[Music]
we are here and we will have a talk from
asim
who
came over here to tell us about all the
censoring that we see in some countries
not here maybe so much but in other
countries the centering of the internet
and he's showing us even in a very
practical manner
how
you
even if you're not a technician
can bypass these centerings so we will
even have a live demo
have fun with asim
hey thank you
thank you
[Applause]
hello everyone uh this is a theme and
probably if you live in this region you
wouldn't have experienced any kind of
censorship because i was trying to run
an application to test if any of the
websites are blocked or not and i didn't
find any so i'll be showing the results
towards the end of the presentation
and the talk the topic is censoring the
internet and how to bypass it so
uh uh
a lot of
you might think that it would be a very
technical one which is which is which it
is but uh there are a lot of small
integrity things that
you can
as a normal person who wants to bypass
it you can use it like if you have an
android device i would have some
settings that you can add to your device
so as to get a totally sensitive
internet or an internet that's not being
monitored by your isp so isp stands for
internet service provider
so yeah let's get started um
who am i uh so myself i also
teach about cyber security on my youtube
channel called hacking simplified
professionally i work as a security
engineer in a us-based startup called
rippling i sometimes hack government
websites and private organizations as
well as part of their bug bounty
programs
so you can scan this if you want the
slides and read through it but i think
you can easily see it on the screen
itself
let's skip
this
on these are some this
so yeah
so i'll start with the question as to
what happens when you type a url in your
browser and you press the enter button
what all goes in the back of it so if
you are a software developer you might
have experienced this question in your
interviews because this is one of the
very common questions that you get asked
the in the later half i will talk about
how
the whole process once you understand
the whole process you would get to know
where are the places where you can be
censored and where you can be monitored
because once you understand something
only then it gets easy to bypass it or
basically get over or get around it
so there are like places the traffic can
be censored those are usually two places
there's a dns and then there's a http
request i'll be talking about both of
these in detail
and after those are done we'll talk
about the bypassing of these
so
how many of you know like what happens
when you type let's say
mch2022.org in your browser just to show
fans
cool how many of you know what our dns
is
cool so how many of you use cloud flare
dns
okay that's quite
low in number
okay how many of you
okay how many of you know what
8.8.8.8 is
cool okay fine
[Music]
sorry
uh yeah i have that but cod nine i think
lesser number would know but yeah so
yeah
uh let's see what happens so this is an
over simplified version of it so
this is your browser and let's say you
go to my website at seamstream.com so
the very first thing that happens
because machines understand only numbers
they don't understand what a seamstress
dot n is
so this a seamstress.10 website gets
translated to a number that number is
the ip address ip address is the
internet protocol address
that number is basically the address
where my website is hosted
and on the right far right if you see
that is the server uh the web server
where the machine
my website is hosted so now the browser
has got the ip address from the dns
server it tries to send the request to
that
machine that hey please give me the
website that's a seamstress.net the
website complies and gives back the html
web page
this is the http flow
let's say an oversimplified version of
an https flow the first part remains the
same in the second part there's some
mathematical calculation which we call
as encryption
and that basically what it does is when
the html web page comes to the browser
that is encrypted so that anyone who is
in between the browser and the machine
that where my server my website is
hosted no one can see that data so
suppose you are using a website that has
payment data or you are entering your
let's say
paypal credential or your stripe
credentials or credit card number so
those are usually encrypted and you see
that https on the url with a green
padlock usually
so that's the http is slow
now let me show you the actual flow
so this is the actual flow you don't
directly talk to the dns so you don't
directly talk to the machine there is
usually an isp
like if you check the isp currently
where you if you're connected to mch
wi-fi you would see stitch internet
something the organization name is
stitch and something so that is the one
who is providing the whole internet
infrastructure to this area if i go to
my
country india there would be airtel geo
or any other mobile network providers
they are usually the internet service
provider
so the traffic if you can see this slow
the browser first requests the isp isp
does all that part on behalf of you
now this is
quite an apt
like this is the answer to the question
what happens when you enter a url into
the browser and press enter this is a
very detailed one i won't be talking
about it but it's a very good one uh
thanks to wasim chekham i found it
online
but
go through it because it would have the
sites it's quite interesting to know
what happens and
how easy you feel that you just press
and enter and it happens in the snap of
a second but this whole thing happens in
that snap of a second
now you might ask okay so what like i
got the flow i got the https flow now
what what more
so let's see which places traffic can be
censored now
so now if you see the isp's color has
been changed to red that signifies that
there is a danger
so
because the isp is in control of the dns
request that is going and it's also in
the control of which server the
web page from where the web page is
being fetched what is being returned all
this is
you are on the mercy of the isp so
basically everything is going through
them
so that's where like these are the two
end point the dns thing and the http
https request for http request these are
the two places where
the isp can basically come into picture
and try to modify or censor the data
that you are getting
okay
so dns level sending fake dns responses
and http request is the host header and
the http intercepting so i'll talk about
both of these so dns level is when
you're trying to get the ip address so
imagine the case where you're trying to
let's say
access a website that
is supposedly that should be blocked or
let's say
there's a website of a terrorist
organization that your country doesn't
want you to see so what they would try
to do is they would try to send you a
different ip address that doesn't belong
to the terrorist organization's website
in the same case when you have the http
request so in that part what happens is
if it's an http not it's a non-encrypted
uh traffic they can directly modify the
traffic and send you let's say a notice
that this website is banned or something
like that i'll show you some examples
later in the slides so how
html response is being modified i also
have a wireshark packet capture which
basically shows the flow of the tcp as
to how that data is being modified
don't get overall about all these terms
it's very simple i mean
tcp and all it gets
over
okay let's
i think yeah
so
on the dns level sensoring uh there are
two methods that that are usually
employed by these isps the first one is
they try to
once you get a
internet connection from your local isp
or home server you are basically um
giving the lease for your internet
connection let's say you are in u.s and
you get comcast or let's say you're in
india you get airtel geo any other
internet service provider so they give
you a router
and you basically get the wi-fi
connection using that
so this router has predefined dns
service ip embedded into that and that's
where i would come to the cloud fair dns
and 8.8.8.8
so these isps when they give you the
router and the internet connection they
already have their own dns server as the
default server where your request would
go
so if they have to do any kind of
filtering they would just
send you like an invalid response or a
fake response or a different response
instead of going through all the hassle
of like
encrypted like intercepting your traffic
and doing all that so that is the very
basic that they do they also do this
because sometimes um it's easier for
them or to cash it on the isp level and
basically
you can get all the dns responses on
their own isp so the traffic they don't
have to forward the internet traffic
from your device to a public dns server
for example let's say
uh you get a connection from a local isp
and
they are running their own dns server so
you request for google.com so what
happens is
where we saw the previous slide so the
google.com request goes through the isp
isp has their own dns server running it
returns the ip address of google.com and
then basically your machine makes a
connection to that
so
what happens let's say you are trying to
access this website which is banned
let's say a terrorist organization
website or any kind of website that your
country feels is not
to be shown to their citizens so what
they would
like give a notice to the isp is that
when you get a request to this change
the ip address or return the non-valid
ip address instead of
giving a valid ip address response so
there are two ways they do it either
they have one is called the sinkhole
sinkhole is basically they have their
own machine which serves uh government
notice that this this website is locked
so any request that goes through them
they return the ip address of that
machine so that is called the sinkhole
so all the requests go through that
sinkhole
the other method is they return a nx
domain response so nx domain is no
domains exist so the browser feels that
there is no domain as such
so
to replicate this you can just type
random characters let's say abcdefgh
whatever you want to type and then dot
com so the browser would show that nx
domain this domain does not exist
so that is what they do
the other thing that is quite
like creepy i would say the transparent
dn is proxing what happens in that case
you
so
that comes because the first case when
you have the default dns you can change
the default dns to a dns provider of
your choosing let's say you choose
google's dns provider or cloudflare dns
provider because you know that those
providers won't block these are public
dns providers so you enter their ip
address as your dns resolver so let's
say you add 8.8.8.8 as your dns
resolvers so any website that your
browser wants to fetch they would fetch
from google's public dns resolver that
is 8.8.8.8
coordinate
what happens in this case because now
isp is not control of your dns traffic
so they can't censor that they can't
monitor that so what they do is
uh
here comes the technical part of it so
dns works on port 53 every machine has
like 65 000 ports and using these ports
your machine makes connection to the
outer world so dns or domain name system
that works on a particular port called
port number 53 that's a port number
so what these isp do they monitor
traffic on this port 53 and
well and what they do is they route all
the data all the traffic that is going
to port 53 to their own servers so even
if you set google as your dns server the
request doesn't go to google rather they
go to the dns providers and because the
whole in internet traffic is going
through them so they can easily do it
without like transparently do it and you
wouldn't you wouldn't know any better of
it the other thing that happens
and sometimes because people know okay
they are transparently proxying their
dns
what isp do is if it's a blocked website
they won't
like proxy it like in india recently i
think two years back what happened was
uh some websites those dns was being
provided by cloudflare whereas the other
was being routed to the isps so they
were transparently proxying those i'll
show you a diagram that would help you
explain it
um yeah so this is the first one the
fake dns so let's say even if you have a
vpn tunnel connected to your
infrastructure the dns or the port 53
request because it's not going through
the vpn by default so that goes to the
isp and the isp changes the response to
that so even if you the major traffic
the http http traffic https traffic goes
through vpn it goes to the wrong ip
address or it goes to the wrong server
so you would get a different response
either way
it's also called a dns leak because
this helps the companies to know which
websites you are using even though you
are using a vpn so the whole purpose of
vpn is to provide you anonymity and like
so that no one knows what you're
actually viewing but using this dns leak
the isps know which particular website
you are browsing even though they don't
know what you are browsing or what you
are doing there but they know okay a
request is being made to
so and so website
this is a transparent dns proxy so in
this case even if you have a public dns
set as your proxy you would still your
request would still be routed to the
isp dns and you would get a response
from them
yeah so if you have a mobile phone right
now you can
go to this website dnsleaktest.com and
you can see if your dns requests are
getting leaked to the isp or is it going
through cloudflare or whichever dns you
have chosen
uh i think i have it up here so this is
the website that's how it looks
so
there's a standard test and there's an
extended test so
i hope it's visible yeah so in the
standard test they do one round of
testing where they send requests to
their own unique domains and try to find
whether you are trying to access that
your you are trying to access that
domains or
the isp is trying to access that and
give you the response so let me just
show you that
so
in
so you can see i have the isp set as
cloudflare so you get a responses
cloudflare amsterdam if it was being
blocked or if it was going through the
isp you would see the isp's response
isp's name here
this is a good website they have
like quite a detailed thing and how it
is working and you can read about it i
have these in the
or they say in the references slide
if you want to know how it works and
there's a way that you can even if
you're using cloud file you can still
modify that and
manipulate it to show that you're using
air trail dns it's i mean it's very easy
to work if you want you can
talk to me about that later we can see
how that works
um
now let's see how you can bypass these
checks
so the very first thing is if you are in
the first if the isps in the first
category where they're just having the
default uh
dns server you can just choose any of
these dns's let's say cloudflare opendns
or quad9 so
you can set it in your mobile setting or
in your browser setting and the dns
request would go to them it is for the
first case when the isp has set a
default dns
server into your router
you can also clear your dns case so what
dns case does is let's say you are going
to google.com again and again so your
browser won't be sending a dns request
every time you go to google rather it
would save the ip address of google and
it would just continue with that but
let's say your isp has already poisoned
that website and it's sending their ip
address instead of actual google website
so that would like continue to show in
your browser until unless you clear that
cache it's called the cache so that's
why you need to clear the cache and
there's a link how you can do
that i'll just quickly show where you
can set this settings for different
browsers
um
okay first let me talk about the second
case so that was the first case where
you add the default dns set by the row
by the isp the second case is where
there is a transparent proxy so any
traffic that you are sending on port 53
that is being
transferred to the proxy and being like
like a fake response is being reverted
from that
so to bypass that we have technical
solutions like dns over https and dns
over tls
i'm stressing more on dns over https for
a reason i'll just talk about it let's
first talk about dns over tls so tls is
basically what powers the https the
security layer of https and that's how
your whole
network whole data that's going through
your website or the encrypted web page
that you get and the reason why no one
is able to sniff your credit card
details that is because of tls so tls
make sure that your connection between
your browser and the website that you
are going that's encrypted and the same
is happening on dns now that you can
basically encrypt that data and so
that's why it's called dns over tls
the reason people don't prefer dns over
tls is because it's limited to a port
called port port number 853
so again what the
isps can do is they can route the
traffic to port 853 to their website
their dns server and give you a fake
response over that so that's why dns
over https is preferred because in dns
or http tps it's a normal http
connection or rather https connection
which is sent to our port 443 so it's
like a normal browser traffic so it goes
through the cloudflare or whichever dns
over https
server you have chosen and the whole
dns request or getting the ip address is
sent as a http https request so to block
that they would have to route all the
port 443 traffic that would be humongous
and
i mean the volume itself won't be able
to like you won't be able to know which
data is inside it because the whole of
the dns request is encrypted inside the
http bracket
so that's the reason why dns over https
is preferred
cloudflare has their domain cloudflare
iphonedns.com
dns query
so you might ask yeah see in the
previous cases we saw that dns was 1.1.1
or it was a ip address but here you have
the https so it's because this whole
fetching the dns responses or fetching
the ip address of the machine it's it is
in itself
uh what is it it is in itself an http
the packet thing the getting an html
page kind of thing
you can also have open dns and quad 9 on
the same on desktop firefox you can even
have doh by from the network setting
itself
doh is not enabled on android till now
you can have dns or tls i have it on my
mobile phone in some countries that's
not preferred like while i was coming
from
india i had a layover in abu dhabi so
their private dns or dns over tls was
not working so i had to switch back to
the normal dns but in other cases
the reason i told you like dns over tls
can be monitored and can be stopped but
dns over https can't be because it's the
same as https traffic
so for android i think they have started
experimentally in android 12 but it's
not yet rolled out
uh yeah so this is the firefox screen uh
let me just quickly show you where you
can do this
so here's the settings for this you just
search for dns here
in the settings you can see enable dns
over https cloudflare next dns and the
custom in the custom you can add quad 9
and other kinds of stuff
i have dns over https
in this
then if you use brave or chrome any of
those in the security settings privacy
and security
you have this use secure dns and inside
you can have cloudflare 1.1.1 and other
kinds of privacy in the san
things like that
for android this is the screen uh in
iphone i think it's the dns over https
is already there i
have not tested it but i think it's
there from android 9 and above you have
this option in the wi-fi and network
settings
so this is a screen in my mobile phone
this is what the settings are i have
cloudflare enabled onto that for
tls you need to have 1.1.1
and these are the instructions for it
you can also have 1.1 dot in the
alphanumeric way
okay
um you can go and set up dns over tls
for this
now if you want to check check your
current dns security you can just go to
this website let me show you here i
already have it up
so
so you can see it is checking and
connectivity resolver so
as name
cloudflare is it connected to 1.1.1.1
yeah
and is it using dns over https yes
let me just
disable this and see if that's actually
working or not
let's refresh this
so you can see dns over std basis no
let me just re-enable this
okay cool
now let's come to the second part of it
which is the http censoring
this has been seen in like i've been
collecting uh
network data in india through a
different a lot of different isps and
i've seen it
being done in one form or the other by
almost all of these isps because the
government mandates that some websites
need to be blocked so one in one way or
the other there is some kind of http
censoring so if you see on the screen in
the bottom side this is cloudy dot pk
it's a pakistani website
i think it hosts free movie content and
things like that so if you see here
there's this message this website has
been logged as per the order of ministry
of electronics and information
technology under it 2000
so
and if in if you see here there's a not
secure sign so it's an html website and
that's why they're able to modify the
content of the website whereas if you go
to the https version of it you would
straight away get a connection regis
connection reset packet i'll have a
screenshot of that as well
so that's what i was talking about we'll
talk about how this is happening and how
they're able to do it
so
yeah
so
how many of you have seen
why shark or know about wireshark
cool
a lot of guys
okay so wireshark is a tool that helps
you capture your raw network packets and
you can basically the thing that you see
on your browser it's the http request
but
before that there are a lot of things
that happen on the tcp ip stack and a
lot of
different kinds of what you say it's
called packets that transmit data to
make that thing happen
so this is a screenshot of it i already
have a uh let me show you i have a
wireshark
thing running
where is that
um
yep
so
let me just
cool
so
yeah
okay
so if you see these are raw packets so
from one it's starting from here and
some requests are being captured because
the your machine so it captures all the
data that is getting all the basically
network request that is being
transmitted from your device to outside
internet so that's how you see a lot of
these things there in the green one if
you see there's this get request and let
me just try to follow this so this
follow tcp stream basically what it
would do is it would just
show you that particular stream or
requests and responses for that
particular ip address and destination so
otherwise you would have a lot of data
from other places as well so if you see
in the top there's this
get request
and it's http 1.1 host is cloudy dot pk
and in the response you see http 1.1 200
okay 200 okay is the status quo when you
get a like a valid response from the
server
so everything looks fine content length
is 252.
if you see the content actual content
you can see this that
um let me show you yeah
there's this iframe which is src airtel
dot in slash dot
and then there's this 301 moved
permanently title and
the document has moved this is
so
it might get confusing that it also
shows the document has moved to this
https website so let me just tell you
what happened here
uh this
bottom part
this bottom part is the actual thing
that was being sent from the server
because it was an http website so it was
being redirected to its https version
and the way it was being
like the way it was being done was by
showing uh what you say a small http
html webpage where it was showing that
this document has moved to this
particular website which was the https
version of it
what the internet servers provider did
was it added on top of all that html
content yeah it added its own meta tag
and then iframe which shows this thing
let me show you what what's there on
this
um
i think let me just continue
so yeah this is the thing that you're
seeing and that's why you see that
you see that
message on the page when you go to
cloudy.pk
so basically in this case what happened
was the isp because it was an
unencrypted traffic so the isp was able
to determine that it's a blocked website
this is something that i have to censor
and once they figured out that okay this
is something i have to censor they added
their own iframe and basically discarded
all the html after that
so yep
so
uh you see that
one of the very basic bypasses is to use
the https version because these isps
they are usually very old technology
they don't always monitor they don't
block on all these phases so i've seen
in cases in some cases where if you go
to the https version of the website
directly you sometimes get access to it
that's not a foolproof way so i would
talk about how we can do that the other
method to bypass is you can use a vpn
which is a very common way
a lot of people would already know or
have been using it
there are places in and countries where
you can you can't use vpn like
and also there are places where if you
are using a vpn you would have to tell
the government collects all the vpn logs
so any activity that you do would be
basically monitored by the government so
their ways around it or rather methods
that you can use i would talk about it
later
i mean
so in the https connection we saw
initially that your traffic was
encrypted so you might ask yes if that
traffic is encrypted how are they gonna
block my network traffic how are they
gonna block the content that i'm seeing
so in this case
uh there's a host header that helps the
web server determine that okay this is
the particular website that the person
is trying to access and
that is what the isp also looks so
let me ask you a question so
uh you know what a web server is you
see that okay there are websites or you
might have your own website or something
like that so
you you might have seen wordpress
websites um anyone who has not seen or
who has seen a wordpress website just a
show of fans
cool
okay so do you think that each of these
websites are hosted on a different
computer or a single computer let's say
uh
two gigs of ram and 25 gb of
storage would it be sufficient for
hosting hundreds of website
i mean yep
so it's fairly common to assume that a
single web server single ip address
would be hosting multiple hundreds of
website if not right
so
how do
how does the web server determine that
okay you have given the ip address you
have given that okay i want a sim
straight dot in from this particular ip
address but how would that machine know
which website to serve because let's say
if it's an encrypted what do you say if
it's an encrypted traffic between you
and the machine the machine should know
how to encrypt that traffic because the
machine is already hosting hundreds of
website and each of these websites would
have a unique way of encrypting the
traffic that is called the key of that
particular machine or that particular
website
so
to do all this you the first request
that you send from your machine to that
particular server where you're getting
the
html page or webpage from you need to
tell that machine without encrypting
that hey i want a seamstream
and further connection would be between
me and that particular hosted website so
that is where your isp sniffs that and
gets to know that okay this is
which website this particular
person is trying to do and that is
called
uh it's called server name indication so
it's uh
extension of tls so tls is the transport
layer security which gives us the https
privilege that we have right now so the
the packet i would show you the packet
as well in the packet it's an
unencrypted packet so a lot of things
that happen in the tails initially
before
like before starting the encrypted
connection that happens over clear text
clear text meaning that happens over a
non-encrypted channel and that's where
these isps come into picture and they
try to sniff that and try to basically
block your access there
yeah this is the flow of it
so
there's a synth you don't need to
understand all that but let me just uh
take you to the important parts client
is you that's the server so there's a
syn packet that's been sent there's an
acknowledgement that comes from the
server that's with us in act packet
there's a packet here then
this is the client hello this is an
important one because this has
a lot of things yeah this also has the
server name indication thing which
mentions that okay this is the
particular host or this is the
particular website that i want from you
so it would send that packet the in
response the server would send a server
hello certificate and server hello done
the certificate is the one that would
help create the encrypted channel
between your machine and the server
so this part is the unencrypted one and
this is where your isps come into
picture
are you able to read this
[Music]
i also have this okay let me just pull
that up
okay so this is the
https version of cloudy.pk when i try to
access it in india there's this if you
see here there's this client hello
packet and this is rst or the reset
packet so reset packet happens whenever
the server wants to terminate the
connection or whenever they want to
close the connection
so yep
but this is not um
let me show you
um
rather i don't even need this one
so if you go and click on the client
hello packet and if i show you the tls
part
so
inside this
so you see a lot of extensions here this
one is a server name indication
and
you can see the host name and there's
this server name cloudy dot pk so this
is an unencrypted traffic that goes
through your isp so isp read this and
once they read it and they found that
it's in the blacklist they block this
traffic altogether and the blocking
happens by sending a reset packet
because once the connection happens they
won't be able to filter and add their
own
like this iframe that shows you a notice
so that's why they just stop the
connection any further
and that's what's it's here
post this if this goes through the
encryption happens and further they
can't be able to decrypt or add their
data into it so they just reset the
connection
oh yeah that's what's mentioned here
so now you would ask e now how do i
bypass this so the very first thing is
you can use a vpn but let's say you are
in the place where vpn is banned or if
using vpn is also a crime there are
places like that i don't know if you had
the privilege of going to those places
but
there are places where vpn is banned and
even in india recently it happened that
if you have vpn and the companies who
are operating vpn they need to have vpn
logs so i remember expressvpn they
run on
ram in in the ram vpn so they stopped
operations in india i think so i'm not
very sure but something like that
happened
so we are gonna do a diy so we are gonna
make our own vpn even simpler because
my it might be that vpn is a very
complicated stuff for a lot of people
although the other easy implementations
are one click implementation for that
but ssh is something that everyone or
every system has that so we'll be i'll
be showing you how
i have been using it for some other
purposes but i found that they can also
be used to bypass censorship
so there's this thing called ssh tunnel
what happens is you have a
vps or a virtual private server or
machine in the country which is not
censored
and you basically do an ssh connection
so you do an
ssh connection to work on that machine
or maybe get a remote access to that
machine for any reason you do an ssh
connection so that same connection can
be used to
route all of your traffic from your
machine through that country and outside
the world so basically your whole
traffic is encrypted into the ssh
connection and you are basically able to
get a censorship free internet now i
don't need to say that the downsides are
you would get us
restricted bandwidth or lower bandwidth
but still
i mean for some use cases it's good
and all you need is this ssh tunnel
command you just run it on your machine
on your terminal on your powershell on
your cmd on your mac where whatever you
are using you just need to run this
command
and it's all there i mean
if you try it it won't work because ssh
tunnel is an alias
so let me just show you how that works
so yeah so
are you able to read this
let me
so ssr10 is an alias for this and let me
show you what
so basically the command is ssh hyphen
and hyphen d
port 8080 8181 you can use any port that
you want don't use port 443 because then
it would be tampering with your traffic
hyphen f bbty i would tell you what bbty
is you would have to use something
different
the later half is just to print out the
connection whether it has been
established or not
so
let first show you what it is it would
be easier to understand so yeah this is
the actual thing uh
hyphen f after that i have used bbty
it's uh i'll show you what that is but
instead you have to use the username at
the rate ip address or the remote host
let me just quickly show you
so
um this is my configuration file
so if you see bbty is a host that i have
it's a
server that i have set up on daily
lotion so i use it for a lot of things
including
my analytics on my website so i use it
for
routing traffic so let me just quickly
show you this
[Music]
so currently my ip address is amsterdam
one five one two one seven now let me
enable this asset tunnel
so yeah this is enabled port 8081 so
8181 i have this foxy proxy uh i have
this ss tunnel here
let me refresh this so you would see
this clifton nj us now my traffic is
being routed through a u.s server and
that's where my data lotion server is
you might ask what foxy proxy is and the
thing let me just show you quickly it's
basically it creates a
sox5 proxy for ip address is one two
seven zero zero one port is 8181 you can
do the same thing by going to settings
and manually setting this up and all
that foxy proxy is an extension that
helps me easily do that by just clicking
on this and switching the proxy
whichever i want
so that's why
let's come back to this
and the vps is cheap you can get that
for as low as five dollar per month you
can use a vpn that's also cheaper
whichever way you prefer
this is setting up your own diy of your
own vpn
it's a project by
google uh it's jigsaw is the project
which makes these kinds of things where
you have
ways of open internet of freedom of
speech thing so
they have this
what you call outline
get outline is the website i have the
link here you can just click download
the software you can add the credentials
of your data lotion vps or your google
cloud vps or amazon vps and sorry amazon
machine it would set up the vps onto
that and give you an access the good
part is that you don't have to do ssh or
anything and they have mobile clients
they have
mac linux clients so you can once you
have the vps setup on that you can run
it from any of your devices you can
access it from any of your devices
there's a tool that i was using to uh
it's a golang what do you say golang
tool i have been using it and for
collecting data
it basically sends get requests to
thousands or 1500 of these websites so
i'm using citizen labs test list so
certain citizen lab is a
organization that
works for human rights and those kinds
of things so they have a test list and
they have country wide country wise
assorted list where you can get the
websites that are blocked it's not very
up to date but yeah you can still find
quite websites quite like thousands or
500 of websites for each of these
countries and all so i mostly have used
global website list and i'll show you in
a minute how we can run this
the these are the results for the cam so
these are things that it does and if you
see here
in the bottom right there's a good isp
tick so if it's a good isp if it isn't
blocking any of these so it's a good isp
it is being determined you can check in
the code it is being determined on the
basis of the dns responses so if the dns
response is one of the isps dns then
it's basically filtering that if in the
response instead of the actual website
you are getting a notice kind of thing
then it's a blocked it's a censored
website if you are getting a connection
reset so then it's a sensor like it's a
censored isp so all these things are
being taken into account let me just
show you a quick demo
uh
so
it's kindly in the debug mode so it's
basically trying to check
go to hundreds of thousands of website
and trying to get the title of it and
all those things the status quo
so it's it's a bit modular whereas you
can write your own filters there's a
yaml file filtering.ml you can like
let's say you're working because i don't
know the different kind of notices being
served in different countries so you can
add your own text string that you find
that like in india you see this website
is blocked by the department of telecom
but in your country it might be in a
german language or invite via in a
different language so in that case you
can just add it into the yaml file and
you don't have to touch the code here
i have i think made this
repo public there are few issues that
i'm working around but yeah
let's come back to this file it's
closing up
so yeah this is a summary of all these
this bypass about dna script i haven't
mentioned about it because it might be a
bit complicated and i wanted that
something a solution that everyone can
use and like if you're a reporter if
you're activated or you're a journalist
and you want to send data to your back
organization and you're working a place
where you are your all data is being
monitored you can straight away use
these
uh that's the end of it there's a
further reading i have the links if you
want to
add resources
you sleep happily
if you want wait
connect with me further and i think
that's
almost on time if you have any questions
[Music]
[Applause]
thank you asim so are there questions
from the audience please if you have a
question line up at the microphone i
think there were no questions from the
internet yes there were no questions
from the internet maybe they were
blocked i don't know so we have a
question at the microphone
thank you for your presentation i was
wondering one of the reasons you said
that
well you made this presentation is
because there are well i know american
isps that monetize from your dns traffic
and one of the suggestions you make is
to either use cloudflare or google's dns
isn't there well
part of the same problem there that they
monetize on your dna dns traffic as well
i mean uh so the way the
the these isps monetize dns is that
let's say if you have a domain name
that's not being owned by anyone so they
would redirect to an advertisement page
kind of thing but if you go on
cloudflare and google dns they just give
you
not no domain response they don't like
they don't do that so i mean that's
right
i hope that answers
well if i can elaborate
i i agree but they do
monetize on your traffic
building a profile
um
around your well dns
and therefore
um i know specialized advertisements
they serve you and stuff like that
so there's like a privacy
i get it what do you mean say
it's a bit weak because the dns traffic
is a lot and in many cases like let's
say if you are going to google a common
news website that you go so in many
cases that's already caged on the
browser so the request doesn't go again
to cloudflare or they don't go against
google's dns servers so that's why you
can have it i mean that's why it's not
part of it
thank you we have time for another quick
question and answer
okay thank you for your talk um a brief
question if i'm about to use dns over
https
and let's assume i used cloud
counselor as an operator
and as you've shown the dms address is
being put into the field uh
of choosing dns over https which
resolver is being used to resolve that
address i mean you can use even the
i thought don't ask this question
because and so you can use the isp dns
also because you are basically resolving
a public domain like a cloudflare
dns.com or google.com let's say for
example so that's not blocked because
blocking that is blocking a major part
of the internet so once that's resolved
then the request goes to that so if you
don't have like let's say if you're
using the
cloudflare iphonedns.com so that request
goes through your what you say your isp
or your local dns that's there and then
that response comes together and if
they'll fake
the address of that
dns name and provide me with a valid
certificate
will that work i mean but how do you get
the valid ssl certificate for the let's
say a google.com dns over https
we are aware of malicious
sites in which you can arrange a faked
in
https uh
certificate i mean the fake ca
certificate yeah
and then
that then that would be a bigger problem
than just the dns part
i mean
the story was like that a couple of
times already
so sorry we are running out of time
please uh do this discussion after the
talk uh no we have no time for another
question sorry
uh thank you team
for telling us how to bypass censorship
and if you have a question please come
to him and discard it with him
afterwards