Understanding the Practices of Global Censorship through Accurate, End-to-End Measurements

Abstract

It is challenging to conduct a large scale Internet censorship measurement, as it involves triggering censors through artificial requests and identifying abnormalities from corresponding responses. Due to the lack of ground truth on the expected responses from legitimate services, previous studies typically require a heavy, unscalable manual inspection to identify false positives while still leaving false negatives undetected. In this paper, we propose Disguiser, a novel framework that enables end-to-end measurement to accurately detect the censorship activities and reveal the censor deployment without manual efforts. The core of Disguiser is a control server that replies with a static payload to provide the ground truth of server responses. As such, we send requests from various types of vantage points across the world to our control server, and the censorship activities can be recognized if a vantage point receives a different response. In particular, we design and conduct a cache test to pre-exclude the vantage points that could be interfered by cache proxies along the network path. Then we perform application traceroute towards our control server to explore censors' behaviors and their deployment. With Disguiser, we conduct 58 million measurements from vantage points in 177 countries. We observe 292 thousand censorship activities that block DNS, HTTP, or HTTPS requests inside 122 countries, achieving a 10^-6 false positive rate and zero false negative rate. Furthermore, Disguiser reveals the censor deployment in 13 countries.

In-Depth Evaluation of the Impact of National-Level DNS Filtering on DNS Resolvers over Space and Time

“…However, many methods cause DNS facilities to respond to incorrect results. For example, as studied in this paper, DNS filtering, also known as DNS redirection or poisoning, causes the DNS resolvers to return incorrect domain records (e.g., IP addresses) to the clients [1][2][3][4][5]. This method may be used for malicious purposes such as phishing, for security and business purposes by a company [6,7] (providing parental control or antivirus filtering services), for advertising purposes of Internet service providers (ISPs), or for the governments to block access to specific domains [8][9][10].…”

“…Many previous studies [8,9,27] focused on discovering the location of DNS filtering devices in cyberspace and collecting the set of keywords that trigger filtering. Jin et al [3,28] proposed a novel framework that enables end-to-end measurement to detect censorship activities accurately (e.g., DNS filtering) and revealed the censor deployment without manual efforts. To discover DNS tampering, their control server will reply to the requests with a static and reserved IP address that has never been used in manipulated DNS responses by any censors in different countries.…”