Philipp Winter

2016 has been marked by major shifts in political policy towards the Internet in Turkey and Thailand, a renegotiation of the responsibilities of content platforms in the west, and a continued struggle for control over the Internet around the world. Turbulent times, indeed. In this session, we'll survey what's changed in Internet surveillance and censorship in the last year, and provide context for the major changes affecting the net today.

The good news is the community ability to monitor and act as a watchdog on policy changes is continuing to develop. The Open Observatory effort has set its sights on monitoring country policy, the US Department of State has called for proposals in the area infusing additional money, and groups like Access Now and Great Fire are working on regular measurement of services and access technologies. As we move from an Internet regulated by DPI and technical controls to one dominated by mobile applications and legal regulations on companies, our ability to argue for policy change from an accurate factual basis is critical for advocacy and our continued right to expression. This session will arm you with an updated set of facts for your discussions in the coming year.

Other people: Will Scott

Several years ago, the Great Firewall of China was silently upgraded to find and block circumvention servers that employ encryption to defeat deep packet inspection. The system is now used to block protocols such as Tor, SoftEther, and SSH. In this talk, we will give an overview of how this system works, and how it can be circumvented.

The GFW's reactive probing system scans egress network traffic for circumvention protocol signatures, and then launches short-lived probes to verify if the suspected server is, in fact, speaking the circumvention protocol. If that is the case, the GFW adds the IP address and port of the server to a country-wide blacklist, preventing people in China from connecting to it. We recently finished a multi-month research project in which we looked at the system from different angles to answer several open questions. In particular, we will talk about:

• How the reactive probing system makes use of thousands of unique IP addresses to launch its probes.
• We discuss our hypotheses on the physical design of the reactive probing system. Our evidence shows that all these IP addresses are either hijacked, or that the GFW operates a large, geographically distributed network of proxies.
• We show patterns in the IP, TCP, and TLS headers that suggest that the thousands of reactive probing IP addresses we harvested are controlled by few centralized systems.
• How the system seems to flush its blacklist regularly, providing a short window for circumvention.
• The effectiveness of the system, i.e., how good is it at blocking servers and how well does it scale?
• How the GFW seems to treat science and education networks different from consumer networks.
• Ways to troll the Great Firewall of China.