Тёмный

DEF CON 30 - Roger Dingledine - How Russia is trying to block Tor 

DEFCONConference
Подписаться 297 тыс.
Просмотров 66 тыс.
50% 1

In December 2021, some ISPs in Russia started blocking Tor's website,
along with protocol-level (DPI) and network-level (IP address) blocking to
try to make it harder for people in Russia to reach the Tor network. Some
months later, we're now at a steady-state where they are trying to find
new IP addresses to block and we're rotating IP addresses to keep up.
In this talk I'll walk through what steps the Russian censors have taken,
and how we reverse engineered their attempts and changed our strategies
and our software. Then we'll discuss where the arms race goes from here,
what new techniques the anti-censorship world needs if we're going to
stay ahead of future attacks, and what it means for the world that more
and more countries are turning to network-level blocking as the solution
to their political problems.

Опубликовано:

 

26 сен 2024

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 102   
@Sam_Bent
@Sam_Bent 5 месяцев назад
This was a great talk, that's my bald head at the bottom left of the podium.
@DommageCollateral
@DommageCollateral 2 месяца назад
haha
@macktheripper7454
@macktheripper7454 Год назад
Roger is an absolute hero. Love hearing him talk.
@eyadkourdi2325
@eyadkourdi2325 6 месяцев назад
I love how he talked at the start about Syria blocking TLS, a Syrian previous media activist, used TOR all through 2011 and 2012, got arrested by the Syrian regime intelligence and all what they accused me of is "having suspicious internet activities" but then I got released, I do remember emailing the TOR project for a specific question (I wanted a port forwarding recommendation for live streams using my android phone to stream a protest) and they were very very helpful and literally kept talking to me not just about this question, but also giving my tips specifically for my case use of TOR, can't that you enough guys! and please consider to run a node if u can it helps ppl (and don't use bridges if u don't need to please!)
@csvscs
@csvscs Год назад
Legendary and thankless work!
@terragame5836
@terragame5836 Год назад
41:22 - "I think Russia has already blocked Facebook, but next it's gonna be, like, Linkedin" - nope, it's blocked already, in fact. Had been even earlier than Facebook, if I recall correctly
@peppigue
@peppigue 11 месяцев назад
nooooooooooooooooooooooooooooooooooooooooooo
@nNiceDreamsMadeTrue
@nNiceDreamsMadeTrue Год назад
I never heard of snowflake, installed the extension right away!
@angusmacgyver
@angusmacgyver Год назад
I had heard about it but I installed it now too.
@uis246
@uis246 Год назад
Do you remember that Futurama episode where Hermes contested document based on wrong number of stamps? Basically that's what happened in Russia.
@Shackleford_Rusty
@Shackleford_Rusty Год назад
Amazing talk
@billyblackburn864
@billyblackburn864 Год назад
i tried to start reading through the tor docs, boy is it thorough, I dont know if I'll ever be able to fully grasp it
@petersuvara
@petersuvara Год назад
Awesome vid! Thanks for the talk guys!
@abstractapproach634
@abstractapproach634 Год назад
Thank for your work while we waited for i2p
@Time4Technology
@Time4Technology Год назад
Great talk, thank you.
@goldnutter412
@goldnutter412 Год назад
30:25 uncertainty is certain We might be about to get occupied, max uncertainty in the people with something to lose ? some subset of people in the moment need to do something. Move some Bitcoin out of the country ? send a message about relocation ? not willing to hang around. Clear to everyone shit is not going to be good. Whatever it was, significant change of some sort was the only priority for this subset of people and their circumstances. Relatively small group, other countries would have drastically different stats.. some would see sustained and perhaps S curve adoption, civil war possibilities etc etc Fascinating, amazing presentation
@uncertaintytoworldpeace3650
U called?
@uis246
@uis246 Год назад
...And that sometimes hard to take, But it will become much clearer With every new choice you make.
@Waitwhat469
@Waitwhat469 Год назад
mTLS should be considered for the bridges, then maybe you can give out keys instead of just addresses, if a good key isn't provided, just ignore it and give a different webpage.
@zephyr1181
@zephyr1181 11 месяцев назад
If the bridges are typically volunteers and not real websites, a state actor would just block the IP and not care what the key is, right?
@austinmurphy9074
@austinmurphy9074 11 месяцев назад
Maybe TOR use spiked in Ukraine during the Russian invasion because Russian military uses TOR in some of their application/devices?
@petergerdes1094
@petergerdes1094 Год назад
Hmm, would it be possible to replace the Bitcoin proof of work with some kind of proof of transport so that mining becomes the provision of Tor relays?
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
You might want to have a look at the Helium network - but on the Internet instead of wireless. One problem, though: just because some node transported your proof of transport doesn't mean it will also transport your actual traffic.
@petergerdes1094
@petergerdes1094 Год назад
@@thewhitefalcon8539 Right, but if you encrypt the traffic and the proof so that the node doing the transport can't tell the difference. Designing it right to have all the right incentives would be hard but u could probably get at least a probabilistic guarantee they'd transport traffic.
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
@@petergerdes1094 Good idea.
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
@@petergerdes1094 You know, if you have the time you could actually make this.
@goldnutter412
@goldnutter412 Год назад
@@petergerdes1094 hmm i like where this is going, in a sense.. but.. hm..
@kevincameron192
@kevincameron192 Год назад
This dude has the exact cadence of Jeff Goldblum 👌
@Matthias53787
@Matthias53787 Год назад
What is the SALMON / LOX stuff he mentioned about decentralized trust / reputation? I can't find anything about it online.
@marioh5172
@marioh5172 11 месяцев назад
arma ftw, great presentation
@noahway13
@noahway13 Год назад
Here in Merica, people are proud of the 2nd. The right to bear arms. The fight of a few rednecks in pickups vs US military, anyone can see that outcome. What is MOST important is the ability to communicate freely and evade censorship is VITAL. Especially in totalitarian nations where the people have no way to fight back other than numbers. If the Chinese people could ever get on the same page, they could topple the government just from mass numbers. A government can't kill or imprison 75% of the population.
@bryant2627
@bryant2627 Год назад
"few rednecks in pickups vs US military, anyone can see that outcome". Yeah I think usa and Russia thought the same about Afghanistan...went great for the two largest superpowers vs a bunch of "goat herders".
@Greatscottrules-p9v
@Greatscottrules-p9v Год назад
@@bryant2627they had mountains to hide in. It’s a totally different gorilla war fare in them mountains. The afghans also were born into defense due to the Russians trying to invade and the cia gave them old Cold War stockpile anti air missle sand old aks delta force or green beret probably taught them basic combat concepts and outcomes. That or cia. The afghans are the best at walking threw them mountains. Special forces said they are like goats there so strong from walking mountains all there life they say in the hub where they work up mission plan that if a afghan gets his legs around you your dead you won’t be able to get him off.
@haudiweg
@haudiweg Год назад
Does snowflake works for ipv6 only? Ipv4 cg-nat
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
If WebRTC works on your connection then Snowflake works. ISPs want WebRTC to work, because that's like, Discord voice chat.
@N99622
@N99622 Год назад
Commenting for the algorithm
@ivanslaboratory
@ivanslaboratory Год назад
Raising hands upon questioned who runs relays.... Ehmmm.... 🤣🤣🤣
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
Relays are public information.
@ivanslaboratory
@ivanslaboratory Год назад
@@thewhitefalcon8539 even IP public addresses are but you still try to hide it :)
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
@@ivanslaboratory The IP addresses of all Tor relays and the real-life owners of most are public info. That's how you know you're not getting an evil relay
@ivanslaboratory
@ivanslaboratory Год назад
@@thewhitefalcon8539The identity being published does not mean is legitimate, could be name borrowers. Same as your public IP address could be someone's elses. :) To my knowledge exit nodes are public info, so that can be blocked in case :)
@carnivorebear6582
@carnivorebear6582 Год назад
Sad we don't get to hear Jacob Applebaum talk on Tor a
@RomanDvoryadkin
@RomanDvoryadkin 10 месяцев назад
One of the reason of huge spike in Tor connections from Ukraine during first weeks of the russian invasion, that many hacktivists uses Tor for DDoS of the russian propaganda sites, financial and logistic infrastructure. But usage of Tor turned out to be ineffective, so different measures were taken later.
@JGnLAU8OAWF6
@JGnLAU8OAWF6 10 месяцев назад
Using Tor for DDoS is such a big brain move.
@RomanDvoryadkin
@RomanDvoryadkin 10 месяцев назад
@@JGnLAU8OAWF6 I know. But some russian banks was unhappy even on this traffic.
@347573
@347573 Год назад
Russian hackers are the ones that are using the most sofisticated and more reliable access to TOR. Even the ones working for the government. All the accesses should be easy, since the average people (the one that give or need information) is surely not able to go further than downloading and launching the TOR browser (and already this is not so average). If not those "bad" ones are the only people that will benefit...
@tobysonline4356
@tobysonline4356 Год назад
Russia has plenty of out of country proxy’s to access tor from. The damage caused be helping the Russian people see all the facts of the war is worth the effort
@coldobina
@coldobina Год назад
@@tobysonline4356 You forgot to put "facts" in quotes.
@rogo7330
@rogo7330 Год назад
No. Tor not used only by "bad ones". FSB and other f*ckfaces are most likely have their own VPS in Europe, legally bought by the way; yes, you still can buy VPS with Russia's bank account, and maybe Im already gone insane, but I think "normal" russians can get problems with police if they look into your account and find that you bying proxy for yourselves, and god forbid you use it to do something that "descriminates army of Russia". Tor is just too slow in general and often connections are just dying, but it's nice to have, especially when you don't want to install random "VPN" crap on your computer and have accounts for it.
@TheBinaryHappiness
@TheBinaryHappiness 11 месяцев назад
@@tobysonline4356 poor us Russians w/o access to BBC LMAO westoids are so delusional
@NoNameAtAll2
@NoNameAtAll2 Год назад
30:24 mind that Ukraine also has been doing censorship of major websites from 2016 or so in an unstable situation reaching for sources of information from both sides might have been important for many
@johngiaus8632
@johngiaus8632 Год назад
Why would I want to hear from both sides of that conflict?
@NoNameAtAll2
@NoNameAtAll2 Год назад
@@johngiaus8632 ...because not doing that is the exact definition of information bubble and you need to educate yourself on that?
@Tuxfanturnip
@Tuxfanturnip Год назад
​@@johngiaus8632 The Ukrainian government could lie or censor news to paint themselves in a more positive light or preserve military secrecy, while Russian media reported on which city your friends live in just got hit with a missile strike. You need to be able to piece together the truth for yourself from multiple sources
@peppigue
@peppigue 11 месяцев назад
several reasons ukrainians or other people in ukraine could want safe comms with people in russia. the biggest group are family connections, second group is businesses and organizations operating in both countries. pro-russia operators in ua are probably not numerous enough to contribute much to such stats.
@monkemode8128
@monkemode8128 7 месяцев назад
"Please consider this as the DEF CON audience that you are" lol
@olommentes
@olommentes Год назад
i would say that rt and similar outlets are at least equal to social engineering. If all people would be informed about the background, mo and goals of these disinformation campaigns, they would treat them as such. But this level of knowledge is just not there, they are currently incredibly harmful and no democracy has tools or strategies at place to fight them. Banning is a brute force approach yes, but it is necessary to act on this someway.
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
Absolutely right.
@fus132
@fus132 Год назад
Ok, and _Who_ defines the disinformation exactly?
@awesomesauce804
@awesomesauce804 5 месяцев назад
​@@fus132the integrity initiative.
@sharpenedge
@sharpenedge Год назад
32:06 nostr pubkeys? 🤔
@goldnutter412
@goldnutter412 Год назад
AEweb thoughts ? building on this web3 platform with Uniris biometrics and hierarchical transaction chains structure seems.. unbounded ? "the first ever tamperproof identification that doesn't store any data" is the main selling point but integrating the various technologies of today in the way they have is potentially the end game for defenders ? Imagine all content on the internet has a meta tag of human or not..
@goddessofkratos
@goddessofkratos Год назад
I want those docs, I don't tor or telegram, give me safe access and let us process our way 😊 #aibot
@josiahsharkey7520
@josiahsharkey7520 Год назад
Tor still has centralization it uses centralized dns servers for all dns you can proxy dns over tor but it still requires trust of centralized dns servers onion services also use centralized matching servers they do allow you to encrypt the metadata on the central server but it is encryption that the NSA can break with there quantum computer and it requires setting up a key pair for each user also Russia isn't the only one censoring tor my ISP allows tor without bridges as a client but my ssh service that I run over tor for ddns was blocked until I used bridges so even in the US they do DPI to block hosting services over tor but they allow client access to anything over tor so bridges in iat mode 2 prevents them from knowing the difference between client and server tor connections and everything works
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
not correct
@josiahsharkey7520
@josiahsharkey7520 Год назад
Yes it is tor uses distributed centralized matching servers and if you proxy dns through tor it normally goes to cloudflare you can send clearnet dns to cloudflares onion service but that still requires trusting distributed centralized matching servers that can be poisoned by the NSA using there quantum computer to steal private keys then redirecting all traffic to a fake version of the site that sends malware to all users that's why I put ssh behind wireguard psk behind udp tunnel behind tor for ddns so they won't be able to poison my service because they won't know the psk and all pre quantum encryption should be considered broken because the NSA has a quantum computer and my ISP does DPI to block only hosting onion services so everything I said is true
@GeoNeilUK
@GeoNeilUK Год назад
The Russian Tor censorship sounds a lot like Soviet radio jamming. I wonder if most of the censorship office are women? It was mostly women working on jamming Western radio.
@josiahsharkey7520
@josiahsharkey7520 Год назад
Having any restrictions on bridges is a huge problem if you don't allow users to add there exclude nodes list because I already have to retry getting bridges for a couple hours using tor to randomize my IP to get a few bridges that aren't in fascist countries like the US and EU that censor the internet so they are more likely to block hosting onion services like my ISP does it is not as bad as Chinese or Russian bridges but they are unacceptable for anyone that cares about privacy and security not just anonymity for client side access
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
It doesn't matter whether your bridge is in a fascist country (like the one you are in). Your bridge doesn't know what sites you are accessing. I know you live in a fascist country because you wouldn't need a bridge otherwise.
@josiahsharkey7520
@josiahsharkey7520 Год назад
Yes it does matter because they can block only hosting onion services by doing DPI on the output from the bridge and it is terrible security to use a bridge in the US, EU, 14 eyes, or any other country that does any internet censorship because your bridge and exit node are more likely to cooperate and de-anonymize you and your bridge is more likely to be compromised by the NSA so I exclude all of them and my tor service refuses to connect to any bridge hosted in those countries so you are wrong also bridges are necessary for anyone that cares about privacy not just people that can't connect to tor because bridges obfuscate tor use just like tor over vpn but it is harder for the US government to get search warrants for them because at least in US law node operators aren't responsible for any tor traffic so they have no reason to help the government unless they are a fascist because the government can't threaten to arrest them because there are already laws protecting them from that because it was invented by the US government and they wanted other people to help hide their traffic
@thewhitefalcon8539
@thewhitefalcon8539 Год назад
@@josiahsharkey7520 The output from a bridge is still encrypted 3 times. You might be confusing bridges and exit relays. The output from an exit relay is still encrypted 1 time unless you don't use HTTPS which you should always use with Tor.
@josiahsharkey7520
@josiahsharkey7520 Год назад
@@thewhitefalcon8539 that's not true it isn't encrypted well enough to hide the difference between client and server even on the first hop my ISP blocks only onion services so DPI can tell the difference even with 5 layers of encryption on the data using ssh, wireguard, and tor and do you really think the NSA can't get a certificate trusted by a root CA in your browser to man in the middle the output of the exit node so https isn't real security against nation state attackers and if the bridge and exit node cooperate you lose all anonymity unless you use post quantum security and there are enough people like me that run post quantum security over tor on the same circuit and using https on an onion service loses all anonymity unless you require adding a hybrid post quantum root CA to every users computer and run your own CA I don't need this level of security, privacy, and anonymity because I am only using it for remote access to my computers I don't have active nation state attackers but other people do and if I use this level of security it helps protects them from being traced because they can't rule me out as their target as easily
@wagyourtai1
@wagyourtai1 Год назад
bridgecoin
@MikeTrieu
@MikeTrieu Год назад
"Translate to english" 😂
@cedricvillani8502
@cedricvillani8502 Год назад
Cohorting and timing just like google, lol thanks but no for me.
@JamieVegas
@JamieVegas 11 месяцев назад
The number of people who use Tor for the purposes claimed is tiny. It's just hammering the banking system and killing ecommerce... and a few other more serious things.
@woozyyt5573
@woozyyt5573 Год назад
ишь какой ушлый молодой чемодан. надеюсь российские математики шо-нить придумают в ответ
@terragame5836
@terragame5836 Год назад
Лично я надеюсь что роскомпараша наконец додумается перестать сливать мои налоги в унитаз и расформируется
@densidste9137
@densidste9137 Год назад
Nice distribution for taking over all the nodes and vote for Hilary .
@negrastormentas2865
@negrastormentas2865 Год назад
How is the FBI trying to infiltrate Tor? Will we get that talk?
@Waitwhat469
@Waitwhat469 Год назад
40:00 sanctions for communication services should be refusing to accept censorship mandates from that country
@mariarahelvarnhagen2729
@mariarahelvarnhagen2729 Год назад
How Many People Have Heard Of Mice ?
Далее
DEF CON 31 - Private Keys in Public Places - Tom Pohl
40:06
Black Hat 2013 - OPSEC Failures of Spies
25:11
Просмотров 223 тыс.
Brilliant Budget-Friendly Tips for Car Painting!
00:28
How Hackers Move Through Networks (with Ligolo)
20:01
Просмотров 271 тыс.
How TOR Works- Computerphile
14:19
Просмотров 1,7 млн
Tactics of Physical Pen Testers
44:17
Просмотров 903 тыс.
When Cybercriminals with Good OpSec Attack
49:01
Просмотров 184 тыс.
Brilliant Budget-Friendly Tips for Car Painting!
00:28