@inproceedings{a7591ac66bac41d0aa7d155edeefe83d,
title = "DNS-Morph: UDP-Based Bootstrapping Protocol for Tor",
abstract = "Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users{\textquoteright} ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor{\textquoteright}s traffic flow. In this paper we introduce a new approach aiming to enhance the PT{\textquoteright}s resistance against active probing attacks, as well as white-listing censorship by partitioning the handshake of the PT from its encrypted communication. Thus, allowing mixing different PTs, e.g., ScrambleSuit for the handshake and FTE for the traffic itself. We claim that this separation reduces the possibility of marking Tor related communications. To illustrate our claim, we introduce DNS-Morph: a new method of transforming the handshake data of a PT by imitating a sequence of DNS queries and responses. Using DNS-Morph, the Tor client acts as a DNS client which sends DNS queries to the Tor bridge, and receives DNS responses from it. We implemented and successfully tested DNS-Morph using one of the PTs (ScrambleSuit), and verified its capabilities.",
keywords = "Bootstrapping, Bridge, Censorship, Circumvention, DNS, Pluggable Transport, Tor, UDP",
author = "Rami Ailabouni and Orr Dunkelman and Sara Bitan",
note = "Publisher Copyright: {\textcopyright} 2021, Springer Nature Switzerland AG.; 5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021 ; Conference date: 08-07-2021 Through 09-07-2021",
year = "2021",
doi = "10.1007/978-3-030-78086-9_19",
language = "American English",
isbn = "9783030780852",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Science and Business Media Deutschland GmbH",
pages = "244--265",
editor = "Shlomi Dolev and Oded Margalit and Benny Pinkas and Alexander Schwarzmann",
booktitle = "Cyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings",
address = "Germany",
}