Original subtitles

1

Tor pluggable transport's and of frustration of traffic if you are stuck behind a firewall or a search

2

device such as the one here on the diagram that blocks pulls you may need to use relays that are open

3

on port 80 and 443 or whatever ports are allowed by that device that is blocking you usually port 80

4

and 443 are allowed as that is web traffic.

5

And if you want to configure your TOR browser to go through a special port to get through that blocking

6

device you need to go here Tor network settings and we want to go to this computer goes through a firewall

7

that only allows connections to certain ports and then you want to specify the ports here and click

8

OK.

9

There are less relays that run on specific ports.

10

So you may have trouble with your network connection if you specify some strange or unusual port but

11

18:4 4:03 should be OK.

12

But it may be slower.

13

Another way that Torres blocks is through deep packet inspection or DP and active network analysis.

14

This is because it's possible to identify ordinary Tor traffic based on byte patterns that appear in

15

it.

16

DPMI is probably Tor's greatest nemesis for blocking Tor.

17

In fact DPR is the best defense for anyone trying to stop traffic that they don't want a number of countries

18

are using.

19

Deepak inspection GPI to classify Internet traffic flows by protocol.

20

For example in 2011 the Great Firewall of China developed the ability to actively detect Tor Tor users

21

bridge relays to get around a sensor that blocks known relays IP addresses.

22

But a sensor that uses deep pack inspection to recognize and filter Tor traffic flows can if they see

23

the traffic the Tor traffic block the connection standard toll bridges don't solve this problem.

24

Bought something called pluggable transport's attempt to mitigate the blocking of toll through the packet

25

inspection.

26

Transports transformed the Tor traffic flow between the client and the bridge.

27

If you see here this is what ordinary Tor traffic looks like.

28

This is what all traffic looks like when it has been put through a pluggable transport.

29

In this case it's the Avs to pluggable transport.

30

And this is the AABs three pluggable transport.

31

The traffic signature or fingerprint is changed from the ordinary Tor traffic to something else based

32

on the pluggable transport.

33

This way censors who monitor traffic between the client and the bridge will see innocent looking transform

34

traffic instead of the actual Tor traffic.

35

External programs can talk to talk clients and toll bridges using the pluggable transport API to make

36

it easier to build interoperable programs.

37

And here are some of luggable transports jobs proxy flash proxy F.T. scrambles Swee me.

38

Obs for some transports trying to make the traffic look like another protocol and others try to make

39

it look random and some transports are aimed at evading IP based blocks rather than content based blocks

40

.

41

So there's pluggable transport sounds cool.

42

How do we can figure out browser to use pluggable transport's here.

43

Tor network settings and select my internet service provider ISP blocks connections to the Tor network

44

then select connect with provided bridges and there you have your different pluggable transport's the

45

pluggable transport must be supported by the bridge or relays that you connect to no one transport will

46

solve the problem.

47

The transports need to be variable and evolve as detection evolves.

48

They need to look plausible but extra scrutiny by sensor will likely reveal what it is.

49

But the idea is to get past the initial scrutiny.

50

You could set a pluggable transfer on your own bridge and for example if you look here weve got meek

51

.

52

Amazon Meeke Google.

53

If you were to use that this would look like you are connecting to Google and on and or Amazon.

54

The idea here is that the sensor will find it hard to block the IP address associated with Amazon and

55

Amazon services because obviously this is used by that company and it will be used for non Tor use as

56

well which means wholesale blocking of those IP addresses could be a problem for the user community

57

that the sensor is serving where you can see here is ordinary Tor.

58

And this is a hex dump of the first thing that our client sends to it.

59

And you know it's a tier less client hello message as the outer layer of the Tor protocol is in fact

60

TLR.

61

Here you can see the safest list in blue.

62

The server name in green and the T.L. as extensions in this brown color.

63

This is a de-code from Wireshark.

64

This does not look the same as say Firefox or chrome connecting to a Web site via Haiti CPS using TLR

65

.

66

Which is why deep packet inspection can tell you are using Tor or is one method by which Deepak inspection

67

can tell that you are using Tor.

68

And here on the left we can see a client.

69

Hello.

70

Using the pulley will transport Meek.

71

And on the right we can see a client hello of chrome 33 on Mac OSX.

72

Is trying to pretend to look the same or at least similar enough so that DPMI doesn't flag it as being

73

a problem as we can see one of the big differences is that Chrome is supporting 20 ciphers suites and

74

me only 13.

75

So it's these sort of differences that somebody using the API.

76

And even with pluggable transports with closer examination they can tell that something is amiss.

77

It is an OPSEC principle to be on.

78

Interesting.

79

And using anonymous bridges with a pro-global transport could make you on interesting on till the traffic

80

is analyzed then you become more interesting.

81

If getting caught for using Tor has serious consequences.

82

Toll bridges and pluggable transports are not recommended.

83

They are only short term work arounds and any adversary sophistication will identify that you are using

84

them.

85

If they start to pay closer examination to the traffic as I have illustrated other options to bypass

86

toll being blocked which might be safer include tunneling tore through all the privacy and anonymity

87

services.

88

As I've already said like VPN is nested VPN is S-sh.

89

Assuming they are allowed or they are viable where you are or using offsite locations or potentially

90

mobile communication all of which rediscuss in it's own section