Invited Paper: Network Measurement Methods for Locating and Examining Censorship Devices
slides-biasws-network-measurement-methods-for-locating-and-examining-censorship-devices-00

Invites talk of published paper:
https://ensa.fi/papers/censorship_devices_network_measurement.pdf

Advances in networking and firewall technology have led to the emergence of
network censorship devices that can perform large- scale, highly-performant
content blocking. While such devices have proliferated, techniques to locate,
identify, and understand them are still limited, require cumbersome manual
effort, and are developed on a case-by-case basis.

In this paper, we build robust, general-purpose methods to un- derstand various
aspects of censorship devices, and study devices deployed in 4 countries
(Azerbaijan, Belarus, Kazakhstan, and Rus- sia). We develop a censorship
traceroute method, CenTrace, that automatically identifies the network location
of censorship devices. We use banner grabs to identify vendors from potential
censorship devices. To collect more features about the devices themselves, we
build a censorship fuzzer, CenFuzz, that uses various HTTP request and TLS
Client Hello fuzzing strategies to examine the rules and triggers of censorship
devices. Finally, we use features collected us- ing these methods to cluster
censorship devices and explore device characteristics across deployments.

Using CenTrace measurements, we find that censorship devices are often deployed
in ISPs upstream to clients, sometimes even in other countries. Using data from
banner grabs and injected block- pages, we identify 23 commercial censorship
device deployments in Azerbaijan, Belarus, Kazakhstan, and Russia. We observe
that certain CenFuzz strategies such as using a different HTTP method succeed
in evading a large portion of these censorship devices, and observe that
devices manufactured by the same vendors have similar evasion behavior using
clustering. The methods developed in this paper apply consistently and rapidly
across a wide range of censorship devices and enable continued understanding
and monitoring of censorship devices around the world.