly how the proxy works. Supposedly someone got a leaked copy of all their manuals, but that person is full of shit and they never leaked the copy to the rest of the world, so maybe they were just fronting, seems like it. So what about the girl I mentioned that was shot? Well, these guys are the ones that shot her, webmail.besiege.ir. Those guys run squirrel mail. Maybe you would like to ask them via a squirrel mail exploit. And down here at the bottom you'll see some interesting hosts, sipproxy.itrc.ac.ir and smsmonitoring.itrc.ac.r. Like, what do you suppose those devices do? Well, you can probably guess that. And you can also fingerprint who the vendors are, and you can look at the vendors and you can call up their sales department and ask, like, hey, do you offer a support contract? I was just in Egypt and I went to some companies and said, hey, I have a small country that I'm helping do some consulting with, and I want to impress the citizens there. I was just wondering if you could sell me some devices to help me. The guy from Cisco who was there at this big event was like, yeah, just don't worry about that. So we've got, you know, our devices are deployed in all the major telecos in Egypt, and yeah, we're working on getting it into some other places, and yeah, we can absolutely do the kind of filtering you want. We can identify exact users. We will totally help you find those people. I was like, oh, that's great. Thanks. This is my documentary film crew, and I was just hoping maybe you could tell them your name. They were, like, less friendly to me after that, but they still gave me a price sheet. So Nokia Siemens here, disconnecting people. This was like a mashup from Andy Moller from the Kiosk Computer Club. Like, if none of you guys have been to the CCC, I really recommend you visit. There's a camp happening in August. It's like the greatest hacking event ever. It's like Burning Man without all the bad stuff, and like Recon but longer with gigabit fiber to your tent in, like, atomic bomb bunker bases with a rocket ship. Oh, and an airstrip where you can fly in World War II classic airplanes all day long. Attached to the wireless network. No kidding. Seriously, it's unbelievable. Burma is actually really fascinating. So imagine for a moment you have a country, and people are like, God, you guys are military dictatorship, like your military junta is really bad. Like, oh, everybody agrees. They're bad news, right? Everybody's really upset. They're upset that the Democratic leader that was elected, she actually can't serve. She's on house arrest and all this stuff. Okay, so it turns out like Fortinet was selling Fortiguard to the military junta. They denied it. They were like, no way. We're not doing that. Absolutely not. It's not happening. We don't do that. We believe in freedom. We believe in justice. We believe in democracy. And we would never break any kind of international treaty or sanction, whatever. Is there a sales dude handing routers over to the military junta? Yeah, full of shit. They were full of shit. So interesting to note that, right? So game change, they pulled out supposedly. What did we find instead? They've been replaced entirely with Cisco gear. Right? That's cool though, right? Bad news. But Cisco is very clearly aligning themselves and telling people what they care about. They care about profit over people, no matter what. So the giant thing happened with Fortiguard, their stuff is there. If you use Blockfinder to parse the allocated IP addresses, you can scan these networks really quickly. They have almost no hosts up. Almost all the hosts are routers, edge routers, and almost all of them are Cisco. And supposedly on the outset, they actually use blue code devices to filter and man in the middle. So they do SSL man in the middle attacks on a lot of things. And in fact, I've been told on almost everything. So you can see screenshots of Gmail, SSL, man in the middle. And Egypt is like a whole talk in itself. I was there before the revolution and I was there after the revolution and started a couple of weeks ago to help with the Bill of Rights and the Freedom of Information Act and stuff like that, just helping people that were working on that. No official involvement from any government on either side. I was on a panel with the head of Telecom Egypt data, Telecom Egypt, the Minister of Communication, Nokia, Vodafone, and all these other places. These are the people that sent the SMS that said, support the Mubarak regime. Don't go out into the streets in protest, right? They actually printed up flyers saying it was our technology that paved the way for the January 25th revolution. So on the panel, I asked them, hey, since you guys made the revolution possible, I was just curious, will you take a stand against censorship and wiretapping? And they all refused. They refused to say anything, refused to do anything. My documentary film crew friends, they were filming it. It was pretty good. It was especially good because they were talking about it in the framework of the past. And they actually said, we will do whatever the law says. And I asked them to clarify, and they said, we will do whatever the law says. And I said, so if the law said that you had to wiretape everybody and do every kind of censorship or blocking when there's a protest again, you'd do that. And he's like, we will do whatever the law says. So maybe the revolution isn't going as well as they would like, right? Old boss, new boss, what's the difference? We can actually see, Roger Dingledine, a very good friend of mine, works on tour. Obviously, he started the tour projects, like the greatest hacker, so amazing. He said I shouldn't put this graph in. He thought I should use a better graph because this implies no one's using tour after the revolution. This is actually more like a retro photo. Like pretend you could be there. This is the network version of being there. So you can actually see all of a sudden a bunch of people really cared about privacy and then they cut the internet off. So we can actually graph events by doing some kinds of observation. We can say, holy shit, something's getting hot in Egypt. And in fact, some people have done some mashups where they look at tour usage and they look at political news in different countries and you can actually see that as things start to get politically heated, these graphs start to go up. So I actually, I mentioned I was on this panel. Well, so if anything happened, I said, hey, you guys were censoring the internet. And they said, you don't know what you're talking about. We weren't censoring the internet. And I was like, oh, I have data that proves it. Do you want me to get it out? I said, well, I'm not saying you don't know what you're talking about. Like, well, OK, that's exactly what you said, you fucking idiot. But so it turns out what they were doing was they were filtering Twitter specifically. And I worked with the Twitter engineer. And what he said was, like, here's a list of IP addresses. Don't share this with anybody. Two of those IP addresses shared the same slash 24 as filtered Twitter hosts. And we found that they were blocked. They were blocked in multiple parts of the network, but generally they were actually blocked at the DSLAM. So you would do any tracer out of any kind, TCP, UDP, ICMP, whatever, and it was dropped. But host directly nearby were not. And when you would call them, they'd say, oh, we're having network trouble. Right. So this is the Chinese model where you pretend the network isn't working very well and you don't talk about it. And the Egyptian constitution is illegal to perform censorship. And therefore, the evidence that is presented here will probably at some point be used in a trial against these people, because I'm going to get the data over. I've already given some of the data over to some people that want to prosecute these guys so we can get them out of power. Because the few places where we do have to centralize control, we have to make sure that the people that are there don't abuse it. And when they abuse it, we hang them for it in a nonviolent sense. So Ireland is interesting. If you look at this, it actually says, there is an abundance of other websites that provide content without infringing the rights of copyright holders. IRCOM has signed a memorandum of understanding with the four major labels and is in discussions with them to develop an innovative new music service for IRCOM and non-IRCOM users. Right. That's for trying to go to the Pyro Bay. We can actually detect this with HTTP heuristics, and we see that the server header differences are different, of course. And we can detect the delta in the network graph. Saudi is the same. We see this. We see this URL. It looks pretty familiar. Well, what is it? We look at it. We see it six hops away. It turns out that if you do some research on Saudi, they actually brag about how they have a giant internet filtering cluster. Jordan, Squid, Turkey. This one I don't know. Someone just sent it to me. But I thought that would be kind of interesting because this is not similar to the Turkey block pages I've seen. Italy, this one, if you just go there, it's a block page. It's similar to the parking page that you've seen. You can actually use their DNS servers as censorship oracles. So you have a list of URLs. You just fire off a bunch of requests. If you get that IP address back, you know that you found a positive hit for the Oracle. North Korea is fascinating for a bunch of reasons. There's a list of countries I will never be able to visit in my life. And since this is one of them, they get their upstream from China, which has an incredibly filtered, like, really weird network. So you actually have to scan with a source port of 80 to bypass the Chinese filters to get to North Korea, to get to their filters to test them, which is like, it's like this hotel network, actually. There are so many filters on this network, I couldn't even, yeah, anyway. It's unbelievable how many filters there are. Cuba is really interesting. They go a different approach. They have, like, pretty serious class warfare. And so as a result, the local cafes, they have spyware that detects stuff. So before you, like, actually even get to send a packet onto the wire, they have dispatching software on there. The Porter Sun Frontier has talked about this. Freetown Christiania is, of course, the anarchist place in Copenhagen I mentioned, this micro nation. It doesn't have any filtering that I know of, but Denmark's the upstream. So you can probably look at all this and say, like, this is totally weak. This isn't going to work, whatever. But it's good enough, right? It's good enough that most people are not actually able to bypass it, and it stops, and changes the way that people perceive the world, right? You go to China, you ask them what they think about Tiananmen Square. They don't know that it was a government massacre. And why is that? It's because they have total control of people's minds, and total control of people's minds means that even if they think they are free, they're not actually free, because they don't know what happened. And that's exactly what's happening. So we can actually measure fascism as, like, an objective number based on filters, and we can build a metric. So given that, instead of talking about cyber war, let's talk about the Cyber Peace Building, because I'm a hippie from San Francisco. So, right, here's the idea. The Internet is an incredible tool which has never existed before, and instead of using it to, like, do cyber war, we can instead have a kind of digital human rights observation network where we observe the reality of these networks, and then we can have an objective measurement where we say, hey, it's almost like you guys have a de facto trade embargo, Twitter, Google, whatever, they don't work in your country. Why is that? And they say, oh, it's because, you know, network just doesn't work. And you can say, no, we ran these tests. You're blocking us. Here are the routers that are doing it. Fix them. Right? And we can have something, or we can have facts, right, where people are trying to keep it secret. We don't keep it secret anymore. We're going to blow that wide open. And unlike the OpenNet initiative, with all due respect, we're going to share that data. So it's not just a checkbox anymore. It's like a bunch of YAML data that anybody can download and contribute to, and anybody can run a central server for collecting, and anybody can run a probe, and we'll have a bunch of open tests. So that's the idea. We return to the taxonomy, and we see we've got state-of-the-art detection methodology. They're pretty weak. We've got some improvements on that methodology. We know how to trigger the filters. That means we can find them. That means we can also plug into Tor, and we can compare data, right? So we have the ability to get a control and an experiment and then compare them. We can compare latency. We can compare heuristics based on protocol. We can figure out where the different things are. And of course, we can scan up the filters and ask those companies, which are in the legal jurisdiction of different respective countries, about their support contracts. See because all of the capitalists that sell this equipment, they also create paper trails. And those paper trails are extremely useful for finding out what actually happened. And so when we have those paper trails and we have this evidence, we can actually try to bring a little bit more justice into the world, or we can decide that's the world we want to live in, and we'll decide that based on some facts instead of a bunch of scare tactics. So we apply it. We say we want a framework for tests. We want open methodology, and we want to have open data. You need to make sure you pre-scrub the data. If your IP address is in it and you submit it, people are going to know your IP. And then basically, we'll have implementation of both the server side and the client side, and it'll be open. So this is what I call the Uniprobe. And the Uniprobe is essentially, it's a Python program, which I wrote in the last couple of days. And basically, it does all the stuff I mentioned. So you distribute it, it logs data, it has a bunch of tests. So I believe that we can detect the clean feed of Canada, which is these men in the middle device for certain questionable URLs. However, it is incredibly difficult to find an upstream filter when you have like a bunch of consecutive filters in front of it. So I was able to find that the Hotel does captive portal stuff, obviously we know this. And I was able to find out that one hop up from the captive portal, we find a thing that hijacks DNS requests, and as a result from that, we couldn't actually find clean feed. It was a little bit frustrating because every time I would load all these different supersketch URLs in Hugo's hotel room, it wouldn't work, right, because it would get hijacked by the hotel. So I actually wasn't able to find any of the supersketch URLs. Like people are always saying like, oh, child porn, it's everywhere on the internet. Well, you know, maybe I'm just not good at searching the internet. But I found that I couldn't find any of it anywhere at all. And these CyberTip guys, they have a secret list that's encrypted and all this crap, but I couldn't find anything. And I wasn't downloading any images, but just trying to hit servers. And it's like you couldn't find anything that was legitimately like bad stuff. And I'm sure that it exists, but it was very difficult to find. But if it's so pervasive that we're going to install these super dangerous wiretaps, you would expect it to just be everywhere, right? And it's not. Anyway, no live demo of that as a result. I'll give a demo in a second and then I'll take questions. But basically the idea here is that we can look at an entire country and we can look at their freedom on the internet as an objective measurement. And we can say, OK, well, we've got one sample. But is that really like what the network is like? Is that what the country is like? We don't actually know the answer to that. So what we want is lots and lots of data. So when a political scientist writes a report and says it's not a free country on the internet, we can say, OK, maybe not. But we only have one data set. We only have one sample here. So what we want to have is a whole bunch of samples. So the people that do the technical collection, they just serve as an information and factual repository where anyone can contribute or run their own. And the political scientists don't have to pretend to be technical people anymore. They can just write their political science reports and they can be separate. And it's interesting because you could actually look at the filters and based on the information you gather, you can tell the general state of freedom in the country. The most incredibly oppressive regimes in the world have the most incredibly repressive internet filtering. That is like a fair statement to say. There's data that backs that up. And the point of this tool is to show that a little bit more. That does not mean, however, that the West or so-called liberal democracies are perfect or free because they're not. They just have different filtering. Obviously, in a lot of ways, they are objectively better and I enjoy living here better than I enjoy living in Lebanon. But at the same time, there's something to that. So another thing which I touched on a little bit is this idea to track social and political things. We can actually predict them. So looking at the usage, like I said, in Egypt and looking at things that are happening online, you could predict that there was something that was about to blow up there. If you look at the usage graphs for other countries that were involved in the so-called Arab Spring, you find the same thing. So just real quick, I'm just going to slide on over to this. So just real quick, this looks like a demo right here. So this is the UniProbe. So it's the open observatory of network interference. Because that's what we're looking at. We're looking at measuring that. And this is pretty lame, I admit, because at the moment, I decided I wanted to have two things that worked instead of 15 things that didn't really work very well. So we can look at the DNS probes. And we can say, OK, so there's all the different Microsoft Tor, RFC 26.06, OpenDNS, Google Chrome. So that's like known good, known bad, known null tests. And we know that none of those things are active on the network. And like I said, this is going to be freestyle for I'm going to put it on GitHub. And the idea is you just hook a test, and then you run it. And you have a simple API. True. Yep. False. Nope. Something went wrong. Or none. Test failed. And then you hook it. And you can write anything. So you can hook in scapey or whatever. And the idea is you'll be able to tell the difference between privilege and unprivileged tests. And then in the interim, you'll basically be able to capture data. It'll output in YAML. And then the YAML data can be correlated. And then we can start to do data analysis on the data that's collected. So that's the DNS. And this is the captive portal tester. So this one, emulates Apple, Microsoft, WC3's tests, Microsoft's DNS stuff in the Google Chrome. And it's decided that the network is clean. And that's because the network is clean for all of those tests. But I mentioned there are captive portals that exist there. And you can actually see them. And those captive portals do sort of like a different suite of injections. And so we have to implement those particular tests. If you just use TCP Traceroute, obviously you can find the hotel network. Like if you've got it open right now, TCPTraceroute to google.com. Second hop is not Google, really. So that's the idea. And the Uniprobe will be on GitHub pretty soon. And it will implement everything that I mentioned in the very near future. It already implements most of it. And it will be able to use it to collect data about all these countries. It will support proxy support. So you'll be able to proxy. Like you can use the local network as a control, the scientific control, or you can use the remote network. You'll be able to proxy it so you don't actually have to be in the country. And you'll be able to do these tests all the time and then sample it. And then you'll be able to share that information with the rest of the world. And then we'll be able to actually talk about what's actually happening there. So that was my incredibly long talk. And thanks to you guys for having me here.
 So, this is a work in progress.  So I don't want you to think that this is like finished.  I've been for the last couple of years, like I've had access to like a large number of  pretty interesting networks.  And often it's by just traveling to this place.  Like I like in some cases for months at a time like live out of a suitcase and just plug  into every network I can get my hands on, which is like a pretty fascinating experience  in itself.  So when I talk about filtering, I'm actually talking about network filtering in the context  of censorship.  So net neutrality sort of comes into play here in that, you know, net neutrality is part  of this bigger taxonomy.  So you can know, for example, that your traffic is being delayed or that you're being packet  shaped and that might actually be part of detecting where a filter is.  But I'm not really going to talk about the network neutrality stuff.  People from Georgia Tech and the UC Berkeley, they actually have some really fantastic monitoring  devices and actual like tests to do this.  And the Tor project is working with Georgia Tech as well as in the future I suspect we  might do some work with UC Berkeley.  Although I don't know about that for sure.  We just got some funding actually to do this type of research for the next couple of years.  So in theory, the goal of this project and the point of this talk is to show some very  like interesting things and some commonalities and to build the taxonomy and then to build  the tool and then to release the tool as free software and also to share all the data.  So one of the key things that I want to drive home here is this idea that censorship is  actually a second order effect.  So you have wiretapping and you have some kind of monitoring of some kind.  Maybe it's like a switch fabric where you can inject or something like that.  But censorship is actually the second order effect.  So it's not actually the most important part.  What we want to try to do is detect the actual wiretapping in different ways.  And there's all kinds of different ways to find wiretaps.  So there's like legal stuff.  There's technical means.  There's like information that people pass down.  Like I was just told today that Canada has the equivalent of the NSA wiretapping room  that's run by CSE.  So that's like a totally fascinating thing, which is very difficult to detect with technology,  but it's really easy to detect with like a person who leaks that information.  So we want to sort of correlate all this together, but we also want to build a technical  tool that will be a useful metric for measuring networks.  And so that's sort of the overall gist of it.  And to give sort of an idea here, I put a lot more information into these slides than  is necessary.  So you can like read them if you want.  Or you can skip them and I'll put them online.  I have like 72 slides or something like that.  But basically in this case, when we talk about censorship, we are usually talking about authoritarian  governments and they generally like to block information.  Like depending on which country you happen to be in or what network you're on, the authoritarian  scale is sort of, you know, you can think about it as like having two sides.  And on one side, you have like supposed free countries like Canada.  And then on the other side, you have places like North Korea or something like that.  And it is true that they're not the same.  And it's a, you know, there's a graduated scale there.  But at the end of the day, like almost every country in the world is on that scale.  There are very few countries that are not on the censorship scale.  So, you know, if you go a little further, you have places like Christianity, which is  a micro nation in Denmark.  They don't have internet censorship to the best of my knowledge, but their upstream is  Denmark.  So that means they have internet censorship because they buy transit from kind of a fascist  country, right?  So an interesting thing here is the threat model is best described by this Iranian police  chief whose name I'm not even going to try to pronounce.  And the thing that's really fascinating about this is how he sees the internet.  So first of all, these guys have like incredible, they have almost total internet surveillance  capabilities in Iran.  The exception being with satellite devices, though they do have access, my understanding  is they do have access to some equipment that allows them to monitor some of the satellite  downlink.  It's pretty easy to monitor satellite downlinks.  I also have heard some things that say that they actually can monitor some of the satellite  uplinks, which is like, you know, that's pretty good.  They're doing better than a kid at a Starbucks.  So, but what they actually say is fascinating.  And I'll read this quote, and I'll try not to read too many other things from the slides,  but these people should know where they are sending the SMS and email as these systems  are under control.  They should not think using proxies will prevent their identification.  If they continue, those who organize or issue appeals about opposition protests have committed  a crime worse than those who take to the streets.  So if you just like let that sink in for a second, there are people on the streets that  are protesting the government that are getting like shot without any due process, just like  summary executions.  And they're basically saying if you're using a proxy, you're actually like, you know, worse  than them.  That's pretty crazy, right?  And it's interesting because if you look at their proxy systems, you realize they have  like a lot of log data.  They collect a lot of information.  And in fact, what they do with that information is they go to people's houses, they kick down  their doors, and they kidnap them, and they arrest them.  They just like straight up stuff you see out of like a movie, like a Stozy movie or something  like that.  And that's exactly what's happening in Iran with a lot of people.  So it's incredibly important to be able to know the edges of these filters if we can,  because we want to be able to maybe send traffic between peers inside of a country, but we  don't want it to cross a boundary where there is perhaps some kind of monitoring taking  place.  But it's pretty scary when you think about this, because there are people that make some  snake oil crypto systems, and they just declare them to be secure.  Has anyone here heard of a thing called Haystack, for example?  Okay, so Haystack was this tool written by some guys that meant very well, I think.  And the tool we reversed it, myself and a couple other people here.  We reversed it, and we found that it was a tool that, assuming these logs were available  or that they were constantly logging, that basically they would be able to retroactively  find all of these users.  And the way that they presented the tool was by saying it's only for super secret, high  profile, extremely important people.  So when you combine those things together, you can really create a sense of danger that  I think is important to maybe avoid.  Like, it might be a better idea to not use snake oil crypto, but it's also probably a  good idea to not say anyone who does use your product is a spy.  That's pretty obvious.  You'd think that that would be obvious, but those people often have a financial incentive  to get funding, so they want to look super cool.  So they're like, hey, we help these people that are really important, give us a bunch  of money.  And then, of course, the US government, in that case, did in some way boost that project,  and boy did they look stupid when we owned up their product.  Oh, well.  The thing is that we owned it to show people that it was not safe.  It was important to do that.  So we used our skills in order to protect people, because those people who were using  the tool potentially were in some serious trouble.  So this is some of the context here.  This is very different than the United States or Canada or so-called liberal democracies.  And I think that it's hard to even comprehend that.  It's very difficult.  Unless you've been to a place like this, this kind of authoritarianism is something that  is hard to believe, especially if you're a Canadian, right?  Peace order, good governance.  You're just like totally cool.  You've got a monarchy.  Everything's great.  I don't know.  There's a reason the Americans shot the British.  But at the same time, I want to make it perfectly clear, which is that, so this is a billboard  liberation front.  Modification in San Francisco just happened to take place outside my office.  And I was really surprised by this.  I walked outside.  Boom.  There's the photo.  And this is the reality here, right?  The total surveillance the Iranians have is actually not that different than the total  surveillance we're pretty sure that the United States has.  And that's really bad news for Canada because you don't really have fiber that runs horizontally.  So if we pretend that the Earth is like Canada's here and America's here, you don't really  have fiber that runs that way, except through the internet two links.  So when you go to the Canadian Hockey Hall of Fame in Toronto, because I know everybody  here likes maple syrup, hockey, and moose.  But basically, if you go to the Canadian Hockey Hall of Fame website in Toronto, you actually  transit through Chicago.  So you want to go and look at hockey and you get surveilled by Chicago's wiretapping system.  Because the NSA definitely has wiretapping rooms in Chicago.  There's no question about it.  But there isn't exact proof.  Mark Klein revealed in San Francisco at Second and Folsom that there definitely were NSA  wiretapping rooms.  You produce pictures, network diagrams, and all that stuff.  So there's absolutely no question that they were doing warrantless wiretapping.  Everybody goes through AT&T or a similar provider.  So it's important to note that I'm not going to bash on the United States, but I'm not  also going to pretend that we're perfect.  We've got some serious shit here.  The US government said, we can do this.  The Constitution says you can't do this.  And the court ruled, yeah, well, so since everybody in the United States is harmed,  really nobody was harmed.  So that'll be fine.  We don't need to do anything about this.  And they dismissed the cases or they rule against them.  And that's very serious.  Because it's like saying, as long as we like harm everyone, it's totally cool that the  state totally dominates and breaks all the rules and everything.  And it's weird because it's a so-called conservative government.  It's like, what are they conserving if not the Constitution?  Obviously, they're on power.  So it's important to note that the NSA is everywhere.  They've got a lot of stuff.  And I think that they're really good.  I've met a lot of guys from the NSA.  And they're the best cryptographers that you'll ever find.  And they have really good hackers there as well.  Some of them leave Charlie Miller left and he's pretty good.  And there are people that are there that are maybe even better, especially the guys that  do the wiretapping.  They have optical taps that are very hard to detect.  You need someone like a Mark Klein.  So if any of you guys happen to work in data centers or happen to know about these types  of things, I really encourage you to tell the world about it.  Because there's no reason to keep this a secret.  It's important to show that and to have as part of a democratic society to have discussions  about this.  Because maybe this is the world we want to create.  We want to create a world where we have total surveillance all the time with everything  we do.  Great.  I didn't vote for that.  Just like Canada didn't vote for the monarchy.  And so the thing is that maybe that's not the world you want to create.  But maybe you do.  I don't know.  If you want to create that world, then I think we have to have a dialogue about it.  And we can't have a dialogue without facts.  So that's what this talk is about.  Creating facts all around the world.  There's this idea that you don't have anything to hide.  But there's this other idea, which is this concept called the captive mind.  And the idea of the captive mind is that when you know that you're being monitored all the  time, you know you're being watched, you actually do generally behave differently.  There are studies about this from the Stasi era where people talk about what it is when  you know that maybe your neighbor is a secret police officer.  And so to give an idea about how this is a fallacy that you have nothing to hide, if  you're wearing pants right now, you have this concept that maybe you want to cover yourself  up, or you want to have the autonomy to decide when you take your pants off.  This is privacy.  And this is part of having individual freedom.  You get to choose when those pants come off.  And hopefully they stay on for the whole talk.  But this is important.  Because the thing is, you might not have anything to hide, except that maybe you're going to  go and work at a job.  And maybe at that job, they want to have your genetic information.  Or maybe they want to know whether or not you have ever associated with me at a conference,  for example.  You might not have something to hide, but you might not want to reveal that, because  it could be damaging when your data trail tells a story about you that isn't necessarily  true.  And so this I think is really important to think about when you consider the total  surveillance state that exists.  They have incredible logs.  Full packet captures definitely exist for certain individuals.  And like for example, the NSA had an intern that looked at Bill Clinton's emails after  he was out of office.  Well, how did they have that?  Why did the NSA have that?  Because they were like dumping all this data.  So they had full packet captures for this.  And they have a database where you can query it and ask information.  It's like on the one hand, great, let's go get jobs as NSA interns.  And then on the other hand, that's pretty horrifying that even the former president of the United  States is not able to get away from this.  It's like really total.  And that's pretty scary stuff.  So part of the reason that I came to be interested in this is that I work on Tor, of course,  which I think probably, does anybody here not know what Tor is?  Raise your hand if you don't know what Tor is.  OK, one person.  Great.  Kresh Kursen Tor.  It's an anonymity network.  There you go.  So basically if you try to download Tor, it's a program you install on your computer.  A bunch of different countries actually, and not just countries, lots of corporations,  many corporations that take government funding, which is kind of weird.  We're a legitimate company.  So we're a nonprofit in the United States.  And people try to block this all the time.  And they're successful.  So you go to torproject.org and you get a block page.  In fact, in the last five years, every place I've worked has been blocked by every internet  sensor I've encountered.  So I'll go to my work webpage to try to do something.  And it's like, sorry, you can't do that.  It's weird that they let me into the country, but then they won't let me onto my own network.  So we decided that we're going to solve getting onto our overlay network by using another  overlay network, which is that we just wrote a, do you guys remember, like, where's email  bots where you would send wares via email?  So we did the same thing.  I wrote another thing in Python.  And you just send it.  And we'll deliver source code signatures, binaries.  You can get a whole Firefox and Tor and everything all preconfigured.  So you don't have to download anything and just drop it that way.  And so it's interesting because this shows a lot of people actually use this.  I think somewhere between 600,000 and 1,000 people a day actually download Tor via email,  which is crazy, right?  But the reason this is happening is because people are trying to find a way to get a signal  in or out of wherever they are.  And this is one of the ways.  There are tons of other ways.  Like, as I understand it, people also post binaries to Usenet.  And you can get it through IRC.  I used to run an IRC bot, and you can get it this way.  So their filtering might be total in some cases, but it's interesting because depending  on how you stack all the protocols together, you might end up in a situation where they've  decided that a thing is something other than it actually is.  So it's cool to have, like, a binary in an email.  Like, they can't solve that problem, so they just pumped on it.  Which means, of course, that in almost all places where you can download Tor via email,  we could make, like, a plug-in for Tor that used SMTP as, like, the, you know, communications  channel or something.  And in fact, we're working on a pluggable architecture to do exactly this.  So at some point, you'll have total, you'll have to have, like, full inspection of all  the packets in a meaningful way to be able to understand that.  And even then, like, there are tons of protocols which are necessary that nobody understands  really very well and they don't get filtered.  So unfortunately, the directory design, this is for, like, the one person that doesn't  know what Tor is, all the relays, they publish to directories.  So the directory authorities are trusted authorities.  There's eight of them in the world right now.  Some of them are in the U.S.  Some of them are in other countries.  And basically, the relays published to the directory authority, you get a big list of  all the Tor relays.  So this is a big problem.  On the 60th anniversary of some dude coming to power in China, they decided that, like,  they were done with having Tor in their country right before they went.  We had been expecting this to happen, but we didn't expect exactly how it would happen  to happen.  But essentially, they downloaded the list of all the Tor relays and then they just put  them in the firewall and they blocked it.  So this is really funny for two reasons.  The first reason is that means they, like, use us as a source for their filter, which  is great.  And then two, it's like, depending on how they vet that, there could be some, like,  really, like, quite strange situations here.  Like you could accidentally publish a bunch of Tor relay descriptors that are, like, all  the IP addresses and port numbers of web servers that serve up visa application websites,  for example, to leave the country.  And then they would maybe filter it.  So, I don't know, is that cyber war?  But I'm not sure.  But in any case, this happened.  And an unintended consequence of this is that all these Tor relays that you could no longer  reach from inside China, you couldn't, from the Tor relays, reach back into China either.  So like, if you would try to go to a particular website inside of China, it would actually  drop your packets.  So now, you not only can get yourself inserted into the filter list, you can get yourself  inserted into the filter list, and then you can test your filter from the other side.  And if you can get inside, you can do bi-directional tests.  And I'll talk a little bit about this.  So if one side is lying to you because it has, like, some pretty good packet inspection  stuff, it can only lie to you to the point in which the network reaches it.  So of course, it can lie for an entire side inside a country, like Syria.  Syria has very serious internet filtering, and I'll get to that.  But basically, once you get to Syria, there's like a series of hops to get there.  And that list is not going to be tampered with by Syria up to a point, right?  Interestingly enough, most of the countries in the world that have really oppressive internet  filtering, and not just in terms of economic oppression, but actually, like, sprayed up,  like, these packets are dropped into a black hole, they generally don't have BGP-looking  glasses.  So like, you know, if you want to look at a network, you know, you look at the looking  glass and you see what's going on there, you see what's routed there.  And it's actually, you know, like, it's difficult to find it.  You will not find a BGP-looking glass for Syria.  In fact, you won't find almost any TCP ports open in that country at all from the outside.  And from inside, if you can get it, if you can get a box, however you get a box, instead  of Syria, you can reposition.  And then from that, you can scan different networks all the way up.  But basically, everything is filtered, like, crazy, crazy filtering.  And I'll show some of these.  And so I talked about how the, you know, second order effect of wiretapping is censorship.  So a lot of people, what they do is they say, well, I'll use a VPN.  And then they use a VPN to go to a so-called free country.  But it's fascinating because if censorship is the second order effect, the first order  thing that is actually taking place is wiretapping.  So you've used a VPN.  You've hopped over to the censorship.  You feel like you're totally safe.  And what do you do?  You reveal all your packets to someone else.  Now, like, it's pretty clear to me with things like Lulsec that if they really had all the  data all the time, that they would be able to catch a lot more people, in theory, right?  But I think in practice, it's the John Gilmore quote, right?  If you're watching everybody, you're watching nobody.  So what happens is when they find a person they're interested in, they try to link all  that information back up.  And so it's possible you can do a thing that's unlinked from that.  But if they ever find a way to link that, the data is there.  And there are some cases, and there are some evidence in the news, and there are some legal  cases where this is pretty clearly the case.  We obviously don't have solid information because these guys aren't exactly talking about  their systems.  And in a so-called democratic country, it makes you wonder how that's happening.  And so using a VPN, great for getting past some kinds of censorship, except you're tagged  as using a VPN.  And depending on which country you're VPNing from or to, they might have an agreement between  each other for exporting data.  Like, if you VPN to Holland, well, they legalized and have an open discussion about all this  internet wiretapping and censorship, right?  And so there was an interview with the head of the Dutch police where he actually said,  yeah, I don't understand the Americans.  Like, you know, they're just doing all this stuff, and they're doing it in secret, and  it's causing a controversy.  Here, we just made it all legal, and so no one even talks about it, and no one cares.  And so there's something to be said, right?  And if Holland will excite their own citizens to the United States for anything at all,  they'll probably give up your data to the United States, too, or to another country.  And maybe that's the world we want to live in.  I don't know.  But maybe using a VPN isn't a good idea.  So I got to say, the filter detection tools that exist right now for people to detect  internet censorship are pretty weak.  If you've ever used a Windows device, it says, like, partial internet connection, full internet  connection, right?  The way that that works is pretty simple.  Windows uses what we'll call a known good test and another known good test.  And so it uses an HTTP request to go to a particular hostname, which is configurable.  It downloads a file.  It looks at the contents of the file.  They're not signed, right?  So there's like a kind of weird thing there.  I had an argument with someone about this, and they're like, oh, it's great that it's  not signed.  It's like, well, I guess, depends what you're doing with the data.  If you're trying to do a known good result and then you're going to behave differently  afterwards, you probably won't sign data.  They also do a DNS request.  If the, you know, a record for the DNS request results to what they think, then they say,  partial internet or not.  So they use DNS because sometimes networks allow for DNS packets to pass but not HTTP.  We all know this isn't very special.  But that's how Windows does it.  iOS does something similar to that.  Only it touches a little bit more data.  Android has something similar.  Google Chrome actually uses an inversion.  So Google Chrome looks and it tries to resolve five random names that are 10 bytes wide,  and it says these 10 byte records should never have an IP address if they do were being DNS  poisoned, right?  So you've detected open DNS or something like that.  So I implemented those, like I wrote a little emulator that implements those.  So if you've ever wondered like, hey, I've like gotten onto this network.  Does this network work?  You've got all these like, you know, patchwork tools.  Well, we have a framework now for detecting this.  And it's written in Python.  So you can just say like, oh, I have this Python code.  I want to actually like test this.  Okay.  So that's great, but it's not like particularly interesting.  There's another tool that the OpenNet initiative developed.  Has anybody here ever seen an OpenNet report where they talk about political, like the  political science context, and then they talk about, you know, moderate political filtering,  articles are filtered, you know, like science and religion articles are heavily filtered,  and they have like this box and they like fill in dots to tell you where it is.  Has anybody seen any of these reports?  The guy that works at the OpenNet initiative raises hand.  Okay.  Well, you are relevant.  So, I mean, seriously, oh, and I is amazing.  They have done some interesting stuff.  But my criticism of oh, and I is perhaps not important to anybody because it's inside baseball.  But for me, it's important that we have open methodology and open data so that we can actually  talk about things like in a factual way.  So when oh, and I produces a report and it has, you know, this moderate political content,  well, what does that mean when it's filtered that way?  Well, we don't know because their methodology isn't really open.  So our turtle is an interesting tool.  It's written in Python and it is essentially a tool that connects to the University of Toronto,  which runs a proxy with SSL.  It uses Python's SSL libraries, which means I don't believe, I'm not going to admit to  having looked at the code, but I don't believe that it verifies the SSL certificate.  And so there's two problems.  One, it's completely fingerprintable by its behavior, right?  It downloads a list of all the things that are suspect URLs and then it loads them over  a proxy, which is the University of Toronto's proxy, and then it loads them directly.  So you sequentially load a bunch of super questionable URLs and you do it while also  sequentially loading a bunch of super questionable URLs over a proxy, which connects back to  a known IP, like a slash 24, of the people that test the Internet.  This tool is only handed out to super special hands like the people.  I asked them for a copy.  They refused to give it to me for like three or four years.  Eventually I did get a copy.  I don't know if they ever knew that, but I looked at it and what I found was that this  is not a good methodology because, first of all, a filter can detect that you're an ONI  tester.  And so that's bad news because then they can skew the results.  And another thing is that because the tool is a special tool and not a generic tool and  not a generic framework, it might be the case that having a copy of that tool on your hard  drive is like, no bueno, right?  You don't want that.  You don't want to be the super special spy that has this special R-turtle tool, I think.  I think that could be very dangerous.  And in fact, there's some other issues with it.  For example, you can't stop on a resume test or at least you couldn't at one point.  So it's like you have to sit in the Internet cafe and wait for it to load every single  URL.  So maybe you're loading a bunch of political sites which happen to trigger a filter, which  depending on how serious their Internet filtering is, they might dispatch someone.  So that could be very bad.  So I think that's a bad idea because it also requires like a graphical user interface and  you basically need to be there.  I would prefer to have a probe you could deploy on a system, probably with the system owner's  consent because of what could happen to them.  I think this is probably like a pretty good thing to drive home.  So for example, if you happen to find a proxy in a country, that might be a useful way to  deploy this stuff.  Herdict is an example where they tried to fix a bunch of the R-turtle stuff.  And I think Herdict is a great idea, but it's very limited.  So what Herdict is, is it's like a Firefox plugin and it just tries to load URLs and  when it doesn't work, it kind of automates the process of submitting it to their website.  It's great except it does the same connect back stuff that R-turtle does.  So people know you're using this tool and I don't think that it's going to be able to  get a lot of information.  So you might know that a site is potentially blocked, but you really don't know a lot more  than that.  I suggested that they should bundle a copy of Tor and then they can use Tor as a control  channel to send data, but also to fetch data and then compare it.  And yeah, well, they didn't do it.  So the academic research by Georgia Tech and UC Berkeley is also totally awesome.  So UC Berkeley has a bunch of stuff they put up and they do like known good tests against  stuff.  It's incredible how easy to do this.  Basically almost no man in the middle protocol devices that I found in the wild with the exception  of blue code devices really are very smart.  Blue code is very, very smart.  And I've met some people from blue code and some of them are really impressive guys.  They just work towards really unimpressive things.  And so all of these things here, I had to either reverse engineer or I had to like, I  don't know, other stuff, but to understand the way that it worked.  Because the methodology and the tools and the data are basically closed.  Herdict is sort of the exception to that.  But what it does is basically the same thing as you go to a website, it's blocked, you  like let somebody know.  So it's not really that interesting.  It's good though because the data correlation on their website is awesome, right?  You can go and look at all the URLs that are blocked and when they're submitted you get  to see the data point analysis.  I think that's really useful.  Okay.  So each different country has different kinds of filtering, which is of course obvious,  but it's interesting because in the case of China, someone here said like, oh, I don't  want to go to that internet filtering talk.  It's just going to be China bad, Iran bad, USA good.  And that's not the case at all, right?  I hope that's clear.  But China is not, people like to talk about the Great Wall of China or in Iran, they call  it the potato wall.  And the basic issue here is that it's actually not one wall.  Like yes, the country has border routers.  There is a point where the fiber leaves the country.  There is the point where a satellite uplinks out of the country.  It is true that those routers do have some extra special stuff.  If you don't know this, is anybody here in the audience from Cisco?  Anybody?  Cisco employees?  I guess I'm not too surprised, but Cisco has a nice marketing department and they actually  had some slides that talked about how using their special products that they could help  custom design as part of this greater thing called the Golden Shield project, that they  could build the Great Firewall of China to help track down like, what did they call them?  Evil religious cults, the Falun Gong.  I'm not really a big fan of the Falun Gong.  They write some earpieces about me in their newspapers, which is totally awful.  But nonetheless, I think it's fucked up that Cisco is like, yeah, you want to hunt down  those people and really harm them?  Well, we'll sell you the products to do that.  And in fact, we'll help design them so they do it better.  They're being sued right now.  The lawsuit was just filed on the last month against Cisco by some Falun Gong people in  the United States.  So there's something to be said about doing that, because the end result of that is not  just that someone gets their internet taken away.  It's like they get executed potentially.  Definitely their life is destroyed.  So let's call China profit over people by Cisco.  It's a Cisco-powered network.  The USA has different tactics.  The DMCA is used for taking down stuff and centering stuff, but they also use ICE, the  Immigration Customs Enforcement people.  They've decided they want to go into the domain seizure business.  You've probably seen this.  So they claim legal authority.  It's pretty weak, in my opinion, because what they do is they just take a domain.  So first of all, if you host a domain in the United States, super sketchy, right?  Because one day someone can just pull your shit and you're done.  So that's bad news.  And the illegal tactics are the ones I talked about before with the NSA, AT, and Treason  people.  So basically, NARIS devices deployed across AT&T networks, and then they sniff them, right?  So I think this is a grand strategy towards a total internet surveillance plan, which  it's not clear to me how to prove that, but it seems pretty obvious that when you wire  tap the whole internet, you're not doing it just for the sake of wiretapping.  You have something beyond that you want to do.  And that's really scary stuff.  Even if you know you're politically neutral, which I don't know how you can do that on  a moving train, but if you're politically neutral on this, it should still be scary  that they aren't consulting you, especially if you're a citizen of this country, or if  you have bilateral treaty agreements and your traffic flows through this country.  Lebanon is really interesting to actually use free software.  I was like, oh, cool.  They use free software here in this country.  Oh, look at that.  Damn.  So Syria actually uses off-the-shelf commercial products.  And this is really fascinating because they're off-the-shelf commercial products are, well,  supposedly they have some embargoes, right?  Where the government and corporations aren't supposed to be able to buy some tools.  And I don't know if I agree with them, but it's fascinating to note that they are ineffective.  So each network is, of course, different.  So if this seems familiar, it's because if you do black box testing and reverse engineering,  like if you saw Sodorov's talk about XSS filtering, I think this is maybe a little weaker than  his talk.  I don't know.  But basically, it's a black box, right?  All these network devices are black box devices.  And you can model them.  And you can say, I know that the network is supposed to behave like X, Y, and Z, but it  actually behaves like ABC instead.  I know the latency is supposed to be Y, but actually it's the Z, right?  And so that's kind of a fascinating thing because it means you can build unit tests for  the internet, right?  You can say, how fucked up is my internet connection?  And then you can answer that question.  So we have a taxonomy, right?  So if you have the ability to do wiretapping, an active wiretapping where you can write  data back to the network, you can, of course, log data, right?  That's something that flows out of it.  So passive wiretapping, we're not even going to really talk about that.  Just assume that in almost every place, there is passive wiretapping because there's evidence  of in almost every place, there being passive wiretapping.  And in fact, in some cases, the network administrators want that.  And it just gets misused.  So once they, of course, can wiretapping, they can do injection, they can do interception,  they can drop packets, they can spoof packets.  So if you've ever seen Evil Grade, for example, there's a deep packet inspection company in  the United Kingdom where one of their guys went on to Reddit and talked about how, you  know, if you use lateral thinking, you can always take out the bad guys.  So he implied, he didn't say which company he was from, but it was obvious to figure  out which one he was from.  It sort of implied that they have tools, that they deploy on the network, and then when  they find a bad guy, like even if they're using Tor or SSL or something like that, they  have a way to get data into their computer or to inject code into their computer.  And it's fascinating if you think about it.  If you can man in the middle of the whole internet, does every computer that you've  ever seen stand up to that?  Probably not, right?  So this wiretapping goes a long way because you can basically understand that those people  that are running those devices, they're human beings with needs and families, right?  So that means that you can probably get them to do what you want if you're willing to go  pretty far.  And so having this ability to wiretap leads to a pretty serious situation where you can  do really nasty stuff to a lot of people.  And I think that's kind of a little bit scary.  So we've got this filtering taxonomy.  And here's some techniques that I've used.  So I'll sort of explain each one.  Like TTL, walking and probing, we can call that trace route.  It's a little bit more than trace route.  But basically, you can use a bunch of different protocols, and then you can expire things,  and you can measure things at each one.  So like, for example, you could take like an IP where you're in one position, you want  to go to another position, and you can walk all the routes in between, and you can look  at the latency.  Obviously, any hop along the way can lie to you, right?  If you've seen Moxie Marlin, Spike's, TCP, or his trace route spoofing tool, I don't  think it still works, but maybe it does.  Some people use a tool like that against the Scientologists many years ago, where when  the Scientologists did trace routes to the Operation Clam Bacon Network, they made it  spoof the trace route back to the Scientologists upstream.  So when the Scientologists would call to pull their uplink or to get mad at them, it was  their own ISP.  So like, oh my god, it's going from inside the network.  So basically that's a pretty useful thing.  Keyword injection is awesome.  So combining TTL walking and keyword injection, you can stick in the payload of a packet,  a keyword.  I'm going to go faster here.  But basically, the keyword injection here is pretty awesome because you can walk each  router and know when you hit a router, which one has triggered it.  If you make a request and you don't get the result you expect, basically you're getting  like tampered with.  And you can do a bunch of other stuff, but you can just literally detect tons of different  tampering in a bad way.  Now, HTTP request tampering is pretty awesome.  So you can say get space, e space, t, and filters will let that pass, even if the website  was blocked.  Testing known bad URLs.  Like last night, I downloaded extremely questionable URLs, and since my hotel room is on Hugo's  name, and I downloaded all these things, I didn't download any of the images, so tree  falls in the forest.  And Hugo gets the call from the police.  So you can download this bad list of URLs and check it against a control.  And never-clientancy is, of course, something also really awesome.  Let's say you don't know how many hops a thing is.  If you get a request in one millisecond, you can be pretty damn sure that it's not the  upstream host that's like 20 hops away.  They gave it to you.  And of course, every single application has different heuristic content length and this  header.  Like for example, the Pirate Bay is Blanc show this in a particular country, and you wouldn't  necessarily know it without downloading the content.  But just by looking at the HTTP headers themselves, you can pretty much instantly tell that you're  being man in the middle, and you can always find out that these proxies, well, people  that run the networks generally don't patch them, and the reason they don't patch them  is because they're not the kind of people that visit those bad sites.  Whoops.  So that creates some weird stuff.  So let's talk about keywords for a second.  Like gosh, how would you do that?  Well, you can use a language dictionary, right?  Or you can own up TomSkype.  So that's what I did.  And TomSkype is this awesome backdoor deployed against the Chinese people.  And I'm pretty sure that this is the case, but this web site, which has like hilarious  things on that URL too, e2.skype.tom.glesh installr.  And the way that this works is that someone says to the TomSkype, embarrass us.  This keyword is very serious.  So make sure that's filtered.  And so then they push that out, right?  So these sensors are like outsourced, right?  So it's really fascist.  And it's the marriage of the corporation and the state, really, right?  So they send, there's your keyword.  So for China, it's like this.  Every country has weird shit like this.  So you just have to find the weird shit you're interested in or every network.  Like in Canada, it's all about child porn, right?  So that is a little sketchy.  I admit that.  So you might not want to tread there unless you're in Hugo's room.  But this is a project I really wanted to share.  There's a guy named Andrew Clement from the University of Toronto who's totally amazing.  So he's this old guy.  If he's watching this, like lots of respect to you.  You're like an old Unix beard, you know?  And he built a tool that's IX Maps.  And basically you visit it and you say, I want to go to the Hockey Hall of Fame.  Tell me.  What happens?  And it shows you like a Google Smash app with all the possible NSA listening sites that  they've inferred that exist.  Because yeah, your packets, we pass through an NSA listening point.  I'm pretty sure actually to go to IXMaps.ca from some place you have to go through an  NSA wiretapping point, which is like hilarious, right?  So when they give you Google KML files, so it's not just like in theory.  It secures the address of the wiretapping point.  You go through Second Man San Francisco, therefore we know that that's the case.  So that's awesome.  It visualizes this and lets people know and lets people check this URL and say, oh, hey,  how about that?  So I see quick, but this is not very quick.  China, I mentioned the Baidu problem where they filter your IP.  Now you can't connect the sites in China.  Well, you just like everything about building this into Tor, actually.  Want to know if the Tor bridge has been discovered by the Chinese?  Well, then like load the Baidu web page.  And if we can't load it, it's because they have put us into their filter.  So we can do automatic.  So we can build an API basically of their filter.  Their DNS move is awesome.  Pick an IP address in China.  I've told Block Finder, which is this simple thing for parsing LAR and RAR allocation data  and GIP data.  And just say, like, give me all the IP addresses for China.  Pick one at random.  Pick an IP address.  It doesn't have to be up.  Craft with Scapey, DNS packet, a query, and then do CL walk all the way through.  And before you hit that IP address, as long as it's routed, you'll actually get a DNS  response when you cross their border routers that do DNS booping.  You have the right request.  So if you ask for a super secret Falun Gong, you know, church, then you get that, right?  So that's awesome because it means that you can also note a couple of things about it.  Like you can use them for DNS amplification attacks because you can, you know, make a bunch  of spoof requests and then they send a whole bunch more spoof responses.  So their censorship is actually, you can use it as an attack tool, which is hilarious.  Like, so you spoof from Iran and you spoof a bunch of stuff and then they start packeting  Iran or they spoof like a country that has a very small link and that really small uplink  can be flooded by the Chinese, which have like a much larger uplink and you, like, have  multiple layers of indirection.  And anyway, don't do that.  But just an interesting thing, which is that, like, when they're tampering on things on  the Internet, you know, you can have that.  Okay.  So the other thing is timing of TCP resets.  If you do a trace route and I see and P trace route from say California to, um, this and  Shenzhen, you're going to have, uh, you're going to have like a certain latency for ISM  P knowing the number of hops and knowing the latency allows you to guess a range and you  can visualize this and I don't do very good visualizations, but you can visualize this  as a sort of line and here's, you know, zero milliseconds and here's 20 milliseconds and  here's a hundred.  And you trace route with ICMP and you see that you're a hundred milliseconds from Shenzhen,  but you actually get a response, um, say a TCP reset at five seconds.  You could be pretty sure it didn't get all the way to Shenzhen twice as fast.  Right.  And so then you can say, well, I'm going to do a bunch of network exploration and I  can say, okay, well, I did a bunch of network exploration and I found these five hops that  I always pass through.  And so you can change the TTL again and you can see that when you've done, you do in  Shenzhen, you're acting this stuff back and forth and you can actually change the TTL  and so you never hit the host.  So you can actually probe systems in this country without ever sending packets to them  as long as you know the general dense.  So you can like, of course, just take a guess.  Once you cross the border, you're good.  So you just need a routable IP and now you have a metric that allows you to calibrate  all of your tests.  So you can say, I know that if I get a TCP in 30 milliseconds, I'm definitely getting  a reset from the outer, I'm going to drop that reset.  I don't care about it, but I'm going to note that I got it.  And so now you've like just like taken their millions of dollars worth of censorship and  you just thrown it in the trash.  Except that in some cases, some stuff doesn't get TCP reset, it just gets dropped on the  floor.  And when that happens, you can know that it's happening, but you can't really do a lot  about it.  You need to find a new path.  Denmark, for example, so here's the pirate bay in Denmark.  How does this work?  This word is filtering, right?  And taking over their entire country's DNS filter is hard as owning a bind.  So that's maybe not so great.  But anybody that goes to the pirate bay on that particular network, this one, full rate,  a bind that they have.  I didn't check again last night, but I'm pretty sure it was buying.  So they just like spoofed their response.  Okay, Bahrain is awesome.  I didn't know they were part of Anonymous, but if you notice, it's anonymous.com.bh.  So like I thought that was cool that they did that.  Like who knew that they were in support?  So they have a pretty familiar block page, like this aesthetic, this like English, Arabic,  mirror.  You'll see this a lot in the next coming pages.  I forget exactly how this is triggered.  The reason I had this in here is I met a guy that does network engineering for Bahrain,  and I taught him how to use Tor.  And he said, yeah, the office next to me is through the internet in Bahrain.  Check out our censorship block page.  So it's like he works on building the internet, and the guys, I'm a fuck it up.  And he was really, really, really not happy about that.  He thought it was like kind of a bummer.  It's like very self-defeating.  Like every day you go into work to make the internet better, and then the guys next to  you, their whole job is to make people think the internet is broken when they try to do  stuff.  He's like very unhappy about that.  So United States has an interesting thing, which is that anybody here of Amtrak, I guess,  you've probably heard of Amtrak.  So it's like a train system, but it doesn't really run on time.  That's how you know that America is not too far away from being a good place.  Our trains don't run on time.  So you'll notice that this is for Amtrak Cascades.  So what is this?  Well, it's a captive portal system, and it depends on the region.  When I was at Akaleta, I think how you say it, in DC, they used Barracuda internet filtering  devices, and on the WICOS, which I thought was more interesting, they had some Hodgepodge  free software crap basic portal where depending on you, you would actually like, you'd hit  Apache, or you'd hit Lighty, or you'd hit Squid.  And you could also make RPC calls against these boxes, which was kind of weird.  So you could, in theory, mount NFS and stuff like that.  So I think you might even be able to mount the NFS partitions where their filters, rules  are stored and then change them.  But I didn't do that.  I just looked at the fact that they had RPC open in general.  An interesting question here is a legal question, which is if Amtrak takes US government federal  money and they block access to a website, which is a legitimate company in the United  States, and it's not in the same state, is that interfering with interstate commerce?  I think it might be.  And I think it's interesting when they take federal government money to do that, because  that's something a little bit questionable.  So forward that on to a lawyer or something, I guess, if anybody cares.  Like I said, all the places I've worked, like Tours in non-profit in Massachusetts, and I  go to the tour website and it wasn't blocked, but I used to work at a small industrial film  company in California that specialized in online rehabilitation videos.  And those videos, of course, are blocked.  And the website is blocked and everything relating to it is blocked.  And it's a legit company.  So in Washington going to this, it's blocked.  I don't know.  That's a little questionable.  Anyway, you can detect it and it is a danger to everybody on the train, of course, because  like, you know, squid.  So the United States has a different tactic, which I mentioned before.  This is the domain seizure tactic.  All it is is they take NS records and they just point them somewhere else.  It's like no big deal.  So Lebanon is interesting.  Here we are trying to go to tour project and we see access denied.  So if you're noticing something about the block pages, you're probably noticing that  the content is regular.  And so in this case, content underscore filter denied, access denied, whatever, you can be  pretty sure that's squid.  So you know that Lebanon routes all their ATV traffic on this network through squid.  So Ogero, there are the IP addresses of their squid machines, 2.5 stable 11.  I don't know if that's actually very stable.  They were unpatched like at the time years ago.  I don't think they've upgraded them at all.  An interesting thing is if you try to scan them from the outside, you don't actually  get the same results.  But here's where it gets interesting.  We know it and we see that it says it's like four hops away.  So now we know the distance.  Prop ups.  Prop up.  There come any milliseconds away.  And if you look at that, it's like 169 milliseconds away.  Gosh, that could plant it.  Why is that number so high?  Well, the reason it's so high is everybody is going through these proxies.  That number, day.  It's so over them, like it doesn't have a lot of RAM in the machine, I would imagine.  I don't know for sure.  But that's like maybe not so great.  And if we look, we can compare.  So now we have a way to create a delta.  So port 443 is not hijacked.  It's not the same.  So that's great.  So we have the ability to calculate a delta between things that we are pretty sure about  and things we aren't sure about.  And you can use different networks to test this, but it's actually kind of difficult.  One thing that you can do if you're in a really heavily filtered network but a proxy  will work is that you can identify your IP address and do a trace route in return with  multiple protocols or from routeviews.org.  Really awesome that you can do trace routes from that.  So you would do like a trace route and you would go back and you can actually see the  actual latency from the host to the router.  And so you can take that off and you can know how much was actually added by everything  up in between.  And so you can say there was like 50 milliseconds of latency added by the first hop and 150  or 1200 milliseconds of latency added.  And so you can do some really basic math and you can say these fucking guys are totally  screwing up my internet connection on hop 4.  So worst ISP in the world, Interference of Names.  I mean if I was a Middle Eastern ISP I would not call myself Keranet.  Fucking horrible, right?  Like they want to be Earthlink, that's what they're trying to say, but like I, whoa.  You know just from a public perception standpoint I might not call myself that.  They shut you through 85, 112, 95.11.  That whole slash 24 is full of super sketch man in the middle stuff.  They do mask ICMP trace routes.  So they have an engineer there that does understand a little bit about TCPIP, which was surprising  to me.  I met a couple of guys that started these ISPs and they have really interesting ideas  about running networks like from patching to whatever.  Like I think there's some people in the audience here that have spent some time in Lebanon and  they know that like the computer systems in the Lebanon are like, well, you know, bad  news for them.  So you can see that it's the same thing.  So two hops here.  So we can easily know that that host is absolutely not two hops away.  And we can know by the latency that, you know, the proxy is probably a little overloaded  too.  Two hops away, 167.  I don't know.  That's so great.  Syria is interesting and I'm a little hesitant to talk about it because I don't want the Syrian  government to just fucking kill me basically.  They're super scary.  They're really scary.  They are like in this moment right now where we're all sitting comfortably in this place  and I'm standing slightly uncomfortably.  You know, the Syrian government is like shooting people in the streets that are protesting in  the major cities.  Like I have a friend who's like in a protest with his father yesterday and like saw like  something like five or something people get shot and killed.  So they are serious.  Like when they want to harm you, they do.  And now I think this is the first time anyone's ever talked about this.  So I'm going to, well, we'll see how this goes.  So imagine for a second that you have some uplinks and then you have a cluster.  You have a bunch of different machines in the cluster and each one is a group.  So you have a series of filters and in these groups, you essentially have like cell phones.  They go through one group.  The government, they go through another one.  Commercial ISPs, they go through another one.  Well, so what are those groups?  They have a packet tier for a packet shaping.  They use a Debian box, I believe maybe one Debian box for all of it.  They might have it for everything or for each cluster and they use snort.  So snort on an old Debian box.  Sounds good.  Any ingress and ingress filtering.  So like if you try to connect in or out, you see like a black hole.  You can actually make a map of the Syrian internet from inside and from outside and  you can say, okay, here are the edges of the Syrian internet as far as the free world is  concerned, which is just everybody outside of Syria.  And we have this map and then it's like a black hole.  It just like falls in.  And then you don't really know a lot about it, but from the inside, you can start to  discover the structures inside up to the edge of the black hole.  So you can actually draw a picture and it looks like a moat around a castle.  And there are a couple of ways to like cross the moat, but essentially you can't.  And they have really, really nasty filtering.  I mean, there are some things that you can do, but it's really, really sketch.  There is not a unified block page.  There is the fear of God.  What they do is that when you go to certain websites, you get a visit from the secret  police.  No joking.  They just come to your house and they seriously will mess you up.  And there was one major ISP that was reported to have done man in the middle attacks against  Facebook.  Someone actually contacted me and gave me the factored RSA key, which I thought was  really cool.  So we had the cert and we had it.  So like we were just like the attackers.  I thought that was, that was pretty funny.  So because they generated their Facebook certificate with like 512 bits.  It's like, oh yeah.  So you're not even signed by a CA and like you can recover.  Weird.  So also if you try to go to Israeli sites, like obviously there's some shit going on  in the Middle East that's pretty serious.  So they don't like each other.  And if you try to go to those sites, you can block it.  But that means if you were to write a Syrian module for, if you were to write a Syrian  module for the tool that I'm about to talk about, you would know that you could run  some tests to test whether or not Israel was blocked or whether or not Israel got a like  police visit, you know, like if you're going to one of those sites.  I was really sad to find out that actually there is a blue code device in this country.  There's the IP address, 82137192.206.  You're not going to be able to reach it from the outside, which is a little annoying.  But it is a blue code filter without question.  It has some administrative ports open when you're on the inside, inside Syria, you reposition  and you look at it.  That is I think pretty crazy stuff.  It actually is able to fingerprint Tor by protocol and it blocks it.  Even Tor bridges.  And we've never seen this anywhere in the world before on a like country wide network.  We've seen it at like a bank or something like that.  We were working on fixing the Tor protocol to be significantly less fingerprintable.  We try to look like Firefox, like HTTPS connections.  Obviously we have some differences here.  We have some people that were red teaming Tor with us and we know what the problem is.  We think we need to deploy some fixes.  We want to make general fixes though.  It's not meant to fix Syria.  It's meant to fix a little more, just everything.  And we can of course see that five hops up from a place where I was repositioned.  I'm pretty sure MIT is not 89 milliseconds away from Damascus.  We can be pretty sure about that.  Another interesting thing here is that we can be pretty sure that the network latency  there is not exactly like other networks because as you see the third hop is 99 milliseconds  and the fifth hop is 89 milliseconds.  So you don't get the same amount of information there because you don't have a bunch of close  together links that are not saturated.  You have a bunch of who knows how far away, who knows how close links that are probably  saturated.  We don't know for sure.  You'd have to run some more tests on them.  Just from this you can just see though that it can't be shorter.  It can't possibly be shorter for that fifth hop.  Now Qatar has something kind of similar.  We see this blocking page.  What do we see?  Well, Canadian Net Sweeper.  Those guys.  These guys are selling information and selling hardware to these people.  Maybe that's okay.  Maybe that's a world we want to live in.  I don't know.  But if you look at that URL, proxy1.isp.qa.port8080, we see that the URL is heavily fingerprintable.  We also noticed that the user's IP, in this case it was like an IP address for me in a  hotel, and the filter.  So we can actually see filter rules and all this stuff.  If their logging system is connected to these URLs, that means that we can change the values  in the URLs and get somebody else to get a visit.  Just change the IP address.  Oh yeah, someone tried to visit this website from 1.2.3.4.  There you go.  They actually inject.  So they take your TCP connection once it's open and they actually inject an HTTP 302  redirect.  So you could write a Firefox plug-in, for example, that just ignored 302 redirects, or  you could install NoScript or request policy or something like that and just ignore it.  And it'll keep injecting, but you won't actually care.  I mean, it will change the page, obviously.  You can find the exact location of these devices because you know when you trigger it.  And you can, of course, once you open the TCP connection, then you can change the TTL  on the actual packet for sending the payload.  So once you have an open connection, you can try to see what it is when you send the payload,  where it is that you trigger it, and then you can find the logging.  They also need to patch their networks.  It's pretty lulz-y.  I highly recommend you scan this up.  Centered.qa, proxy1.isp.qa, 82, 148, 98, 52, 82, 148, 100, 101.  They are interesting.  You can find Canadian devices all over these networks.  Seems interesting to me.  You know, maybe that's the world we want to create, maybe not.  I don't know.  If you don't feel like that's the world you want to create, feel free to contact their  executive team.  There they are.  So I wanted to make this relevant to Canada.  And I think these people probably have children, and they probably sleep at night.  And I don't know how they do that, right?  Because they sell devices that are used to de facto harm people.  And I think that is fucking bullshit.  And we should use our skills to do stuff like this, I think.  So these people, if you're a journalist in Canada here, like this guy in the front, maybe  it would be good to talk about that.  So okay.  Iran is really interesting.  There's a guy here in the audience who built a filter testing tool.  He didn't want to own any boxes in Iran, and he didn't want to make friends with anybody  in Iran.  So he wrote an FTP bounce scanning tool.  It's really fucking awesome.  It works very well.  You can use it to find the DPI devices that way, which I think is really cool.  This will eventually be part of the toolkit that I'm working on.  But it's going to be re-implemented probably.  An interesting thing is that Nokia said, oh, it's okay that we're doing this.  And the reason it's okay that we're doing this is because the West made us put in this  wiretapping.  Kalea forces us.  So there's a legitimate trickle down effect here, which is that you have a legitimate  authority in some countries, supposedly, let's say the United States.  Let's pretend that's legitimate.  And then that trickles down to these guys.  And these guys are definitely not legitimate, in my view.  And they do some pretty bad stuff.  And Nokia sells them these devices and says, yeah, it's cool, whatever.  We have to.  So anyway, if you want to see the gear, 80, 191, 2DZ0 slash 24 is the Iran Telecommunications  Research Center, or the ITRC.  I'm not really a big fan of them, to be honest.  This is a girl, Netta.  She was walking with her father, not even going to a protest, shot in the heart by the  besieged militia.  So this is actually the byproduct of some of the things that Nokia is doing in Iran.  And I think it's important to recognize that just because we like to dick around with bits  and bytes, that actually there's a wider impact for it.  That's why a lot of people get pretty good salaries to do this kind of stuff.  But that's the result.  So Nokia can say that, and she's still dead.  Those people also deploy, like I said, filters that don't really work very well.  In fact, the green anti-sec group, which is just hilarious, they released a local request  proxy where you set it as your proxy, and it just takes to get requests and adds two  spaces.  And that was enough to get past it.  But only the sensor, that obviously don't get past the wiretapping part.  I mean, we don't know exactly how the proxy works.  Supposedly someone got a leaked copy of all their manuals, but that person is full of  shit and they never leaked the copy to the rest of the world, so maybe they were just  fronting, seems like it.  So what about the girl I mentioned that was shot?  Well, these guys are the ones that shot her, webmail.besiege.ir.  Those guys run squirrel mail.  Maybe you would like to ask them via a squirrel mail exploit.  And down here at the bottom you'll see some interesting hosts, sipproxy.itrc.ac.ir and  smsmonitoring.itrc.ac.r.  Like, what do you suppose those devices do?  Well, you can probably guess that.  And you can also fingerprint who the vendors are, and you can look at the vendors and you  can call up their sales department and ask, like, hey, do you offer a support contract?  I was just in Egypt and I went to some companies and said, hey, I have a small country that  I'm helping do some consulting with, and I want to impress the citizens there.  I was just wondering if you could sell me some devices to help me.  The guy from Cisco who was there at this big event was like, yeah, just don't worry about  that.  So we've got, you know, our devices are deployed in all the major telecos in Egypt, and yeah,  we're working on getting it into some other places, and yeah, we can absolutely do the  kind of filtering you want.  We can identify exact users.  We will totally help you find those people.  I was like, oh, that's great.  Thanks.  This is my documentary film crew, and I was just hoping maybe you could tell them your  name.  They were, like, less friendly to me after that, but they still gave me a price sheet.  So Nokia Siemens here, disconnecting people.  This was like a mashup from Andy Moller from the Kiosk Computer Club.  Like, if none of you guys have been to the CCC, I really recommend you visit.  There's a camp happening in August.  It's like the greatest hacking event ever.  It's like Burning Man without all the bad stuff, and like Recon but longer with gigabit  fiber to your tent in, like, atomic bomb bunker bases with a rocket ship.  Oh, and an airstrip where you can fly in World War II classic airplanes all day long.  Attached to the wireless network.  No kidding.  Seriously, it's unbelievable.  Burma is actually really fascinating.  So imagine for a moment you have a country, and people are like, God, you guys are military  dictatorship, like your military junta is really bad.  Like, oh, everybody agrees.  They're bad news, right?  Everybody's really upset.  They're upset that the Democratic leader that was elected, she actually can't serve.  She's on house arrest and all this stuff.  Okay, so it turns out like Fortinet was selling Fortiguard to the military junta.  They denied it.  They were like, no way.  We're not doing that.  Absolutely not.  It's not happening.  We don't do that.  We believe in freedom.  We believe in justice.  We believe in democracy.  And we would never break any kind of international treaty or sanction, whatever.  Is there a sales dude handing routers over to the military junta?  Yeah, full of shit.  They were full of shit.  So interesting to note that, right?  So game change, they pulled out supposedly.  What did we find instead?  They've been replaced entirely with Cisco gear.  Right?  That's cool though, right?  Bad news.  But Cisco is very clearly aligning themselves and telling people what they care about.  They care about profit over people, no matter what.  So the giant thing happened with Fortiguard, their stuff is there.  If you use Blockfinder to parse the allocated IP addresses, you can scan these networks  really quickly.  They have almost no hosts up.  Almost all the hosts are routers, edge routers, and almost all of them are Cisco.  And supposedly on the outset, they actually use blue code devices to filter and man in  the middle.  So they do SSL man in the middle attacks on a lot of things.  And in fact, I've been told on almost everything.  So you can see screenshots of Gmail, SSL, man in the middle.  And Egypt is like a whole talk in itself.  I was there before the revolution and I was there after the revolution and started a couple  of weeks ago to help with the Bill of Rights and the Freedom of Information Act and stuff  like that, just helping people that were working on that.  No official involvement from any government on either side.  I was on a panel with the head of Telecom Egypt data, Telecom Egypt, the Minister of  Communication, Nokia, Vodafone, and all these other places.  These are the people that sent the SMS that said, support the Mubarak regime.  Don't go out into the streets in protest, right?  They actually printed up flyers saying it was our technology that paved the way for the  January 25th revolution.  So on the panel, I asked them, hey, since you guys made the revolution possible, I was  just curious, will you take a stand against censorship and wiretapping?  And they all refused.  They refused to say anything, refused to do anything.  My documentary film crew friends, they were filming it.  It was pretty good.  It was especially good because they were talking about it in the framework of the past.  And they actually said, we will do whatever the law says.  And I asked them to clarify, and they said, we will do whatever the law says.  And I said, so if the law said that you had to wiretape everybody and do every kind of  censorship or blocking when there's a protest again, you'd do that.  And he's like, we will do whatever the law says.  So maybe the revolution isn't going as well as they would like, right?  Old boss, new boss, what's the difference?  We can actually see, Roger Dingledine, a very good friend of mine, works on tour.  Obviously, he started the tour projects, like the greatest hacker, so amazing.  He said I shouldn't put this graph in.  He thought I should use a better graph because this implies no one's using tour after the  revolution.  This is actually more like a retro photo.  Like pretend you could be there.  This is the network version of being there.  So you can actually see all of a sudden a bunch of people really cared about privacy  and then they cut the internet off.  So we can actually graph events by doing some kinds of observation.  We can say, holy shit, something's getting hot in Egypt.  And in fact, some people have done some mashups where they look at tour usage and they look  at political news in different countries and you can actually see that as things start  to get politically heated, these graphs start to go up.  So I actually, I mentioned I was on this panel.  Well, so if anything happened, I said, hey, you guys were censoring the internet.  And they said, you don't know what you're talking about.  We weren't censoring the internet.  And I was like, oh, I have data that proves it.  Do you want me to get it out?  I said, well, I'm not saying you don't know what you're talking about.  Like, well, OK, that's exactly what you said, you fucking idiot.  But so it turns out what they were doing was they were filtering Twitter specifically.  And I worked with the Twitter engineer.  And what he said was, like, here's a list of IP addresses.  Don't share this with anybody.  Two of those IP addresses shared the same slash 24 as filtered Twitter hosts.  And we found that they were blocked.  They were blocked in multiple parts of the network, but generally they were actually  blocked at the DSLAM.  So you would do any tracer out of any kind, TCP, UDP, ICMP, whatever, and it was dropped.  But host directly nearby were not.  And when you would call them, they'd say, oh, we're having network trouble.  Right.  So this is the Chinese model where you pretend the network isn't working very well and you  don't talk about it.  And the Egyptian constitution is illegal to perform censorship.  And therefore, the evidence that is presented here will probably at some point be used in  a trial against these people, because I'm going to get the data over.  I've already given some of the data over to some people that want to prosecute these  guys so we can get them out of power.  Because the few places where we do have to centralize control, we have to make sure that  the people that are there don't abuse it.  And when they abuse it, we hang them for it in a nonviolent sense.  So Ireland is interesting.  If you look at this, it actually says, there is an abundance of other websites that provide  content without infringing the rights of copyright holders.  IRCOM has signed a memorandum of understanding with the four major labels and is in discussions  with them to develop an innovative new music service for IRCOM and non-IRCOM users.  Right.  That's for trying to go to the Pyro Bay.  We can actually detect this with HTTP heuristics, and we see that the server header differences  are different, of course.  And we can detect the delta in the network graph.  Saudi is the same.  We see this.  We see this URL.  It looks pretty familiar.  Well, what is it?  We look at it.  We see it six hops away.  It turns out that if you do some research on Saudi, they actually brag about how they  have a giant internet filtering cluster.  Jordan, Squid, Turkey.  This one I don't know.  Someone just sent it to me.  But I thought that would be kind of interesting because this is not similar to the Turkey  block pages I've seen.  Italy, this one, if you just go there, it's a block page.  It's similar to the parking page that you've seen.  You can actually use their DNS servers as censorship oracles.  So you have a list of URLs.  You just fire off a bunch of requests.  If you get that IP address back, you know that you found a positive hit for the Oracle.  North Korea is fascinating for a bunch of reasons.  There's a list of countries I will never be able to visit in my life.  And since this is one of them, they get their upstream from China, which has an incredibly  filtered, like, really weird network.  So you actually have to scan with a source port of 80 to bypass the Chinese filters to  get to North Korea, to get to their filters to test them, which is like, it's like this  hotel network, actually.  There are so many filters on this network, I couldn't even, yeah, anyway.  It's unbelievable how many filters there are.  Cuba is really interesting.  They go a different approach.  They have, like, pretty serious class warfare.  And so as a result, the local cafes, they have spyware that detects stuff.  So before you, like, actually even get to send a packet onto the wire, they have dispatching  software on there.  The Porter Sun Frontier has talked about this.  Freetown Christiania is, of course, the anarchist place in Copenhagen I mentioned, this micro  nation.  It doesn't have any filtering that I know of, but Denmark's the upstream.  So you can probably look at all this and say, like, this is totally weak.  This isn't going to work, whatever.  But it's good enough, right?  It's good enough that most people are not actually able to bypass it, and it stops,  and changes the way that people perceive the world, right?  You go to China, you ask them what they think about Tiananmen Square.  They don't know that it was a government massacre.  And why is that?  It's because they have total control of people's minds, and total control of people's minds  means that even if they think they are free, they're not actually free, because they don't  know what happened.  And that's exactly what's happening.  So we can actually measure fascism as, like, an objective number based on filters, and  we can build a metric.  So given that, instead of talking about cyber war, let's talk about the Cyber Peace Building,  because I'm a hippie from San Francisco.  So, right, here's the idea.  The Internet is an incredible tool which has never existed before, and instead of using  it to, like, do cyber war, we can instead have a kind of digital human rights observation  network where we observe the reality of these networks, and then we can have an objective  measurement where we say, hey, it's almost like you guys have a de facto trade embargo,  Twitter, Google, whatever, they don't work in your country.  Why is that?  And they say, oh, it's because, you know, network just doesn't work.  And you can say, no, we ran these tests.  You're blocking us.  Here are the routers that are doing it.  Fix them.  Right?  And we can have something, or we can have facts, right, where people are trying to keep it  secret.  We don't keep it secret anymore.  We're going to blow that wide open.  And unlike the OpenNet initiative, with all due respect, we're going to share that data.  So it's not just a checkbox anymore.  It's like a bunch of YAML data that anybody can download and contribute to, and anybody  can run a central server for collecting, and anybody can run a probe, and we'll have a  bunch of open tests.  So that's the idea.  We return to the taxonomy, and we see we've got state-of-the-art detection methodology.  They're pretty weak.  We've got some improvements on that methodology.  We know how to trigger the filters.  That means we can find them.  That means we can also plug into Tor, and we can compare data, right?  So we have the ability to get a control and an experiment and then compare them.  We can compare latency.  We can compare heuristics based on protocol.  We can figure out where the different things are.  And of course, we can scan up the filters and ask those companies, which are in the legal  jurisdiction of different respective countries, about their support contracts.  See because all of the capitalists that sell this equipment, they also create paper trails.  And those paper trails are extremely useful for finding out what actually happened.  And so when we have those paper trails and we have this evidence, we can actually try  to bring a little bit more justice into the world, or we can decide that's the world we  want to live in, and we'll decide that based on some facts instead of a bunch of scare  tactics.  So we apply it.  We say we want a framework for tests.  We want open methodology, and we want to have open data.  You need to make sure you pre-scrub the data.  If your IP address is in it and you submit it, people are going to know your IP.  And then basically, we'll have implementation of both the server side and the client side,  and it'll be open.  So this is what I call the Uniprobe.  And the Uniprobe is essentially, it's a Python program, which I wrote in the last couple  of days.  And basically, it does all the stuff I mentioned.  So you distribute it, it logs data, it has a bunch of tests.  So I believe that we can detect the clean feed of Canada, which is these men in the  middle device for certain questionable URLs.  However, it is incredibly difficult to find an upstream filter when you have like a bunch  of consecutive filters in front of it.  So I was able to find that the Hotel does captive portal stuff, obviously we know this.  And I was able to find out that one hop up from the captive portal, we find a thing that  hijacks DNS requests, and as a result from that, we couldn't actually find clean feed.  It was a little bit frustrating because every time I would load all these different supersketch  URLs in Hugo's hotel room, it wouldn't work, right, because it would get hijacked by the  hotel.  So I actually wasn't able to find any of the supersketch URLs.  Like people are always saying like, oh, child porn, it's everywhere on the internet.  Well, you know, maybe I'm just not good at searching the internet.  But I found that I couldn't find any of it anywhere at all.  And these CyberTip guys, they have a secret list that's encrypted and all this crap, but  I couldn't find anything.  And I wasn't downloading any images, but just trying to hit servers.  And it's like you couldn't find anything that was legitimately like bad stuff.  And I'm sure that it exists, but it was very difficult to find.  But if it's so pervasive that we're going to install these super dangerous wiretaps,  you would expect it to just be everywhere, right?  And it's not.  Anyway, no live demo of that as a result.  I'll give a demo in a second and then I'll take questions.  But basically the idea here is that we can look at an entire country and we can look  at their freedom on the internet as an objective measurement.  And we can say, OK, well, we've got one sample.  But is that really like what the network is like?  Is that what the country is like?  We don't actually know the answer to that.  So what we want is lots and lots of data.  So when a political scientist writes a report and says it's not a free country on the internet,  we can say, OK, maybe not.  But we only have one data set.  We only have one sample here.  So what we want to have is a whole bunch of samples.  So the people that do the technical collection, they just serve as an information and factual  repository where anyone can contribute or run their own.  And the political scientists don't have to pretend to be technical people anymore.  They can just write their political science reports and they can be separate.  And it's interesting because you could actually look at the filters and based on the information  you gather, you can tell the general state of freedom in the country.  The most incredibly oppressive regimes in the world have the most incredibly repressive  internet filtering.  That is like a fair statement to say.  There's data that backs that up.  And the point of this tool is to show that a little bit more.  That does not mean, however, that the West or so-called liberal democracies are perfect  or free because they're not.  They just have different filtering.  Obviously, in a lot of ways, they are objectively better and I enjoy living here better than  I enjoy living in Lebanon.  But at the same time, there's something to that.  So another thing which I touched on a little bit is this idea to track social and political  things.  We can actually predict them.  So looking at the usage, like I said, in Egypt and looking at things that are happening  online, you could predict that there was something that was about to blow up there.  If you look at the usage graphs for other countries that were involved in the so-called  Arab Spring, you find the same thing.  So just real quick, I'm just going to slide on over to this.  So just real quick, this looks like a demo right here.  So this is the UniProbe.  So it's the open observatory of network interference.  Because that's what we're looking at.  We're looking at measuring that.  And this is pretty lame, I admit, because at the moment, I decided I wanted to have two  things that worked instead of 15 things that didn't really work very well.  So we can look at the DNS probes.  And we can say, OK, so there's all the different Microsoft Tor, RFC 26.06, OpenDNS, Google  Chrome.  So that's like known good, known bad, known null tests.  And we know that none of those things are active on the network.  And like I said, this is going to be freestyle for I'm going to put it on GitHub.  And the idea is you just hook a test, and then you run it.  And you have a simple API.  True.  Yep.  False.  Nope.  Something went wrong.  Or none.  Test failed.  And then you hook it.  And you can write anything.  So you can hook in scapey or whatever.  And the idea is you'll be able to tell the difference between privilege and unprivileged  tests.  And then in the interim, you'll basically be able to capture data.  It'll output in YAML.  And then the YAML data can be correlated.  And then we can start to do data analysis on the data that's collected.  So that's the DNS.  And this is the captive portal tester.  So this one, emulates Apple, Microsoft, WC3's tests, Microsoft's DNS stuff in the Google  Chrome.  And it's decided that the network is clean.  And that's because the network is clean for all of those tests.  But I mentioned there are captive portals that exist there.  And you can actually see them.  And those captive portals do sort of like a different suite of injections.  And so we have to implement those particular tests.  If you just use TCP Traceroute, obviously you can find the hotel network.  Like if you've got it open right now, TCPTraceroute to google.com.  Second hop is not Google, really.  So that's the idea.  And the Uniprobe will be on GitHub pretty soon.  And it will implement everything that I mentioned in the very near future.  It already implements most of it.  And it will be able to use it to collect data about all these countries.  It will support proxy support.  So you'll be able to proxy.  Like you can use the local network as a control, the scientific control, or you can use the  remote network.  You'll be able to proxy it so you don't actually have to be in the country.  And you'll be able to do these tests all the time and then sample it.  And then you'll be able to share that information with the rest of the world.  And then we'll be able to actually talk about what's actually happening there.  So that was my incredibly long talk.  And thanks to you guys for having me here.
Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_0_83.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_84_203.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_204_251.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_252_311.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_312_419.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_420_467.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_468_515.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_516_2663.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_2664_2819.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_2820_3707.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_3708_3935.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_3936_4583.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_4584_5843.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_5844_6059.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_6060_6623.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_6624_7043.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_7044_7175.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_7176_7331.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_7332_7379.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_7380_7799.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_7800_8627.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_8628_9119.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_9120_10187.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_10188_10259.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_10260_10487.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_10488_11483.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_11484_11747.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_11748_11939.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_11940_12755.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_12756_12863.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_12864_16331.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_16332_19103.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_19104_21227.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_21228_22787.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_22788_23315.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_23316_27119.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_27120_30347.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_30348_40451.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_40452_45839.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_45840_46739.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_46740_49151.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_49152_52715.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_52716_53363.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_53364_54815.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_54816_56003.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_56004_56087.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_56088_56207.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_56208_61355.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_61356_61931.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_61932_63203.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_63204_63671.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_63672_64715.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_64716_66239.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_66240_66527.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_66528_66863.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_66864_67175.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_67176_67391.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_67392_68171.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_68172_69611.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_69612_70547.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_70548_71459.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_71460_75899.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_75900_77387.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_77388_78599.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_78600_80951.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_80952_81083.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_81084_81215.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_81216_81383.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_81384_81467.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_81468_81527.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_81528_82355.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_82356_83999.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_84000_84731.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_84732_85583.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_85584_87323.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_87324_88415.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_88416_89267.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_89268_89555.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_89556_90719.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_90720_92831.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_92832_93599.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_93600_95519.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_95520_96095.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_96096_96287.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_96288_96335.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_96336_96611.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_96612_96827.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_96828_96995.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_96996_97247.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_97248_98627.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_98628_99611.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_99612_101135.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_101136_102455.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_102456_102887.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_102888_103283.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_103284_105191.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_105192_108239.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_108240_111767.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_111768_111815.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_111816_111863.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_111864_111959.png Recon_2011_Internet_Filtering_by_Jacob_Appelbaum_July_10__2011_7TEYr8acmn0_111960_111976.png