Slashdot Log In
Encrypted Traffic No Longer Safe From Throttling
Posted by
CmdrTaco
on Mon Jun 30, 2008 07:23 AM
from the didn't-think-it-was dept.
from the didn't-think-it-was dept.
coderrr writes "New research could allow ISPs to selectively block or slow down your encrypted traffic even if they cannot snoop on your transmitted data. Italian researchers have found a way to categorize the type of traffic that is hidden inside an encrypted SSH session to around 90% accuracy. They are achieving this by analyzing packet sizes and inter-packet intervals instead of looking at the content itself. Challenges remain for ISPs to implement this technology, but it's clear that encrypting your traffic inside an SSH session or VPN connection is not a solution to protect net neutrality."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Er, no. (Score:5, Informative)
First, encrypted traffic was never safe from throttling anyway. Second, FTA:
"So it seems the use of a tool like this would be limited to an extremely controlled environment where users are limited to a white-list set of network protocols (so that they can't use a different tunneling mechanism, stunnel for example) and only allowed to ssh to servers under the control of the censoring party. In which case you would wonder why the admin wouldn't just set the ssh server's AllowTcpForwarding option to false."
Kinda useless.
Non-timing critical? (Score:3, Interesting)
If the application is not time-critical, introducing random jitter would go some way to subverting this, no?
Re:Non-timing critical? (Score:5, Interesting)
> introducing random jitter would go some way to subverting this, no?
Exactly. I took a few minutes to glance over the paper. Their feature
extraction stage consists of two predictable attributes: packet size
and time between packets. Modifying the traffic sent at the
application layer (SSH itself does not even need to be touched) can
trivially ambiguate the extracted features so as to throw off the
classification attempt. This is simply a road bump; as soon as it gets
into use, application-layer proxies will pop up to circumvent it.
They also seemed to have inventented their own home-brew statistical
analysis. I was disappointed that they did not go into detail as to
why they largely ignored the entire field of Machine Learning
(NaiveBayes? Perceptron? kNN? Why not try using these?) when coming up
with their classification model.
Parent
Why would they do it? (Score:5, Insightful)
Re:Why would they do it? (Score:4, Interesting)
No, it's not. But it could be a defense with the FCC/Congress or other regulatory agencies. Just wait until some Congresscritter can't VPN back into his office because of a policy like this -- that's when attention will start being paid to these issues.
Kind of like how nobody in power gave a shit about the Gestapo^WTSA until some Congressman/Senator had to take HIS shoes off or found HIMSELF on the no fly list.
Parent
Would have happened anyway. (Score:5, Insightful)
Even without this analysis it was kinda obvious that throttle-happy ISPs would simply throttle all encrypted data once encrypting became mainstream in P2P.
Re:Would have happened anyway. (Score:5, Insightful)
What about VPN tunnels? People working from home are a core customer group they don't want to piss off.
Parent
Re:Would have happened anyway. (Score:5, Insightful)
those people will be more obliged to pay the ridiculously jacked up business internet prices, then, i suppose.
Parent
Re: (Score:3, Insightful)
I'm just saying that restricting the majority of encrypted traffic will have no effect on the people who actually need the traffic for their job. The ISP will probably consider it a perk that they've manufactured a new "feature" for their business internet package: We don't renege on our contract.
Re:Would have happened anyway. (Score:4, Interesting)
1. Not always true, depends on your provider. Having had various consumer and business packages in the past, most ISPs only push you to a business package if you:
a. Want a static IP
b. Want to run any kind of server
2. In the age of 20mbps consumer connections there is no need for someone who just needs legitimate heavier usage of the connection to not use it. I transfer 100's of gigs a month to and from datacenters around the country for my job. Granted I can get my company to help subsidize that but if I found out my ISP was throttling me I would more than likely take my business elsewhere. I would rather have my company pay for an expensive business package with another provider than give more money to a provider that actively wants to screw me over.
Contractors have an even bigger problem as they don't get their connections subsidized (trust me the tax refund isn't much).
So far my ISP has been pretty good, I called about bandwidth issues once or twice and when asked if I was downloading movies I explained to them what I do. When the rep realizes your just another guy trying to do his job you get all sorts of help.
Parent
Re:Would have happened anyway. (Score:5, Interesting)
Actually, encrypted or not, the way the Sandvine (I think that was the name?) system used by Comcast worked was it just did a traffic analysis - If your upload connection was more than X% saturated for N seconds, the Sandvine appliance would start spoofed RST injection to kill off connections. The only way around this would be a full blown VPN that used an encrypted transport layer. (Encrypted BitTorrent, SSH, and nearly all encrypted protocols except the various VPN systems are an encrypted application stream over an unencrypted TCP session. Even some VPNs use an unencrypted TCP session to tunnel through, making them vulnerable to RST injection.)
Parent
Look, this is a dead end. (Score:5, Insightful)
You can identify the type of traffic, because we're not trying very hard to hide it. If you keep going down this road, we'll just send all the time, the same constant packet size, the same rate, regardless of actually required service. It's the same to us, really, because we pay a flat price. It is not the same to you, though, because when we have to make every traffic look the same, we'll use much more of your precious bandwidth, so cut out the crap.
Re:Look, this is a dead end. (Score:5, Interesting)
Actually, strange you should suggest this, I was working on a small and rather generic package to tunnel data between hosts in this very way, constant rate/constant packet size tunneling, with empty data filled with random noise, and with non-packet-aligned encrypted data overlayed when there is data to actually send. I was going to call it tstunnel. Yes, it is somewhat of an extreme response to an extreme problem.
Parent
Re:Look, this is a dead end. (Score:5, Funny)
Dear customer,
Thank you for your comments. We regret that because it makes no business sense to continue providing an unlimited bandwidth service, we will be discontinuing this offering from next month. Current subscribers may transfer to our metered service with no disruption. This service is commercially viable and we expect it to remain so, and most users will find the metered service significantly cheaper as they will no longer be subsidising a small minority of heavy users.
At your current usage rates, we estimate that your own monthly bill on the metered service would be approximately:
$1,764.38
Please note that this figure is an estimate based on your current usage level, and may go down or up depending on your future usage patterns.
Best wishes,
Your ISP
Parent
Re:Look, this is a dead end. (Score:5, Interesting)
Parent
This will backfire (Score:5, Insightful)
All its going to do is encourage P2P developers to try (and they will likely succeed) to make P2P traffic look more like other traffic. Want your bittorent to look more like encrypted telnet? Easy send tons of tiny packets and take a short break every few seconds. All this is going to do is increase the packet overhead the ISPs see. That same overhead will also hurt P2P end users but unless its more then the throttle does they will do it anyone. Its a loose loose situation really. They ISPs should realize they gain nothing going down this path.
Re:This will backfire (Score:5, Funny)
Its a loose loose situation really
That sounds very loose. How loose can you get?
Parent
Re:This will backfire (Score:5, Funny)
Its a loose loose situation really
That sounds very loose. How loose can you get?
i dunno. ask goatse.
Parent
Re:This will backfire (Score:5, Insightful)
Parent
Or they can just be lazy and save money (Score:3, Insightful)
And throttle all encrypted traffic over whatever an IP phone or VPN connection would use on assumption of file-sharing. They don't give a rat's ass what you are doing, really, they just want a reason to throttle you and this company just makes money by giving them one.
Next move... (Score:4, Insightful)
Well, the next move would simply be some tool, or modification to bittorrent, that makes the traffic patterns look like that of other protocols. While I'm sure it would have some impact upon performance, surely torrent packets can be make to look pretty damn similar to a bunch of HTTPS images being loaded on a web page (or something along those lines). Just like DRM, each move like this isn't solving any problem, just slowing things down, while a counter-move is made. (Or, another provider is chosen who doesn't throttle traffic, competition permitting.)
They can already throttle encrypted traffic. (Score:5, Informative)
Could be worse. Rogers and Bell, here in Canada, just throttle ALL encrypted traffic.
Re:They can already throttle encrypted traffic. (Score:5, Interesting)
You'd think that's how they're doing it, but it doesn't seem to be the case. Rogers customer here, and my SFTP (FTP over SSH) connections go at full-tilt, while BitTorrent has slowed down to a crawl (0-1 KB/sec) on my connection in the past (yes, using the latest uTorrent/Azureus Vuze client, with standard BT MSE/PE encryption enabled).
I don't know what's going on, but I suspect they've already figured out something that these Italian guys are researching now, and they've been able to identify BitTorrent from other encrypted traffic.
Parent
Re:They can already throttle encrypted traffic. (Score:5, Insightful)
Parent
Italian researchers have also found a way to... (Score:4, Funny)
Re: Italian researchers have also found a way to.. (Score:4, Funny)
Yeah but that's a cheat owing to the tubes. See, they route all traffic through a huge green pipe and listen for the "Gew gew gew" noise that signals the presence of a Mario Brother.
Why would an ISP do Deep Mario Brother Inspection, I hear you ask? Well if you remember, those depths were filled with coins! There's no depth an ISP won't go in order to get those.
Parent
Re: (Score:3, Informative)
Mario Brothers would never be in the packets, as they travel through pipes, not tubes. :-)
The security hole will soon get fixed (Score:5, Interesting)
And in the next (or two) release of SSH implementations, this weakness will, no doubt, be fixed.
Professional cryptographers have known for decades that you don't just switch on your transmitter when you want to send a secret message - no matter how well encrypted it is. The mere fact of traffic is frequently a sizeable tell-tale itself. Instead, you keep your transmitter on 24*7 sending encrypted garbage, with the ability to interleave genuine messages when the need arises. I'm sure that in a short time, the SSH people will remove the ability to profile the transmission to glean anything usable from it.
Re:The security hole will soon get fixed (Score:4, Interesting)
Parent
Comparison to copy protection schemes (Score:4, Insightful)
Attempts to analyze (and then throttle) Internet traffic reminds me of copy protection schemes. The schemes get more and more complicated (and costly) and at every turn the user gets more sophisticated in his or her attempts to get around the protection. ISPs would be wise to look at the music, movie, and in particular video game industries and realize that there are many, many more users who wish to use P2P software than there are ISP engineers who wish to throttle said users, and that it will always be a losing battle.
Personally, I think the granularity of the ISP payment schemes need to be increased. We pay for cell phone minutes in blocks of 100 or so (or by the minute, depending on your plan); we pay for electricity by the kWH, we pay for water by the gallon (or liter), and so on... why not pay for bandwidth by the Mb? In a perfect world (yeah, well, one can dream!) this would mean reduced costs for the average home Internet user, as most people aren't using anywhere close to what is available, and maybe slightly increased costs for people like me. But then at the same time throttling is no longer an issue. Of course in reality this is unlikely to happen any time soon; why charge responsible, realistic rates when you could charge a flat fee and then just block any traffic you don't like with increasingly expensive technology (and pass the cost on to your monthly subscribers, of course)?
ISPs, learn from the "War on Copyright Violation" - you won't win this battle; give it up and fix the underlying problem.
A Few Misunderstandings for Many (Score:4, Interesting)
Okay, before everyone starts their throttling engines for war please remember the following:
A: ISP's are not throttling data because of bandwidth, they are throttling because of latency. If you do not understand the difference, here is a simple way to look at it
A router can handle a million packets a second let say. Wether the packet is a size of 10 or a size of 1000 it still can only handle a million packets. Bandwidth is how many seats on the bus (or if all the buses had the same number of seats, how many lanes on the road), latency is how fast the bus is going. A router it a toll gate. Too many buses, regardless of how many seats, will bog down the toll gate. P2P is very chatty in the number of packets and depending on how it sliced the data, lots of big chunks, or a whole hella lot of small chunks. Either way the guy working the toll gate is going to go postal at some point.
B: Encryption, your rights online, data type, freedom, and all of that supurious crap we like to toss around means nothing when: "You sign a contract." While I am not a lawyer I am an informed customer (I read the small print). When you sign up for Internet service, regardless of what you feel, or in fact what your rights are, you can and do sign most of those away when you sign up for a commerical service. If they say that you cannot encrypt your P2P traffic and you do; thus losing your service... that is more then acceptable under most nations idea of contract law. You have no right to privacy if you sign a contract that gives them the right to look.
Keeping A & B in mind please feel free to march forward with your discussions but, the most important thing to remember, is point A. Telling people there is plenty of bandwidth has LITTLE IF ANYTHING to do with throttling as far as I can tell. I watched 3 hearing on CSPAN and not one rep from the big three telecoms mentioned BANDWIDTH as a reason, but I did hear 18 engineers talk about routers, MTU initiated fragments, and total packets per second capacities on core routers, and I did keep count of bandwidth vs. latency.
Bandwidth Mentioned: 34 times
Latency: 400+ times (I ran out of chicken scratch space on the page and gave up...)
Now I admit I did doze off after 30 minutes of an engineer trying to explain to a senate committee the difference between TCP and UDP but I am human after all.
Now certainly there is some complexity in latency and bandwidth in how they are related and from what I have heard fiber does take care of a lot of the latency issues (signal to noise ratio seemed to be a big talking point from some AT&T engiee who looked like Dracula) so feel free to toss that into the discussions.
But seriously, this whole filtering stuff has nothing to do with bandwith, so please, please, please, stop with the bad 3rd party reporting. We have already seen on /. that the ISPs aren't hurting for bandwidth.
Getting accurate information from the mainstream press on Internet filtering is like asking a caveman to fix your car... all he's gonna do is smash it with a rock.
Re:A Few Misunderstandings for Many (Score:4, Informative)
What you said about the problem being latency, is a little bit hard to swallow given that the core of most ISPs runs multi-terabit routers.
The fact of the matter is that not only have router CPUs increased in power exponentially, but also core router technology, has advanced to implement caching such as CEF (Cisco Express Forwarding), and build into regular router blades additional CPUs such as DCEF (distributed CEF), etc.
Case in point, core routers these days have SO much spare processing power that most routing cores run VRF (virtual routing and forwarding), which allows a single physical router to VIRTUALLY pose as if it is 100 or even 1,000 different routers, all inside the same box.
And further, the total throughput capacity of these routing processors today is measured in the TERABITS. The latest Cisco router can process some 15 Terabits of traffic in a single box. Even if packet sizes were inneficient, you're still looking at 1+ Terabits of throughput... which is many many many OC192s (10Gigabit Sonet rings).
So don't tell me we're hitting router processing capacity, because that's a complete joke, and if that were the case, Bell Canada would have been smart and presented that info right up front to the courts (they're currently being asked to justify why they throttle their end-users).
I think what it actually may come down to is peering costs with other ISPs... which for the most part isn't a problem for the biggest players which are Tier 1 providers. Tier1 here is defined as a Telco/ISP that is so big (i.e. AT&T) that all other providers pay THEM for packets to traverse their network, and they in fact don't pay anyone or their peering costs are way lower than their peering income.
So Tier1's aside, yes I can see ISPs having to fork out significant $$ for bandwidth per month, and of course torrent freaks doing 200+ GigaBytes/month are costing them significant money.
just my $2.22 cents,
Adeptus
Parent
"Go ahead... make my day!" (Score:3, Interesting)
You'd think those ISPs *cough* Shaw Cable *cough* would have learned the lesson by now. That lesson should have been wastin... I mean spending, MILLIONS and MILLIONS on products like Sandvine to try to throttle bittorrent only to find out a few months later people were bypassing it with encryption.
So now some Italians can identify prediction based on packet size etc... watch ISPs spend many more Millions implementing this, then the torrent client software guys simply change 10 lines of code, recompile and voila... Millions down the drain for ISPs!
So go ahead, make my day! Just don't try to pass off those costs in your monthly bills to me.
Adeptus
Illegal? (Score:3, Interesting)
Re:Correction... (Score:5, Insightful)
Not really, they're providers of the medium and have no business limiting or snooping the datat that goes through their network especially since they were often granted a monopoly over building infrastructure in their area.
Parent
Another Correction... (Score:5, Insightful)
Not a solution to defeat ISPs attempts to control what's going through the government-funded, monopoly-protected, public-land-using network.
You're right, facts do change the interpretation.
Parent
Re:Correction... (Score:4, Insightful)
Do you understand that ISPs are not exactly charity organizations, don't you? I am paying for their service and I expect it to work as it was advertised in their offer.
Parent
Re:Correction... (Score:5, Insightful)
If these policies where openly documented, and there where truly free competition, I'd agree with you; let the market sort it out.
That typically isn't the case. First, these policies are rarely documented at all, and if they are, it's in language so vague as to make it useless for purposes of comparing one ISP to another. ("We may, at our discretion, at various times, perform adjustments to packet-priority")
Free competition is also the exception rather than the rule. A huge fraction of end-user-lines where built by telcos acting as a government-granted monopoly, and then they somehow got to keep a large piece of this after the monopolies are no longer in principle monopolies. Which means in many areas they are still in -practice- pretty close to monopolies.
And even where they're not, competition is low and that will remain so. Few people have more than 2, perhaps 3 physical cables coming in that are suitable for broadband. (many have a twisted-pair copper that used to be for POTS and a coax that used to be for analogue-cable, and that's it, extra bonus if the old monopolist owns the tv-cable in your area!)
This ain't gonna change. A single modern cable has moder than enough capacity for all needs, so it's not economically sensible to have a large number of competitive cable-networks.
Really, last-mile networks should be owned and run by the neighbourhoods, or failing that atleast be considered infrastructure, really today a working broadband-connection is basic infrastructure like electric power, water, sewage and roads. (it's not -equally- crucial as those, but it's crucial nevertheless, I doubt a house with -no- telecom-connection of any sort would find many buyers)
Wireless changes the picture a bit, for low-bandwith applications. But only a bit. The problem is that the RF-spectrum is fundamentally shared, thus it will not be possible to deliver the same speeds and reliability as is possible on physical cable. (a single single-mode fibre easily supports speeds up atleast a Tbps or thereabouts which is more than most people need for the next few decades)
Parent
Re:Correction... (Score:4, Interesting)
The ultimate solution would be to ban last-mile owners from providing any services at all. No voice, no video, no data. They exist to provide copper and/or fiber to subscriber premises, and to operate central offices as colocation facilities. That's all. Nothing else.
Then, anyone who wants to provide services, simply colocates their head end equipment at the central offices in areas where they wish to provide service. At that point it doesn't matter whether they're offering video, voice, data, local or long distance, Internet or private lines, it just doesn't matter because the central office is shared between as many providers as will fit in the building.
We need to separate the last mile land-use monopoly from the services being provided. There should be no such thing as an ILEC.
Parent
Re:Correction... (Score:5, Insightful)
Not a solution to defeat ISPs attempts to control, what's going through networks they constructed with large sums of both public and private money they mortgaged against providing a service to their customers, not fighting against them.
Yup, sure do.
Parent
Re:Correction... (Score:4, Insightful)
Funny, when I began using their service they never told me they would throttle certain protocols. They said they'd give me access to the internet at certain speeds to the best of their ability. Throttling packets seemed to be significantly below their best.
Parent
Re:Why bother? (Score:5, Insightful)
Anyway it doesn't take a genius to detect p2p.
See the user. See the user after 1 hour. See how many bytes up and down. Check how many different IP destinations the user is connected with.
If they are downloading a lot up and down, and connected to lots of host, chances are they are using P2P. Put them on a watch list. If they are still doing it much later, you put them on a black list where from then on if they are doing something similar you throttle them immediately (you can do it in a way that would in most cases still allow that user's web surfing to work reasonably - since most users don't websurf 20 different sites at the same time AND read those pages at the same time - it doesn't matter if pages come in one by one ).
If they aren't downloading or uploading much, why throttle?
No need for fancy math. No need for "deep packet inspection" or fancy "Dumb Investors Hand Over Your Money" phrases.
Then again maybe I should write a "research" paper, mmm $$$$
Parent
Re:Why bother? (Score:5, Interesting)
Parent
Re: (Score:3, Informative)
Go look at the traffic if you don't believe me. I've monitored the traffic on my connection as I play various online games - but not Xbox Live though.
In theory the server might get throttled affecting the game BUT online game traffic seldom adds up to gigabytes a day - all you are usually sending is "changes in state". In some cases yes game assets do get downloaded - but the clients seldom upload that much bac
Re:Why bother? (Score:4, Insightful)
If bittorrent users looked like RTS game players there won't be much traffic to throttle.
For example it seems like it's 24kbps per opponent for Supreme Commander. So 20 opponents won't even saturate a 512kbps upstream.
Do many people play Supreme Commander with 40 opponents at a time and expect good performance?
Parent
Re:Why bother? (Score:4, Funny)
I doubt those games even hit 1Mbps up and down sustained for more than even 1 minute :).
So, just like normal peer to peer services then? ;)
I think the most opponents SupCom supports are 8; those 8 can be on a very large map, with thousands of units each, and each round from each unit tracked, though.
Parent
Re:Why bother? (Score:5, Informative)
how would this work for gaming online? 16 different IP destinations and I play for hours on in. My understanding of Xbox Live is that it is P2P and if they throttle my Halo 3 game, I'm gonna get pwned even more than normal.
I totally agree. Steam creates a lot of connections to various content servers to bring down content faster for the Steam Client. It also creates a shitload of traffic when you refresh the server list via Steam Clinet > Servers Tab. The Steam Client is also P2P by definition.
Now this type of throttling would piss me off greatly.
Parent
Re:Why bother? (Score:4, Interesting)
My ISP already throttles my connection by price. I've currently got 256/768 as that suits my needs. If they were to start throttling any more of my net access (I'm paying for unlimited at 256/768) I'd have their asses in court in a hurry for false advertising and violation of contract, which I have kept the hard copy of from the day I signed up for service.
I was one of the first adopters to get broadband when it became available 6 years ago in my area and according to the original contract (have hardcopy on file) they planned offering tierred service with it being a simple change in minimum speeds and thus not requiring a new contract. I also informed them that I'm worse then a squeaky wheel, I'm like a brake that's gone metal to metal since I'm semi-retired and disabled with plenty of time on my hands to pursue things every time they try to change my contract without consent.
Parent
Re:Why bother? (Score:5, Interesting)
2) Those plugins that do "fetch ahead" tend to stick to fetching from the same few sites - they may make lots of connections but they are to the same few sites (ad webserver, content webserver, icon/widget server etc), and they stop at some point - otherwise your browser would be downloading the entire internet (and AFAIK they don't do that). And really they definitely don't upload much.
Personally I think the US ISPs are scumbags not because they throttle, but because it seems they took USD 200 billion and promised to deliver 45Mbps up/down.
But after taking that 200 billion, more than ten years later their users have still only got DSL and cable, and they're getting throttled.
Too bad most of the users don't appear to know how screwed they really got. They should ask for the ISPs to build the infrastructure NOW.
But I suppose given a big enough crime, you are more likely to get away with it
Cheat one person of money and it's jail time. Cheat 10 people and it's longer jail time. Cheat 100000 people, and you become a rich CEO and the board gives you a big fat bonus.
Kill one person you get a life sentence or death row. Kill 20 people, people start asking for you to be executed. Get thousands of people killed, who knows you might get elected president
Parent
Re:Why bother? (Score:5, Insightful)
Mark my words,they are talking about congestion now,but if they kill off P2P and turn the country into a tiered network,you'll see us end up back with the walled gardens of AOL and Compuserve. Any videos except those hosted(and generating revenue for) your ISP will count against your cap. Any VoIP or other service that isn't run by(and generating money for) your ISP will count against your cap. And they will make the cap so low that unless all you do is surf websites(and you probably want to think about blocking those flash ads while you are at it) then you are going to smack into the cap,and get to pay $1 per Gb. Unless of course you stick with what the ISP offers you,which will of course not count against your cap. Instant lock in,just add congress critters to block that nasty net neutrality. But as always this is my 02c,YMMV
Parent