Tor (dirauths and default bridges) blocked by certain Russian ISPs since 2021-12-01 #97
Comments
|
The Tor Project community team has posted a guide, in Russian, that explains how to get a private obfs4 bridge.
|
|
On 2021-12-07, www.torproject.org and its IPv4 and IPv6 addresses were added to the Unified Register of blocked sites in Russia, meaning that ISPs have an obligation to block access to it.
|
|
It looks like the obfs4 bridges that are available through Moat, the convenient in-browser bridge discovery interface in Tor Browser, have already been enumerated and blocked. The Tor Project has updated the access guide to explain how to get bridges from other sources: Telegram, email, or HTTPS. https://forum.torproject.net/t/tor-blocked-in-russia-how-to-circumvent-censorship/982 The Telegram option is new: contact the @GetBridgesBot account in Telegram and send the text |
|
There has been progress in understanding how Snowflake connections are being detected. In short, it looks like fingerprinting a feature in DTLS Server Hello messages. The discussion may interest you if you are into TLS fingerprinting—DTLS fingerprinting is comparatively under-researched. |
|
The block of Tor relays and default bridges, meek, and Snowflake stopped for a while on 2021-12-08, but resumed on 2021-12-09, affecting more ISPs. It appears that newly established bridges from Moat are not blocked. This suggests that the censor had somehow enumerated most of the available Moat bridges before effecting the block, but has not updated the list of bridges since then. Tor Browser 11.0.2, released 2021-12-08, contains a new default obfs4 bridge, which has not been blocked yet. On 2021-12-08, the web server block was expanded, from
@cohosh developed a mitigation for the snowflake-client DTLS fingerprint that will be in the next release of Tor Browser. If you want to test it manually, there are instructions here. |
|
OONI reports anomalies with Psiphon in Russia, as do human testers. @ValdikSS has posted pcaps of failed Psiphon connections and says that "automatic region selection" connects successfully. I don't see any change yet in the Psiphon Data Engine graph, but it currently stops at 2021-12-08: To be fair, you wouldn't know anything was happening with Tor either, if you were only looking at the graph of relay users. (The graph of bridge users shows an increase in obfs4 and Snowflake users.) This is a good reminder that Tor is blocked on only a few networks in Russia, not all of them. |
|
OONI has published a report on Tor blocking in Russia. The part of the report about the Tor network covers the time span 2021-12-01 to 2021-12-08. https://ooni.org/post/2021-russia-blocks-tor/ OONI's Tor test tests for blocking of Tor directory authorities' dirport and OR port, and of Tor Browser's default obfs4 bridges. Between 2021-12-01 and 2021-12-08, the measurements showed evidence of Tor blocking in 15 out of 65 networks tested in Russia:
|
|
Censored Planet measurements from the past week also indicate likely IP blocking of default Tor bridges within some Russian ASes. We have Spooky Scan measurements for 255 ASes in Russia, belonging to 203 organizations. Spooky Scan uses infrastructure vantage points with a global IPID to measure reachability. 55 ASes had at least one vantage point with anomalous measurements for all tested IPv4 default bridges:
Similar to OONI, we noted nonuniform results within a single AS (e.g., in |
The Tor Project and Roskomsvoboda started a legal challenge of the blocking of the Tor web site. As a result of the challenge, an appellate court reversed the block (EN, RU) on procedural grounds. There will be a new trial to decide whether the web site will be re-added to the blocking register, this time with the Tor Project present. However, the scope of the case has been expanded: it is no longer only about the blocking of the torproject.org domain, but also whether Tor Browser is prohibited and whether Tor Browser should be removed from the Google Play store. The government prosecutor has added Google to the case. https://torrentfreak.com/tor-project-unblocked-but-russia-redemands-censorship-embroils-google-220527/ (archive)
https://roskomsvoboda.org/post/google-v-dele-tor/ (archive)
|
It looks like the unblocking actually happened on 2022-07-14 (one week ago). The Tor Project admins received an email from Roskomnadzor on that date stating that the torproject.org domain and various IP addresses would be unblocked.
In this OONI MAT query, you can see connection attempts starting to succeed across Russia starting 2022-07-14: The email had an attached RTF document (gzipped to attach here), and another attachment of type application/pgp-signature whose format I don't recognize, but which contains some email addresses:
Transcript of RTF attachmentУведомление
|
|
Roger Dingledine will give a talk about about Tor blocking in Russia next week at DEF CON 30. How Russia is Trying to Block Tor
|
|
The slides How Russia is Trying to Block Tor by Roger Dingledine are available here. |
The domain www.torproject.org and its IP addresses have been re-blocked as of 2022-07-28, in a separate court decision and a new registry entry. Other subdomains of torproject.org, however, remain unblocked since 2022-07-14 and the removal of the *.torproject.org registry entry. The Tor Project admins received another email; here are the attachments: These are the registry entries:
OONI measurements support the observation that www.torproject.org was unblocked on 2022-07-14 and re-blocked on 2022-07-29, while bridges.torproject.org was unblocked 2022-07-17 and remains unblocked. |
On 2022-12-15, the Tor Project lost its case to be removed from the blocking registry. The decision also affects the removal of Tor Browser from the Google Play store. https://roskomsvoboda.org/post/tor-ne-proshel-apelliatsiyu/ (archive)
|
|
We must have missed some adventure 🤫
|
The Tor Project's community team noticed that OONI's Tor test, which tests access to Tor's directory authorities and Tor Browser's default obfs4 bridges, showed evidence of blocking in a small number of ASes in Russia since 2021-12-01. The same ASes, before that date, did not show signs of blocking. Further analysis shows that the blocking is mostly concentrated in Moscow.
@ValdikSS did manual testing and found that it is not only plain Tor and default obfs4 bridges that are blocked, but all default pluggable transports present in Tor Browser:
However, obfs4 bridges from bridges.torproject.org, obfs4 bridges from bridges@torproject.org, and a private obfs4 bridge all worked.
@ValdikSS ran additional diagnostics for blocking of ajax.aspnetcdn.com specifically (used in meek-azure).
From the RIPE Atlas measurement map page, we can see that the blocking of ajax.aspnetcdn.com correlates with geography. 16 of the failed probes are in Moscow, and 1 is in Saint Petersburg:
The 466 non-failed probes are located all over Russia, including in Moscow and Saint Petersburg:
The text was updated successfully, but these errors were encountered: