Re: [tor-talk] OBFS4 Blocking

[Justin <davisjustin002@xxxxxxxxx>]

Hi,
Someone else suggested the idea of Cyberoam using a timing attack. When it comes to iBoss, they certainly are blocking OBFS4. IAT modes 1 and 2 worked, so I guessed that they were fingerprinting packet interarrival times. Also note that IAT does not work behind Cyberoam.

> On Nov 17, 2016, at 3:13 PM, Flipchan <flipchan@xxxxxxxxxx> wrote:
> 
> Did u only try to connect to a bridge and proxy data throw it?
> 
> Justin <davisjustin002@xxxxxxxxx> skrev: (17 november 2016 12:16:49 CET)
>> Hi everyone,
>> I’ve been doing research to see how some of the pluggable transports
>> are getting blocked with DPI. I used a Cyberoam filter under my control
>> for testing, and an iBoss filter at a different location.
>> OBFS4 is blocked behind both filters. Cyberoam is doing some sort of
>> timing attack, but I’m not sure what. When a bridge is used by lots of
>> people, then it doesn’t work. Even enabling Iat mode=1 or 2 doesn’t fix
>> the issue. When I tried a bridge with not many users, it worked no
>> matter what Iat mode was set at. Behind iBoss, they are fingerprinting
>> Packet Interarrival times. Iat mode 1 and 2 worked no matter how much
>> load the bridges had on them.
>> Hopefully this information can help people understand a little more
>> about how these transports are filtered.
>> Thanks,
>> Justin.
>> -- 
>> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
>> To unsubscribe or change other settings go to
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
> 
> -- 
> Sincerly flipchan - LayerProx dev
> -- 
> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
> To unsubscribe or change other settings go to
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk