Censors of the Internet must continually discover and block new circumvention proxy servers. We seek to understand this process; specifically, the length of the delay between when a proxy first becomes discoverable and when it is actually blocked. We measure this delay in the case of obfuscated Tor bridges, by testing their reachability before and after their introduction into Tor Browser. We test from sites in the U.S., China, and Iran, over a period of five months. China's national firewall blocked new bridges after a varying delay of between 2 and 36 days. Blocking occurred only after end-user software releases, despite bridges being potentially discoverable earlier through other channels. While the firewall eventually discovered the bridges of Tor Browser, those that appeared only in Orbot, a version of Tor for mobile devices, remained unblocked. Our findings highlight the fact that censors can behave in ways that defy intuition, presenting difficulties for threat modeling but also opportunities for evasion.
[1]
J. Alex Halderman,et al.
Internet Censorship in Iran: A First Look
,
2013,
FOCI.
[2]
Collin Anderson,et al.
Dimming the Internet: Detecting Throttling as a Mechanism of Censorship in Iran
,
2013,
ArXiv.
[3]
Damon McCoy,et al.
Proximax : A Measurement Based System for Proxies Dissemination
,
2010
.
[4]
Nick Feamster,et al.
Examining How the Great Firewall Discovers Hidden Circumvention Servers
,
2015,
Internet Measurement Conference.
[5]
Dan S. Wallach,et al.
The Velocity of Censorship: High-Fidelity Detection of Microblog Post Deletions
,
2013,
USENIX Security Symposium.
[6]
Nick Mathewson,et al.
Tor: The Second-Generation Onion Router
,
2004,
USENIX Security Symposium.
[7]
Stefan Lindskog,et al.
How the Great Firewall of China is Blocking Tor
,
2012,
FOCI.
[8]
Nikita Borisov,et al.
rBridge: User Reputation based Tor Bridge Distribution with Privacy Preservation
,
2013,
NDSS.