DEF CON 30 - Roger Dingledine - How Russia is trying to block Tor

  Рет қаралды 62,456

DEFCONConference

DEFCONConference

Жыл бұрын

In December 2021, some ISPs in Russia started blocking Tor's website,
along with protocol-level (DPI) and network-level (IP address) blocking to
try to make it harder for people in Russia to reach the Tor network. Some
months later, we're now at a steady-state where they are trying to find
new IP addresses to block and we're rotating IP addresses to keep up.
In this talk I'll walk through what steps the Russian censors have taken,
and how we reverse engineered their attempts and changed our strategies
and our software. Then we'll discuss where the arms race goes from here,
what new techniques the anti-censorship world needs if we're going to
stay ahead of future attacks, and what it means for the world that more
and more countries are turning to network-level blocking as the solution
to their political problems.

Пікірлер: 101
@DoingFedTime
@DoingFedTime Ай бұрын
This was a great talk, that's my bald head at the bottom left of the podium.
@macktheripper7454
@macktheripper7454 Жыл бұрын
Roger is an absolute hero. Love hearing him talk.
@eyadkourdi2325
@eyadkourdi2325 2 ай бұрын
I love how he talked at the start about Syria blocking TLS, a Syrian previous media activist, used TOR all through 2011 and 2012, got arrested by the Syrian regime intelligence and all what they accused me of is "having suspicious internet activities" but then I got released, I do remember emailing the TOR project for a specific question (I wanted a port forwarding recommendation for live streams using my android phone to stream a protest) and they were very very helpful and literally kept talking to me not just about this question, but also giving my tips specifically for my case use of TOR, can't that you enough guys! and please consider to run a node if u can it helps ppl (and don't use bridges if u don't need to please!)
@csvscs
@csvscs Жыл бұрын
Legendary and thankless work!
@nNiceDreamsMadeTrue
@nNiceDreamsMadeTrue Жыл бұрын
I never heard of snowflake, installed the extension right away!
@angusmacgyver
@angusmacgyver Жыл бұрын
I had heard about it but I installed it now too.
@terragame5836
@terragame5836 11 ай бұрын
41:22 - "I think Russia has already blocked Facebook, but next it's gonna be, like, Linkedin" - nope, it's blocked already, in fact. Had been even earlier than Facebook, if I recall correctly
@peppigue
@peppigue 8 ай бұрын
nooooooooooooooooooooooooooooooooooooooooooo
@uis246
@uis246 Жыл бұрын
Do you remember that Futurama episode where Hermes contested document based on wrong number of stamps? Basically that's what happened in Russia.
@petersuvara
@petersuvara 10 ай бұрын
Awesome vid! Thanks for the talk guys!
@Time4Technology
@Time4Technology 11 ай бұрын
Great talk, thank you.
@billyblackburn864
@billyblackburn864 Жыл бұрын
i tried to start reading through the tor docs, boy is it thorough, I dont know if I'll ever be able to fully grasp it
@Shackleford_Rusty
@Shackleford_Rusty Жыл бұрын
Amazing talk
@abstractapproach634
@abstractapproach634 11 ай бұрын
Thank for your work while we waited for i2p
@Matthias53787
@Matthias53787 11 ай бұрын
What is the SALMON / LOX stuff he mentioned about decentralized trust / reputation? I can't find anything about it online.
@goldnutter412
@goldnutter412 Жыл бұрын
30:25 uncertainty is certain We might be about to get occupied, max uncertainty in the people with something to lose ? some subset of people in the moment need to do something. Move some Bitcoin out of the country ? send a message about relocation ? not willing to hang around. Clear to everyone shit is not going to be good. Whatever it was, significant change of some sort was the only priority for this subset of people and their circumstances. Relatively small group, other countries would have drastically different stats.. some would see sustained and perhaps S curve adoption, civil war possibilities etc etc Fascinating, amazing presentation
@uncertaintytoworldpeace3650
@uncertaintytoworldpeace3650 Жыл бұрын
U called?
@uis246
@uis246 Жыл бұрын
...And that sometimes hard to take, But it will become much clearer With every new choice you make.
@kevincameron192
@kevincameron192 9 ай бұрын
This dude has the exact cadence of Jeff Goldblum 👌
@marioh5172
@marioh5172 7 ай бұрын
arma ftw, great presentation
@Waitwhat469
@Waitwhat469 9 ай бұрын
mTLS should be considered for the bridges, then maybe you can give out keys instead of just addresses, if a good key isn't provided, just ignore it and give a different webpage.
@zephyr1181
@zephyr1181 7 ай бұрын
If the bridges are typically volunteers and not real websites, a state actor would just block the IP and not care what the key is, right?
@RomanDvoryadkin
@RomanDvoryadkin 7 ай бұрын
One of the reason of huge spike in Tor connections from Ukraine during first weeks of the russian invasion, that many hacktivists uses Tor for DDoS of the russian propaganda sites, financial and logistic infrastructure. But usage of Tor turned out to be ineffective, so different measures were taken later.
@JGnLAU8OAWF6
@JGnLAU8OAWF6 6 ай бұрын
Using Tor for DDoS is such a big brain move.
@RomanDvoryadkin
@RomanDvoryadkin 6 ай бұрын
@@JGnLAU8OAWF6 I know. But some russian banks was unhappy even on this traffic.
@austinmurphy9074
@austinmurphy9074 7 ай бұрын
Maybe TOR use spiked in Ukraine during the Russian invasion because Russian military uses TOR in some of their application/devices?
@carnivorebear6582
@carnivorebear6582 Жыл бұрын
Sad we don't get to hear Jacob Applebaum talk on Tor a
@petergerdes1094
@petergerdes1094 Жыл бұрын
Hmm, would it be possible to replace the Bitcoin proof of work with some kind of proof of transport so that mining becomes the provision of Tor relays?
@thewhitefalcon8539
@thewhitefalcon8539 Жыл бұрын
You might want to have a look at the Helium network - but on the Internet instead of wireless. One problem, though: just because some node transported your proof of transport doesn't mean it will also transport your actual traffic.
@petergerdes1094
@petergerdes1094 Жыл бұрын
@@thewhitefalcon8539 Right, but if you encrypt the traffic and the proof so that the node doing the transport can't tell the difference. Designing it right to have all the right incentives would be hard but u could probably get at least a probabilistic guarantee they'd transport traffic.
@thewhitefalcon8539
@thewhitefalcon8539 Жыл бұрын
@@petergerdes1094 Good idea.
@thewhitefalcon8539
@thewhitefalcon8539 Жыл бұрын
@@petergerdes1094 You know, if you have the time you could actually make this.
@goldnutter412
@goldnutter412 Жыл бұрын
@@petergerdes1094 hmm i like where this is going, in a sense.. but.. hm..
@ivanslaboratory
@ivanslaboratory Жыл бұрын
Raising hands upon questioned who runs relays.... Ehmmm.... 🤣🤣🤣
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
Relays are public information.
@ivanslaboratory
@ivanslaboratory 11 ай бұрын
@@thewhitefalcon8539 even IP public addresses are but you still try to hide it :)
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
@@ivanslaboratory The IP addresses of all Tor relays and the real-life owners of most are public info. That's how you know you're not getting an evil relay
@ivanslaboratory
@ivanslaboratory 11 ай бұрын
@@thewhitefalcon8539The identity being published does not mean is legitimate, could be name borrowers. Same as your public IP address could be someone's elses. :) To my knowledge exit nodes are public info, so that can be blocked in case :)
@haudiweg
@haudiweg Жыл бұрын
Does snowflake works for ipv6 only? Ipv4 cg-nat
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
If WebRTC works on your connection then Snowflake works. ISPs want WebRTC to work, because that's like, Discord voice chat.
@N99622
@N99622 Жыл бұрын
Commenting for the algorithm
@monkemode8128
@monkemode8128 4 ай бұрын
"Please consider this as the DEF CON audience that you are" lol
@347573
@347573 Жыл бұрын
Russian hackers are the ones that are using the most sofisticated and more reliable access to TOR. Even the ones working for the government. All the accesses should be easy, since the average people (the one that give or need information) is surely not able to go further than downloading and launching the TOR browser (and already this is not so average). If not those "bad" ones are the only people that will benefit...
@tobysonline4356
@tobysonline4356 Жыл бұрын
Russia has plenty of out of country proxy’s to access tor from. The damage caused be helping the Russian people see all the facts of the war is worth the effort
@coldobina
@coldobina Жыл бұрын
@@tobysonline4356 You forgot to put "facts" in quotes.
@rogo7330
@rogo7330 Жыл бұрын
No. Tor not used only by "bad ones". FSB and other f*ckfaces are most likely have their own VPS in Europe, legally bought by the way; yes, you still can buy VPS with Russia's bank account, and maybe Im already gone insane, but I think "normal" russians can get problems with police if they look into your account and find that you bying proxy for yourselves, and god forbid you use it to do something that "descriminates army of Russia". Tor is just too slow in general and often connections are just dying, but it's nice to have, especially when you don't want to install random "VPN" crap on your computer and have accounts for it.
@TheBinaryHappiness
@TheBinaryHappiness 8 ай бұрын
@@tobysonline4356 poor us Russians w/o access to BBC LMAO westoids are so delusional
@Waitwhat469
@Waitwhat469 9 ай бұрын
40:00 sanctions for communication services should be refusing to accept censorship mandates from that country
@GeoNeilUK
@GeoNeilUK 10 ай бұрын
The Russian Tor censorship sounds a lot like Soviet radio jamming. I wonder if most of the censorship office are women? It was mostly women working on jamming Western radio.
@noahway13
@noahway13 Жыл бұрын
Here in Merica, people are proud of the 2nd. The right to bear arms. The fight of a few rednecks in pickups vs US military, anyone can see that outcome. What is MOST important is the ability to communicate freely and evade censorship is VITAL. Especially in totalitarian nations where the people have no way to fight back other than numbers. If the Chinese people could ever get on the same page, they could topple the government just from mass numbers. A government can't kill or imprison 75% of the population.
@bryant2627
@bryant2627 11 ай бұрын
"few rednecks in pickups vs US military, anyone can see that outcome". Yeah I think usa and Russia thought the same about Afghanistan...went great for the two largest superpowers vs a bunch of "goat herders".
@Enlisttoday
@Enlisttoday 11 ай бұрын
@@bryant2627they had mountains to hide in. It’s a totally different gorilla war fare in them mountains. The afghans also were born into defense due to the Russians trying to invade and the cia gave them old Cold War stockpile anti air missle sand old aks delta force or green beret probably taught them basic combat concepts and outcomes. That or cia. The afghans are the best at walking threw them mountains. Special forces said they are like goats there so strong from walking mountains all there life they say in the hub where they work up mission plan that if a afghan gets his legs around you your dead you won’t be able to get him off.
@sharpenedge
@sharpenedge 9 ай бұрын
32:06 nostr pubkeys? 🤔
@goldnutter412
@goldnutter412 Жыл бұрын
AEweb thoughts ? building on this web3 platform with Uniris biometrics and hierarchical transaction chains structure seems.. unbounded ? "the first ever tamperproof identification that doesn't store any data" is the main selling point but integrating the various technologies of today in the way they have is potentially the end game for defenders ? Imagine all content on the internet has a meta tag of human or not..
@goddessofkratos
@goddessofkratos 8 ай бұрын
I want those docs, I don't tor or telegram, give me safe access and let us process our way 😊 #aibot
@NoNameAtAll2
@NoNameAtAll2 Жыл бұрын
30:24 mind that Ukraine also has been doing censorship of major websites from 2016 or so in an unstable situation reaching for sources of information from both sides might have been important for many
@johngiaus8632
@johngiaus8632 Жыл бұрын
Why would I want to hear from both sides of that conflict?
@NoNameAtAll2
@NoNameAtAll2 Жыл бұрын
@@johngiaus8632 ...because not doing that is the exact definition of information bubble and you need to educate yourself on that?
@Tuxfanturnip
@Tuxfanturnip Жыл бұрын
​@@johngiaus8632 The Ukrainian government could lie or censor news to paint themselves in a more positive light or preserve military secrecy, while Russian media reported on which city your friends live in just got hit with a missile strike. You need to be able to piece together the truth for yourself from multiple sources
@peppigue
@peppigue 8 ай бұрын
several reasons ukrainians or other people in ukraine could want safe comms with people in russia. the biggest group are family connections, second group is businesses and organizations operating in both countries. pro-russia operators in ua are probably not numerous enough to contribute much to such stats.
@olommentes
@olommentes Жыл бұрын
i would say that rt and similar outlets are at least equal to social engineering. If all people would be informed about the background, mo and goals of these disinformation campaigns, they would treat them as such. But this level of knowledge is just not there, they are currently incredibly harmful and no democracy has tools or strategies at place to fight them. Banning is a brute force approach yes, but it is necessary to act on this someway.
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
Absolutely right.
@fus132
@fus132 8 ай бұрын
Ok, and _Who_ defines the disinformation exactly?
@awesomesauce804
@awesomesauce804 Ай бұрын
​@@fus132the integrity initiative.
@mariarahelvarnhagen2729
@mariarahelvarnhagen2729 10 ай бұрын
How Many People Have Heard Of Mice ?
@wagyourtai1
@wagyourtai1 Жыл бұрын
bridgecoin
@MikeTrieu
@MikeTrieu 10 ай бұрын
"Translate to english" 😂
@josiahsharkey7520
@josiahsharkey7520 11 ай бұрын
Tor still has centralization it uses centralized dns servers for all dns you can proxy dns over tor but it still requires trust of centralized dns servers onion services also use centralized matching servers they do allow you to encrypt the metadata on the central server but it is encryption that the NSA can break with there quantum computer and it requires setting up a key pair for each user also Russia isn't the only one censoring tor my ISP allows tor without bridges as a client but my ssh service that I run over tor for ddns was blocked until I used bridges so even in the US they do DPI to block hosting services over tor but they allow client access to anything over tor so bridges in iat mode 2 prevents them from knowing the difference between client and server tor connections and everything works
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
not correct
@josiahsharkey7520
@josiahsharkey7520 11 ай бұрын
Yes it is tor uses distributed centralized matching servers and if you proxy dns through tor it normally goes to cloudflare you can send clearnet dns to cloudflares onion service but that still requires trusting distributed centralized matching servers that can be poisoned by the NSA using there quantum computer to steal private keys then redirecting all traffic to a fake version of the site that sends malware to all users that's why I put ssh behind wireguard psk behind udp tunnel behind tor for ddns so they won't be able to poison my service because they won't know the psk and all pre quantum encryption should be considered broken because the NSA has a quantum computer and my ISP does DPI to block only hosting onion services so everything I said is true
@cedricvillani8502
@cedricvillani8502 Жыл бұрын
Cohorting and timing just like google, lol thanks but no for me.
@josiahsharkey7520
@josiahsharkey7520 11 ай бұрын
Having any restrictions on bridges is a huge problem if you don't allow users to add there exclude nodes list because I already have to retry getting bridges for a couple hours using tor to randomize my IP to get a few bridges that aren't in fascist countries like the US and EU that censor the internet so they are more likely to block hosting onion services like my ISP does it is not as bad as Chinese or Russian bridges but they are unacceptable for anyone that cares about privacy and security not just anonymity for client side access
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
It doesn't matter whether your bridge is in a fascist country (like the one you are in). Your bridge doesn't know what sites you are accessing. I know you live in a fascist country because you wouldn't need a bridge otherwise.
@josiahsharkey7520
@josiahsharkey7520 11 ай бұрын
Yes it does matter because they can block only hosting onion services by doing DPI on the output from the bridge and it is terrible security to use a bridge in the US, EU, 14 eyes, or any other country that does any internet censorship because your bridge and exit node are more likely to cooperate and de-anonymize you and your bridge is more likely to be compromised by the NSA so I exclude all of them and my tor service refuses to connect to any bridge hosted in those countries so you are wrong also bridges are necessary for anyone that cares about privacy not just people that can't connect to tor because bridges obfuscate tor use just like tor over vpn but it is harder for the US government to get search warrants for them because at least in US law node operators aren't responsible for any tor traffic so they have no reason to help the government unless they are a fascist because the government can't threaten to arrest them because there are already laws protecting them from that because it was invented by the US government and they wanted other people to help hide their traffic
@thewhitefalcon8539
@thewhitefalcon8539 11 ай бұрын
@@josiahsharkey7520 The output from a bridge is still encrypted 3 times. You might be confusing bridges and exit relays. The output from an exit relay is still encrypted 1 time unless you don't use HTTPS which you should always use with Tor.
@josiahsharkey7520
@josiahsharkey7520 11 ай бұрын
@@thewhitefalcon8539 that's not true it isn't encrypted well enough to hide the difference between client and server even on the first hop my ISP blocks only onion services so DPI can tell the difference even with 5 layers of encryption on the data using ssh, wireguard, and tor and do you really think the NSA can't get a certificate trusted by a root CA in your browser to man in the middle the output of the exit node so https isn't real security against nation state attackers and if the bridge and exit node cooperate you lose all anonymity unless you use post quantum security and there are enough people like me that run post quantum security over tor on the same circuit and using https on an onion service loses all anonymity unless you require adding a hybrid post quantum root CA to every users computer and run your own CA I don't need this level of security, privacy, and anonymity because I am only using it for remote access to my computers I don't have active nation state attackers but other people do and if I use this level of security it helps protects them from being traced because they can't rule me out as their target as easily
@JamieVegas
@JamieVegas 8 ай бұрын
The number of people who use Tor for the purposes claimed is tiny. It's just hammering the banking system and killing ecommerce... and a few other more serious things.
@woozyyt5573
@woozyyt5573 Жыл бұрын
ишь какой ушлый молодой чемодан. надеюсь российские математики шо-нить придумают в ответ
@terragame5836
@terragame5836 11 ай бұрын
Лично я надеюсь что роскомпараша наконец додумается перестать сливать мои налоги в унитаз и расформируется
@densidste9137
@densidste9137 Жыл бұрын
Nice distribution for taking over all the nodes and vote for Hilary .
@negrastormentas2865
@negrastormentas2865 10 ай бұрын
How is the FBI trying to infiltrate Tor? Will we get that talk?
ХОТЯ БЫ КИНОДА 2 - официальный фильм
1:35:34
ХОТЯ БЫ В КИНО
Рет қаралды 2,6 МЛН
Can you beat this impossible game?
00:13
LOL
Рет қаралды 46 МЛН
Como ela fez isso? 😲
00:12
Los Wagners
Рет қаралды 30 МЛН
Eccentric clown jack #short #angel #clown
00:33
Super Beauty team
Рет қаралды 26 МЛН
37C3 -  Tor censorship attempts in Russia, Iran, Turkmenistan
1:02:42
media.ccc.de
Рет қаралды 12 М.
Bill Swearingen - HAKC THE POLICE - DEF CON 27 Conference
41:18
DEFCONConference
Рет қаралды 601 М.
DEF CON 26 - Si, Agent X - Wagging the Tail:Covert Passive Surveillance
47:14
Black Hat 2013 - OPSEC Failures of Spies
25:11
HackersOnBoard
Рет қаралды 221 М.
When Cybercriminals with Good OpSec Attack
49:01
RSA Conference
Рет қаралды 176 М.
How to HACK your ISP router - step by step.
13:51
Tomaž Zaman
Рет қаралды 109 М.
Defcon 21 - Forensic Fails - Shift + Delete Won't Help You Here
47:10
HackersOnBoard
Рет қаралды 635 М.
ПРОБЛЕМА МЕХАНИЧЕСКИХ КЛАВИАТУР!🤬
0:59
Корнеич
Рет қаралды 3,5 МЛН
С Какой Высоты Разобьётся NOKIA3310 ?!😳
0:43
Xiaomi Note 13 Pro по безумной цене в России
0:43
Простые Технологии
Рет қаралды 2 МЛН
Apple, как вас уделал Тюменский бренд CaseGuru? Конец удивил #caseguru #кейсгуру #наушники
0:54
CaseGuru / Наушники / Пылесосы / Смарт-часы /
Рет қаралды 4,6 МЛН
Эволюция телефонов!
0:30
ТРЕНДИ ШОРТС
Рет қаралды 6 МЛН