More Like this

1. Exposing and Circumventing SNI-based QUIC Censorship of the Great Firewall of China

   Zohaib, Ali; Zao, Qiang; Sippe, Jackson; Alaraj, Abdulrahman; Houmansadr, Amir; Durumeric, Zakir; Wustrow, Eric (August 2025, USENIX Security Symposium)

   Despite QUIC handshake packets being encrypted, the Great Firewall of China (GFW) has begun blocking QUIC connections to specific domains since April 7, 2024. In this work, we measure and characterize the GFW’s censorship of QUIC to understand how and what it blocks. Our measurements reveal that the GFW decrypts QUIC Initial packets at scale, applies heuristic filtering rules, and uses a blocklist distinct from its other censorship mechanisms. We expose a critical flaw in this new system: the computational overhead of decryption reduces its effectiveness under moderate traffic loads. We also demonstrate that this censorship mechanism can be weaponized to block UDP traffic between arbitrary hosts in China and the rest of the world. We collaborate with various open-source communities to integrate circumvention strategies into a leading web browser, the quic-go library, and all major QUIC-based circumvention tools. 

   more » « less
2. Detecting Media Self-Censorship without Explicit Training Data

   https://doi.org/10.1137/1.9781611976236.62  

   Tao, Rongrong; Zhou, Baojian; Chen, Feng; Mares, Dvid; Butler, Patrick; Ramakrishnan, Naren; Kennedy, Ryan (July 2020, Proceedings of the 2020 SIAM International Conference on Data Mining)

   Demeniconi; Carlotta; Nitesh V. Chawla (Ed.)

   The motives and means of explicit state censorship have been well studied, both quantitatively and qualitatively. Self-censorship by media outlets, however, has not received nearly as much attention, mostly because it is difficult to systematically detect. We develop a novel approach to identify news media self-censorship by using social media as a sensor. We develop a hypothesis testing framework to identify and evaluate censored clusters of keywords and a near-linear-time algorithm (called GraphDPD) to identify the highest-scoring clusters as indicators of censorship. We evaluate the accuracy of our framework, versus other state-of-the-art algorithms, using both semi-synthetic and real-world data from Mexico and Venezuela during Year 2014. These tests demonstrate the capacity of our framework to identify self-censorship and provide an indicator of broader media freedom. The results of this study lay the foundation for detection, study, and policy-response to self-censorship. 

   more » « less
3. DeResistor: Toward Detection-Resistant Probing for Evasion of Internet Censorship

   Amich, Abderrahmen; Eshete, Birhanu; Yegneswaran, Vinod; Hoang, Nguyen Phong (August 2023, 32nd USENIX Security Symposium)

   Calandrino, Joseph A.; Troncoso, Carmela (Ed.)

   The arms race between Internet freedom advocates and censors has catalyzed the emergence of sophisticated blocking techniques and directed significant research emphasis toward the development of automated censorship measurement and evasion tools based on packet manipulation. However, we observe that the probing process of censorship middleboxes using state-of-the-art evasion tools can be easily fingerprinted by censors, necessitating detection-resilient probing techniques. We validate our hypothesis by developing a real-time detection approach that utilizes Machine Learning (ML) to detect flow-level packet-manipulation and an algorithm for IP-level detection based on Threshold Random Walk (TRW). We then take the first steps toward detection-resilient censorship evasion by presenting DeResistor, a system that facilitates detection-resilient probing for packet-manipulation-based censorship-evasion. DeResistor aims to defuse detection logic employed by censors by performing detection-guided pausing of censorship evasion attempts and interleaving them with normal user-driven network activity. We evaluate our techniques by leveraging Geneva, a state-of-the-art evasion strategy generator, and validate them against 11 simulated censors supplied by Geneva, while also testing them against real-world censors (i.e., China’s Great Firewall (GFW), India and Kazakhstan). From an adversarial perspective, our proposed real-time detection method can quickly detect clients that attempt to probe censorship middle-boxes with manipulated packets after inspecting only two probing flows. From a defense perspective, DeResistor is effective at shielding Geneva training from detection while enabling it to narrow the search space to produce less detectable traffic. Importantly, censorship evasion strategies generated using DeResistor can attain a high success rate from different vantage points against the GFW (up to 98%) and 100% in India and Kazakhstan. Finally, we discuss detection countermeasures and extensibility of our approach to other censor-probing-based tools. 

   more » « less
4. Understanding Routing-Induced Censorship Changes Globally

   Bhaskar, Abhishek; Pearce, Paul (October 2024, ACM CCS 2024)

   Internet censorship is pervasive, with significant effort dedicated to understanding what is censored, and where. Prior censorship measurements however have identified significant inconsistencies in their results; experiments show unexplained non-deterministic behaviors thought to be caused by censor load, end-host geographic diversity, or incomplete censorship—inconsistencies which impede reliable, repeatable and correct understanding of global censorship. In this work we investigate the extent to which Equal-cost Multi-path (ECMP) routing is the cause for these inconsistencies, developing methods to measure and compensate for them. We find that ECMP routing significantly changes observed censorship across protocols, censor mechanisms, and in 18 countries. We identify that previously observed non-determinism or regional variations are attributable to measurements between fixed endhosts taking different routes based on Flow-ID; i.e., choice of intrasubnet source IP or ephemeral source port leads to differences in observed censorship. To achieve this we develop new route-stable censorship measurement methods that allow consistent measurement of DNS, HTTP, and HTTPS censorship. We find ECMP routing yields censorship changes across 42% of IPs and 51% of ASes, but that impact is not uniform. We develop an application-level traceroute tool to construct network paths using specific censored packets, leading us to identify numerous causes of the behavior, ranging from likely failed infrastructure, to routes to the same end-host taking geographically diverse paths which experience differences in censorship en-route. Finally, we compare our results to prior global measurements, demonstrating prior studies were possibly impacted by this phenomenon, and that specific results are explainable by ECMP routing. Our work points to methods for improving future studies, reducing inconsistencies and increasing repeatability 

   more » « less
5. The Strong Cosmic Censorship conjecture

   https://doi.org/10.5802/crmeca.271  

   Van_de_Moortel, Maxime (January 2025, Comptes Rendus. Mécanique)

   In the wake of major breakthroughs in General Relativity during the 1960s, Roger Penrose introduced Strong Cosmic Censorship, a profound conjecture regarding the deterministic nature of the theory. Penrose’s proposal has since opened far-reaching new mathematical avenues, revealing connections to fundamental questions about black holes and the nature of gravitational singularities. We review recent advances arising from modern techniques in the theory of partial differential equations as applied to Strong Cosmic Censorship, maintaining a focus on the context of gravitational collapse that gave birth to the conjecture. 

   more » « less