DNS-Morph: UDP-Based Bootstrapping Protocol for Tor

Rami Ailabouni; Orr Dunkelman; Sara Bitan

doi:10.1007/978-3-030-78086-9_19

DNS-Morph: UDP-Based Bootstrapping Protocol for Tor

Rami Ailabouni, Orr Dunkelman, Sara Bitan

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users’ ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor’s traffic flow. In this paper we introduce a new approach aiming to enhance the PT’s resistance against active probing attacks, as well as white-listing censorship by partitioning the handshake of the PT from its encrypted communication. Thus, allowing mixing different PTs, e.g., ScrambleSuit for the handshake and FTE for the traffic itself. We claim that this separation reduces the possibility of marking Tor related communications. To illustrate our claim, we introduce DNS-Morph: a new method of transforming the handshake data of a PT by imitating a sequence of DNS queries and responses. Using DNS-Morph, the Tor client acts as a DNS client which sends DNS queries to the Tor bridge, and receives DNS responses from it. We implemented and successfully tested DNS-Morph using one of the PTs (ScrambleSuit), and verified its capabilities.

Original language	English
Title of host publication	Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings
Editors	Shlomi Dolev, Oded Margalit, Benny Pinkas, Alexander Schwarzmann
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	244-265
Number of pages	22
ISBN (Print)	9783030780852
DOIs	https://doi.org/10.1007/978-3-030-78086-9_19
State	Published - 2021
Event	5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021 - Be'er Sheva, Israel Duration: 8 Jul 2021 → 9 Jul 2021

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12716 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021
Country/Territory	Israel
City	Be'er Sheva
Period	8/07/21 → 9/07/21

Bibliographical note

Publisher Copyright:
© 2021, Springer Nature Switzerland AG.

Keywords

Bootstrapping
Bridge
Censorship
Circumvention
DNS
Pluggable Transport
Tor
UDP

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-030-78086-9_19

Cite this

Ailabouni, R., Dunkelman, O., & Bitan, S. (2021). DNS-Morph: UDP-Based Bootstrapping Protocol for Tor. In S. Dolev, O. Margalit, B. Pinkas, & A. Schwarzmann (Eds.), Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings (pp. 244-265). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12716 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-030-78086-9_19

Ailabouni, Rami ; Dunkelman, Orr ; Bitan, Sara. / DNS-Morph : UDP-Based Bootstrapping Protocol for Tor. Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings. editor / Shlomi Dolev ; Oded Margalit ; Benny Pinkas ; Alexander Schwarzmann. Springer Science and Business Media Deutschland GmbH, 2021. pp. 244-265 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{c80c55763d2e4907b5af02875d213243,

title = "DNS-Morph: UDP-Based Bootstrapping Protocol for Tor",

abstract = "Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users{\textquoteright} ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor{\textquoteright}s traffic flow. In this paper we introduce a new approach aiming to enhance the PT{\textquoteright}s resistance against active probing attacks, as well as white-listing censorship by partitioning the handshake of the PT from its encrypted communication. Thus, allowing mixing different PTs, e.g., ScrambleSuit for the handshake and FTE for the traffic itself. We claim that this separation reduces the possibility of marking Tor related communications. To illustrate our claim, we introduce DNS-Morph: a new method of transforming the handshake data of a PT by imitating a sequence of DNS queries and responses. Using DNS-Morph, the Tor client acts as a DNS client which sends DNS queries to the Tor bridge, and receives DNS responses from it. We implemented and successfully tested DNS-Morph using one of the PTs (ScrambleSuit), and verified its capabilities.",

keywords = "Bootstrapping, Bridge, Censorship, Circumvention, DNS, Pluggable Transport, Tor, UDP",

author = "Rami Ailabouni and Orr Dunkelman and Sara Bitan",

note = "Publisher Copyright: {\textcopyright} 2021, Springer Nature Switzerland AG.; 5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021 ; Conference date: 08-07-2021 Through 09-07-2021",

year = "2021",

doi = "10.1007/978-3-030-78086-9_19",

language = "English",

isbn = "9783030780852",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "244--265",

editor = "Shlomi Dolev and Oded Margalit and Benny Pinkas and Alexander Schwarzmann",

booktitle = "Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings",

address = "Germany",

}

Ailabouni, R, Dunkelman, O & Bitan, S 2021, DNS-Morph: UDP-Based Bootstrapping Protocol for Tor. in S Dolev, O Margalit, B Pinkas & A Schwarzmann (eds), Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12716 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 244-265, 5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021, Be'er Sheva, Israel, 8/07/21. https://doi.org/10.1007/978-3-030-78086-9_19

DNS-Morph: UDP-Based Bootstrapping Protocol for Tor. / Ailabouni, Rami; Dunkelman, Orr; Bitan, Sara.
Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings. ed. / Shlomi Dolev; Oded Margalit; Benny Pinkas; Alexander Schwarzmann. Springer Science and Business Media Deutschland GmbH, 2021. p. 244-265 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12716 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - DNS-Morph

T2 - 5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021

AU - Ailabouni, Rami

AU - Dunkelman, Orr

AU - Bitan, Sara

PY - 2021

Y1 - 2021

N2 - Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users’ ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor’s traffic flow. In this paper we introduce a new approach aiming to enhance the PT’s resistance against active probing attacks, as well as white-listing censorship by partitioning the handshake of the PT from its encrypted communication. Thus, allowing mixing different PTs, e.g., ScrambleSuit for the handshake and FTE for the traffic itself. We claim that this separation reduces the possibility of marking Tor related communications. To illustrate our claim, we introduce DNS-Morph: a new method of transforming the handshake data of a PT by imitating a sequence of DNS queries and responses. Using DNS-Morph, the Tor client acts as a DNS client which sends DNS queries to the Tor bridge, and receives DNS responses from it. We implemented and successfully tested DNS-Morph using one of the PTs (ScrambleSuit), and verified its capabilities.

AB - Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users’ ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor’s traffic flow. In this paper we introduce a new approach aiming to enhance the PT’s resistance against active probing attacks, as well as white-listing censorship by partitioning the handshake of the PT from its encrypted communication. Thus, allowing mixing different PTs, e.g., ScrambleSuit for the handshake and FTE for the traffic itself. We claim that this separation reduces the possibility of marking Tor related communications. To illustrate our claim, we introduce DNS-Morph: a new method of transforming the handshake data of a PT by imitating a sequence of DNS queries and responses. Using DNS-Morph, the Tor client acts as a DNS client which sends DNS queries to the Tor bridge, and receives DNS responses from it. We implemented and successfully tested DNS-Morph using one of the PTs (ScrambleSuit), and verified its capabilities.

KW - Bootstrapping

KW - Bridge

KW - Censorship

KW - Circumvention

KW - DNS

KW - Pluggable Transport

KW - Tor

KW - UDP

UR - http://www.scopus.com/inward/record.url?scp=85111981616&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-78086-9_19

DO - 10.1007/978-3-030-78086-9_19

M3 - Conference contribution

AN - SCOPUS:85111981616

SN - 9783030780852

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 244

EP - 265

BT - Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings

A2 - Dolev, Shlomi

A2 - Margalit, Oded

A2 - Pinkas, Benny

A2 - Schwarzmann, Alexander

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 8 July 2021 through 9 July 2021

ER -

Ailabouni R, Dunkelman O, Bitan S. DNS-Morph: UDP-Based Bootstrapping Protocol for Tor. In Dolev S, Margalit O, Pinkas B, Schwarzmann A, editors, Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings. Springer Science and Business Media Deutschland GmbH. 2021. p. 244-265. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-78086-9_19

DNS-Morph: UDP-Based Bootstrapping Protocol for Tor

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this