0

Wang, L., Dyer, K. P., Akella, A., Ristenpart, T., & Shrimpton, T. (2015, October). Seeing through Network-Protocol Obfuscation. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (pp. 57-69). ACM.

In this paper the authors proposed a method to detect obfuscated packets(including those obfuscated by obfsproxy4) with high TPR and very low FPR(0.002). In the discussion section the writers mentioned "It is important to note that the detection techniques we explore can be, in turn, easily circumvented in almost all cases with simple updates to the obfuscator". So I was wondering whether current obfuscators have done this or not.

0

[Disclaimer: I don't know the answer. Someone else might. What follows is a quick, fairly dumb investigation.]

The project page for Tor's separate projects can be found here.

Looking specifically at the pluggable transports, the most likely candidate for being updated to circumvent the techniques mentioned in the paper would be obfsproxy4.

The few commits that have gone in since October, when the paper was published, mainly seem to be single-liner bug fixes. The exception seems to be the addition of "Meek-Lite", the purpose of which seems to be:

It is intended primarily as a "better than nothina" option for enviornments that do not or can not presently use an external Firefox helper

...which doesn't appear related to changing the obsfuscation mechanisms of the transport. So:

So I was wondering whether current obfuscators have done this or not.

I'd say no, at least not for obfsproxy4.

(Note that Meek has had a lot more updates since the paper. I haven't looked through the changes.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.