OpenVPN is Open to VPN Fingerprinting

[Snowsuit8087 4]

I wanted to share an interesting presentation I read recently regarding VPNs in VPN-hostile regions. 

Abstract: 
VPN adoption has seen steady growth over the past decade due to increased public awareness of privacy and surveillance threats. In response, certain governments are attempting to restrict VPN access by identifying connections using "dual use" DPI technology. To investigate the potential for VPN blocking, we develop mechanisms for accurately fingerprinting connections using OpenVPN, the most popular protocol for commercial VPN services. We identify three fingerprints based on protocol features such as byte pattern, packet size, and server response. Playing the role of an attacker who controls the network, we design a two-phase framework that performs passive fingerprinting and active probing in sequence. We evaluate our framework in partnership with a million-user ISP and find that we identify over 85% of OpenVPN flows with only negligible false positives, suggesting that OpenVPN-based services can be effectively blocked with little collateral damage. Although some commercial VPNs implement countermeasures to avoid detection, our framework successfully identified connections to 34 out of 41 "obfuscated" VPN configurations. We discuss the implications of the VPN fingerprintability for different threat models and propose short-term defenses. In the longer term, we urge commercial VPN providers to be more transparent about their obfuscation approaches and to adopt more principled detection countermeasures, such as those developed in censorship circumvention research.

Presentation:
https://www.usenix.org/conference/usenixsecurity22/presentation/xue-diwen

Paper:
https://www.usenix.org/system/files/sec22-xue-diwen.pdf

[Staff 9771]

Hello!

The paper re-launches the anti-censorship abilities of OpenVPN over SSH which we proposed 13 years ago! It had a filter rate of 0.32, the third best outcome in the world, very remarkable and putting AirVPN in the top 3 worldwide best filtering escaping VPN. As usual we anyway recommend Tor with private obfs bridges to reach filter rates next to 0. We have invested a lot on Tor and the solution is free for everyone. In Iran and Russia Tor obfs and private bridges are instrumental against blocks.

Kind regards
 

[rx_man123 6]

Don't even get me started on browser GPU fingerprinting!

[Stalinium 44]

Imho boring. The Chinese circumvention crowd is ahead of such papers by a decade, without writing any such papers. Apparently, during the hardest enablement days, the Chinese state DPI will make out any type of VPN traffic based on unusually high entropy while avoiding false-positives with regular TLS traffic etc. Not to mention traffic behavior and other details. Similarly in the worst case, SSH traffic can be cut down on too (even without behavioral detection) to the point of making VPN-over-SSH unusable, heavy throttling to only make remote management work.
Tor's newest obfs is the only state of the art alternative to the many developments of the broader Chinese community. Don't get me wrong, it's actually good.