There are several countries in our progressive world that apply filtering rules defined by the state — implementing censorship.

As I can suppose, ISPs are blocking websites by their IPs. Just because they can't see the URL inside the packet — it is behind the SSL/TLS.

But there is an another way of detection — SNI. It is just an optional extension, but it's now commonly used and is sent in plaintext, so we can analyze it.

So what if we sniff the packet before sending and remove or change its SNI value to some allowed server?

If this substitution going to be detected by the server as MITM and my request will be dropped? Does it affect the checksum or some other authenticity parameters?

  • 1
    URL can't be seen in a HTTPS stream? You sure about that? – schroeder Jan 25 '17 at 17:17
  • By the way, this would have far wider impact than censorship on the national level. Even corporate firewalls can block URLs and that isn't about censorship. – schroeder Jan 25 '17 at 17:24
  • @schroeder thank you for your answers! Unfortunately I live in one of such countries and blocking by IP is their most "efficient" way to block the website. DNS spoof or redirect are also used. But it was a story when just one url of the website was banned but ISPs could not determine if you're opening that specific url or just another page on this site because of SSL. So they was really blocking the whole site and others (!!) sitting on this IP. "Full DPI" in action. – ntoskrnl Jan 25 '17 at 18:19
  • The question is more about DPI itself and SNI's role in analysis - my bad questioning. For example, there are mobile operators that offer unlimited data for specific apps, so here is where this technique possibly can be used. – ntoskrnl Jan 25 '17 at 18:32

It would be simple to rewrite the packets, and I'm not sure how the server would respond to an SNI for a domain that didn't exist on the server, but I don't think it matters, because it's not going to be an effective method.

You are under the assumption that only the IP is blocked. This is not correct. You are also assuming that TLS integrity is maintained in these countries. It is not. And you are assuming that you can't see the domain name in a HTTPS stream. This is also not correct.

You have also forgotten about DNS. To get to a domain, you need to look it up. A censoring country would control DNS, and control what domains you can look up.

So, while SNI spoofing might be interesting, it's not where a solution would reside.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.