• Abstract and Figures
• Public Full-text

Rook: Using Video Games as a Low-Bandwidth Censorship Resistant Communication Platform Paul Vines Tadayoshi Kohno University of Washington University of Washington Tech Report: UW-CSE-2015-03-03 March 20, 2015 Abstract sor and surveil private communications within their bor- ders [4, 29]. However, both surveillance and censorship Censorship and surveillence is increasing in scale, sophis- of the Internet has continued to increase in scale, sophisti- tication, and prevalence across the globe. While most cation, and prevalence [9, 15, 33]. There have been many censorship circumvention systems are still focused on es- systems developed for attempting to hide communications caping a given censored region to access Internet content on the Internet from censors we will simply refer to these outside of its control, we address a different but equally as circumvention systems. Most of these are designed pressing problem: secure and secret chat within a cen- with the intent of routing them outside of a censored re- sored region. gion, These systems have many different approaches and We present Rook as a censorship and surveillence re- goals with respect to circumventing censorship, evading sistant platform for communicaton using online games as surveillance, and what kinds of attacks they can with- its cover application. The use of online games represents stand. With the development of circumvention systems a novel form of cover application that provides several there has been an accompanying development in attack features that make them uniquely well-suited for this pur- techniques for detecting or blocking them. This has led to pose. Rook transmits data secretly by embedding it in the an arms race situation in which circumvention systems are network traffic of an online game. To defeat current at- invented and improved followed closely by attacks against tacks based on deep-packet inspection and traffic shape them similarly being invented and improved. analysis, Rook does not generate any additional packets, The focus of most work in reaction to these develop- does not change the length of existing packets, and en- ments in censorship remains on enabling users to access sures packets that are altered are still valid game packets. censored websites by routing their traffic outside of their For evaluation, we implement Rook using the online state’s region. We focus on a related but different prob- first-person shooter Team Fortress 2. Rook is evaluated lem: enabling uncensored and unsurveilled communica- against both active and passive attacks demonstrated in tion between parties within a region of censorship. Re- recent years including anti-mimicry probes, deep-packet cent studies have shown that chat clients with peer-to-peer inspection, traffic shape analysis, statistical analyses of capabilities are being censored [5] and there is no funda- packet payloads and game-specific analyses. mental reason why a censor cannot block chat programs 1 Introduction that use strong security or are unwilling to cooperate in censorship. There are increasing concerns about the privacy of on- In this paper we present Rook as a low bandwidth low line communications throughout the world: there are sev- latency (approx. 30 bits/second) censorship resistant com- eral countries which have historically acted to both cen- munication platform. While Rook can be used to secretly 1 communicate any kind of data, the structure of its net- communicate with the other Rook users also connecting work and limitations of its bandwidth make it best suited to these game servers. Furthermore, legitimate players for chat applications. We intend Rook to be used to fa- will often play for hours at a time, day after day. This cilitate secret IRC-like services among users. These ser- could be significantly more suspicious in the case of an- vices can run the Off-The-Record (OTR) protocol [2] be- other application, such as Skype, repeatedly being used to tween clients to ensure end-to-end security even from the contact the same IP for hours at a time every day. Finally, Rook server. Rook was partially inspired by recent works like VoIP services, games are a widespread and popular on pushing circumvention systems further into the appli- form of network use [26]; we believe a censor would face cation layer [6, 13], but also represents a new direction similar dissent to a decision to block all Internet-gaming for circumvention systems in several ways: first, it uti- as they would to blocking all VoIP. The general design lizes the normal network traffic of online games to hide of Rook is not specific to a game, and so if a censor at- its data; to our knowledge this is first system to leverage tempted to block Rook by blocking a single game, it could this type of application. Games have a number of fea- be adapted to another. tures that make them ideal host applications for hiding Another advantage of games is that they do not im- data which are further explained below. Second, Rook al- ply actual communication: a Skype connection inherently ters the host game traffic in full compliance with the appli- implies the two parties are sharing information, while a cation’s protocol; this means an adversary must first com- game client connecting to a server does not imply any mit the resources to develop a program to correctly parse more communication than the data packets being used to the application protocol, and then must also commit com- play the game. Since the connection is not encrypted, an putational resources to each suspected Rook connection adversary could easily detect if there is other information since the adversary cannot use a stateless single-packet being sent via chat or voice in the game. This creates inspection model to detect a Rook connection. As is the a plausible deniability that Rook users are connected in case with all of these circumvention systems, Rook is not any way. Where a Skype connection implies two IPs are necessarily undetectable, and we outline possible new re- exchanging information, a game connection only implies search directions for attacks below (see Section 5 and 6). two IPs happen to be playing the same game, and prob- However, Rook does represent a significant increase in the ably are not even aware of who the other IP is. Finally, cost of trying to detect and block its use. games provide a way to exchange information while not Many different types of applications have been used interrupting the legitimate activity. In most cases the host as cover or host applications for previous circumvention application, if it is even being run, is not performing its systems. Skype in particular has proven popular because normal operation: e.g., Skype when being used to proxy its calls operate on a peer-to-peer connection and are as- web traffic is not also providing a true VoIP conversa- sumed to be a reasonably legitimate activity for a user to tion [13, 21]. Instead, the game is actually being played be engaged in [13, 21]. Multiple TCP/IP-header based normally while information is exchanged; the adversary covert channels have also been developed. Online games could plant a user in the same game server and not ob- provide a similar opportunity but with greater deniability serve any significant difference in how a Rook user played on the part of users. Traditionally, many online games versus a normal legitimate player (see Section 4). have allowed individuals to host their own private servers Rook was developed with the FPS as the primary type to reduce the resource burden on the companies making of game to be used: this is because of the prevalence of the games. This is particularly the case for the genre private servers and the use a robust and low-latency UDP- of game Rook is primarily focused on: the First Person based network protocol. The use of UDP allows Rook Shooter (FPS). The existence of privately-hosted servers to modify game packets without creating any additional creates opportunities for communities to arise and causes packets and also not effecting legitimate gameplay. FPS many regular players of these games to play almost ex- games generally feature between 8 and 128 players on a clusively on one or a handful of servers. This provides server at a time. Each player controls one avatar inside a a completely legitimate cover for a Rook user to repeat- 3-dimensional game world in which they attempt to ma- edly connect to the same game server over and over to neuver and kill the other avatars. As an example imple- 2 mentation, Rook uses the FPS Team Fortress 2 [27], based on the Source Engine from Valve Software. The Rook de- sign can also be used for other types of games, although it may require modification particularly in the case of TCP- based games. The rest of this paper is laid out as follows: Section 2 describes the design and architecture of the Rook system. Section 3 describes our example implementation of Rook for Team Fortress 2. Section 4 contains our evaluation of Rook against a a variety of current and future proposed attacks including a game-specific trigram value analysis. Section 5 describes related works and how Rook’s ap- proach fits into the context of current circumvention sys- tem research. Section 6 discusses potential future works Figure 1: Example formation of a Rook network: one in this space building upon Rook. Section 7 contains a Rook server with multiple Rook clients and normal game summary of Rook’s contributions and analysis of our im- clients connected to it. plementation. 2 System Design vate game servers used by both Rook users and normal game players.

Load more

  20

Copy Link