Skip to main content
1 of 2
cacahuatl
  • 11k
  • 2
  • 16
  • 39

China has already been doing this for some time. Anyone who runs a Tor relay will often receive inbound connections from some random residential looking IP address in China, often with some bizzare forensic artifacts that set them aside from normal connections. This is actually part of their strategy of performing "active probing" and trying to talk OR to the destination IP address, or one of the earlier, weaker obfuscation protocols (obfs2 or obfs3). A study of this was published in 2015, and is available in pdf here and as a conference presentation here.

This is one of the design goals of the scramblesuit pluggable transport. It uses a shared secret that is distributed to the end user with the bridge address (out of band). Without knowledge of the shared secret, the pluggable transport will not talk to the probe. So if a censor observes a connection, even if the follow up connection is made it will not be able to determine what kind of service it is providing. Similarly obfs4 improved upon this by sharing the public part of a private keypair instead of a shared secret, which provides extra protections against an adversary who learns the shared secret.

Other approaches are thos take by Meek, where connections are TLS connections to commercially available content distribution networks. A censor would not be able to determine the nature of the traffic in the TLS tunnel, or the true end destination and blocking it would cause collateral damage, since other users of the content distribution network would also be censored despite their traffic not containing any information the censors do not want people to learn. In this way discovery of the IP and Port of the bridge is irrelevant since for the censor the cost of blocking access to it may exceed the benefit gained.

cacahuatl
  • 11k
  • 2
  • 16
  • 39