0

There are several countries in our progressive world that apply filtering rules defined by the state — implementing censorship.

As I can suppose, ISPs are blocking websites by their IPs. Just because they can't see the URL inside the packet — it is behind the SSL/TLS.

But there is an another way of detection — SNI. It is just an optional extension, but it's now commonly used and is sent in plaintext, so we can analyze it.

So what if we sniff the packet before sending and remove or change its SNI value to some allowed server?

If this substitution going to be detected by the server as MITM and my request will be dropped? Does it affect the checksum or some other authenticity parameters?

5
  • 1
    URL can't be seen in a HTTPS stream? You sure about that?
    – schroeder
    Commented Jan 25, 2017 at 17:17
  • security.stackexchange.com/questions/7705/…
    – schroeder
    Commented Jan 25, 2017 at 17:20
  • By the way, this would have far wider impact than censorship on the national level. Even corporate firewalls can block URLs and that isn't about censorship.
    – schroeder
    Commented Jan 25, 2017 at 17:24
  • @schroeder thank you for your answers! Unfortunately I live in one of such countries and blocking by IP is their most "efficient" way to block the website. DNS spoof or redirect are also used. But it was a story when just one url of the website was banned but ISPs could not determine if you're opening that specific url or just another page on this site because of SSL. So they was really blocking the whole site and others (!!) sitting on this IP. "Full DPI" in action.
    – ntoskrnl
    Commented Jan 25, 2017 at 18:19
  • The question is more about DPI itself and SNI's role in analysis - my bad questioning. For example, there are mobile operators that offer unlimited data for specific apps, so here is where this technique possibly can be used.
    – ntoskrnl
    Commented Jan 25, 2017 at 18:32

1 Answer 1

2

It would be simple to rewrite the packets, and I'm not sure how the server would respond to an SNI for a domain that didn't exist on the server, but I don't think it matters, because it's not going to be an effective method.

You are under the assumption that only the IP is blocked. This is not correct. You are also assuming that TLS integrity is maintained in these countries. It is not. And you are assuming that you can't see the domain name in a HTTPS stream. This is also not correct.

You have also forgotten about DNS. To get to a domain, you need to look it up. A censoring country would control DNS, and control what domains you can look up.

So, while SNI spoofing might be interesting, it's not where a solution would reside.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .