The Geneva project is developing an engine for automating the circumvention of traffic censorship.

Researchers from the University of Maryland, as part of a project Geneva attempted to create a framework for automating the identification of methods used to censor access to content. Manually trying to sift through potential gaps in Deep Packet Inspection (DPI) systems is quite a difficult and lengthy process, while in Geneva they attempted to use a genetic algorithm to evaluate the features of DPI, identify implementation flaws, and develop an optimal bypass strategy on the client side. The project code is is written written in Python.

The DPI equipment used for blocking has its own shortcomings, allowing for the concealment of access to prohibited resources or avoidance of blocking. For instance, in the simplest case of implementing blocking through the substitution of a fake response (used by passive DPI), it is sufficient on the client side to discard the fake response sent by the DPI. In the case of active DPI, one could attempt to hide the very fact of accessing a blocked site by slightly altering the HTTP request parameters (for example, by adding an extra space after "GET"), splitting the TLS handshake data into several packets, or performing TCB Teardown and TCB Desync attacks. The essence of the mentioned attacks lies in sending a fake packet with data or RST/ACK flags initially, which is not received by the target host, but is caught by the DPI, leading it to make a decision and not analyze the subsequent packet with the actual request (for example, in the initial fake packet another SNI can be specified, and to hide this packet from the target host, a low TTL can be set, along with an incorrect checksum, flags, or TCP sequence number).

Geneva tries develop a working method for bypassing DPI, using four basic primitives for manipulating network packets — dropping, header modification, duplication, and fragmentation. For optimal strategy selection, a genetic algorithm is employed, simulating processes akin to natural selection through random combinations of various manipulation options for the packets. Ultimately, the primitives are combined into an "action tree", defining the algorithm for bypassing DPI.

align=top

The Geneva tool has successfully been tested to bypass censorship methods used in China, India, and Kazakhstan, including the discovery of several new vulnerabilities that were previously unknown. However, Geneva is only effective for bypassing DPI-based blocks; it is useless against IP address blocking and cannot operate without a VPN. seven vulnerabilities have been identified dozens of standard DPI bypass strategies that can be tested immediately without a full analysis, such as:

python3 engine.py —server-port 80 —strategy «[TCP:flags:PA]-duplicate(tamper{TCP:dataofs:replace:10} tamper{TCP:chksum:corrupt},),)-|» —log debug

2020-01-24 20:54:41 DEBUG:[ENGINE] Engine created with strategy \/ (ID bm3kdw3r) to port 80
2020-01-24 20:54:41 DEBUG:[ENGINE] Configuring iptables rules
2020-01-24 20:54:41 DEBUG:[ENGINE] iptables -A OUTPUT -p tcp —sport 80 -j NFQUEUE —queue-num 1
2020-01-24 20:54:41 DEBUG:[ENGINE] iptables -A INPUT -p tcp —dport 80 -j NFQUEUE —queue-num 2
2020-01-24 20:54:41 DEBUG:[ENGINE] iptables -A OUTPUT -p udp —sport 80 -j NFQUEUE —queue-num 1
2020-01-24 20:54:41 DEBUG:[ENGINE] iptables -A INPUT -p udp —dport 80 -j NFQUEUE —queue-num 2

Source: opennet.ru