Unintended Risks and Consequences of Circumvention Technologies: The IBB's Anonymizer Service in Iran

OpenNet Initiative Advisory 001

Last modified: May 5, 2004
<http://www.opennetinitiative.net/advisories/001/>

I. Executive Summary

Internet access in Iran is subject to official censorship. Iranian authorities' guidelines for ISPs and users reportedly warn them to avoid all content seen as being in breach of social and cultural norms.[1] In practice, the filtering of Iranian ISPs extends to cover political as well as pornographic web sites.[2] In September 2003, the U.S. International Broadcasting Bureau (IBB) sponsored the launch of a service through Anonymizer, Inc., designed to allow Iranian Internet users to bypass much of Iran's national filtering regime. Throughout this report we refer to the service as the "IBB Anonymizer" to emphasize that it is distinct from the general services offered to the public by Anonymizer, Inc.[3]

In December 2003 and April 2004, we ran a series of tests to gauge the accessibility of sites through the IBB Anonymizer service. We found that many web sites blocked by Iranian ISPs could be successfully accessed through the IBB Anonymizer service. However, filters built in to the IBB Anonymizer service, intended to prevent Iranians from using it to view pornographic sites, also have the unintended consequence of blocking access to numerous non-pornographic pages and sites. At fault appears to be the IBB Anonymizer's unreleased list of automated "trigger" keywords applied to domain names before any pages are shown to IBB Anonymizer users. These "trigger" keywords appear to generate a significant number of false-positive results, resulting in a significant amount of collateral blocking -- "overblocking" -- of non-pornographic sites. For example, the IBB Anonymizer service blocks non-pornographic websites dealing with women's health issues because the keyword "breast" is within their domain names. Likewise blocked is the anchor page for links to the U.S. Department of State's overseas missions -- usembassy.state.gov -- because it contains the trigger keyword "ass." The service also blocks almost any site containing the word "asian" in the domain. Some of these apparently unintentionally blocked sites are themselves blocked within Iran, resulting in a situation where sites are effectively doubly blocked --by Iranian ISPs and by the IBB Anonymizer service.

The IBB and Anonymizer Inc. confirmed in separate e-mail exchanges with ONI researchers that the circumvention service is explicitly configured to block pornography.[4] They explained that this is intended to conserve available bandwidth and ensure availability of the service to Iranians who wish to visit non-pornographic sites. Several notable studies have pointed out the difficulty of implementing keyword-based filtering systems in such a way as to avoid the unintended consequence of "collaterally blocking" non-pornographic sites. The keyword rules that drive the filters built in to the IBB Anonymizer service are not publicly known, making independent assessment of those rules and their implications more difficult. (Staff at Anonymizer, Inc., have declined to publicly disclose keywords or methods, considering them to be proprietary to the company.)

Further, despite IBB Anonymizer assurances that its Iranian users may surf the Web freely and safely, our testing suggests that the vast majority of its traffic is exposed to monitoring by Iranian authorities and corresponding local ISPs. Iranian users may not be aware that their use of the service may identify them to Iranian government authorities as citizens wishing to view forbidden content, or as supportive of the ideas found within that content.

Examples of filtered web sites

The following list contains examples of non-pornographic web sites filtered on the IBB Anonymizer service, apparently because their domains contain banned keywords; a lengthier list of apparent overblockages is reproduced further below. Filtered web sites include those having to do with women's health issues, the President of the United States, a variety of NGO's, and popular hotel, email, and other commercial services. In addition, it appears that all domains registered in Malaysia (.my) and Tuvalu (.tv, popular domain suffix for television-related material) are blocked.

II. The IBB Anonymizer Service

In response to the recent implementation of Internet content filtering in Iran, the United States, through its federally chartered International Broadcasting Bureau, contracted with Anonymizer, Inc. to provide what is known as "circumvention technology" and services to Iranian citizens. Circumvention technologies assist Internet users in bypassing content filtering and surveillance in areas where such practices exist.

Anonymizer, Inc.'s flagship public Anonymizer service is often adopted for filtering circumvention purposes. While offered primarily as a service allowing Internet users to visit web sites without disclosing any potentially identifying information to those operating the site, the basic Anonymizer technology can also prove useful to those seeking to circumvent certain kinds of web filtering. Anonymizer works by serving as an intermediary between the user and the user's desired web site -- a so-called "web proxy service." By acting as a proxy, only Anonymizer knows a user's IP address -- the visited site views the visit as coming from Anonymizer's servers rather than the user, and Anonymizer relays what it views on the site back to the requesting user. Thus, users prevented from accessing Internet content directly on a site can seek to connect to the Anonymizer service, which retrieves and relays the content instead. (For this reason, filtering regimes often filter access to Anonymizer itself.)

The IBB Anonymizer service is a modified version of the Anonymizer service offered solely to Iranian Internet users, in conjunction with the Voice of America's (VOA) Persian Service and Radio Farda. It appears to be materially less secure than the fee-charging Anonymizer services offered to the public at large -- its paid encrypted service and SSH tunneling service. Operators of web sites visited by users of the IBB Anonymizer will still see the visits as coming from Anonymizer's servers rather than somewhere in Iran, but the traffic between IBB Anonymizer and its Iranian users is apparently itself exposed to network monitoring by Iranian ISPs.

Users that IBB Anonymizer determines to be outside of Iran are unable to access the service. For those who are found to be within Iran, the service is freely accessible through several domain names. As soon as the Iranian authorities block one of the service's domain names or IP addresses, new locations are announced to Iranians through Radio Farda and VOA Persian Radio broadcasts. (Some of these domain names are filtered by some ISPs in Iran and thus inaccessible to users, however even the filtered domains can be accessed by directly entering the IP address.) [5] As has been reported elsewhere, pornography filters are present on the IBB Anonymizer service to prevent Iranians from using the service to retrieve pornographic content.

After media reports indicating that the IBB had procured the services of Anonymizer Inc. to develop and deploy circumvention technology for Iranian Internet users, and that the service was configured with pornography filters, we connected to the IBB Anonymizer services through remote computers located in Iran and sought to determine how well the system worked, and what sorts of sites the system itself filtered.

A. How the IBB Anonymizer works

1. When accessing the IBB Anonymizer, users are presented with a web form into which URL's can be entered:



2. The requested URL is obfuscated within the user's browser, but not formally encrypted, by converting the ASCII text to hexadecimal using JavaScript.

In this case, http://www.radiofarda.com/ becomes...

687474703a2f2f7777772e726164696f66617264612e636f6d2f

The conversion of ASCII text to hexadecimal might render the submission of the requested URL to the IBB Anonymizer more subtle -- since URL keyword scanning by the Iranian authorities, if present, would possibly expect plain text rather than hexadecimal -- but it would be an easy technical adjustment for anyone surveilling the exchange to convert hexadecimally encoded URLs back into ASCII. Thus it's not clear why URL obfuscation takes place at all.

3. The request is transported over HTTP, using POST, to a CGI script that processes and redirects the request.

POST http://sedayema.com/jump.cgi HTTP/1.1

url=687474703a2f2f7777772e726164696f66617264612e636f6d2f&k=&manual=yes&onclick%3D%27xorValue%28document.menu.url.value%2Cdocument.menu.k.value%29%27=%D8%A7%D8%AC%D8%B1%D8%A7

Location: http://anon.barandaz.com/cgi-bin/redirect.cgi?url=687474703a2f2f7777772e726164696f66617264612e636f6d2f

Location: http://util.barandaz.com/cgi-bin/action.cgi?url=687474703a2f2f7777772e726164696f66617264612e636f6d2f&go=go

The requested URL is then encrypted using the Blowfish algorithm, redirected once again where a GET request is issued for the URL.

Location: http://anon.user.barandaz.com/cipher:pEtUzcn+vRTQ+kAURpvqhOt4d3DZ/FkLutmGdOovcmLYzNbqUtINeQ==:

GET http://anon.user.barandaz.com/cipher:pEtUzcn+vRTQ+kAURpvqhOt4d3DZ/FkLutmGdOovcmLYzNbqUtINeQ==: HTTP/1.1

687474703a2f2f7777772e706c6179626f792e636f6d2f

POST http://sedayema.com/jump.cgi HTTP/1.1

url=687474703a2f2f7777772e706c6179626f792e636f6d2f&k=&manual=yes&onclick%3D%27xorValue%28document.menu.url.value%2Cdocument.menu.k.value%29%27=%D8%A7%D8%AC%D8%B1%D8%A7

Location: http://anon.barandaz.com/cgi-bin/redirect.cgi?url=687474703a2f2f7777772e706c6179626f792e636f6d2f

Location: http://util.barandaz.com/cgi-bin/action.cgi?url=687474703a2f2f7777772e706c6179626f792e636f6d2f&go=go

Location: http://anon.user.barandaz.com/cipher:B3EoSzC2Kmgvv2R2Z3JtFx/aI9nzBi2IEGWPI+teMBZKGyCaP5unuQ==:

GET http://anon.user.barandaz.com/cipher:B3EoSzC2Kmgvv2R2Z3JtFx/aI9nzBi2IEGWPI+teMBZKGyCaP5unuQ==: HTTP/1.1

HTTP/1.1 302 Moved Temporarily
Location: https://ssl.kuaidiannao.com/blockpage.html

The site to which users are redirected when accessing banned content (ssl.kuaidiannao.com) was not accessible.

In the case above, "playboy.com" appears to be blocked because it contains the word "boy" -- indeed, any domain name containing "boy" is blocked.

Due to these rules, many sexually-explicit sites are indeed unavailable. But other sites are unavailable too, for words like "ass" appear in the host names of numerous sites not providing sexually-explicit content. For example, usembassy.state.gov is unavailable due to the presence of the letters "ass" within the server's host name, and sussex.police.uk is unavailable for the same reason. In addition, the words "my" and "tv", which are also domain suffixes, are filtered by IBB Anonymizer. As a consequence, all web hosts registered within the domain name systems of Malaysia and Tuvalu are unavailable. Such content can still be accessed by directly entering the IP address of a particular domain, thus bypassing the domain name keyword filtering, but many Internet users do not have the technical ability to determine the IP address of a blocked domain name.

Manual testing revealed that when specific substrings or groups of letters (usually with pornographic connotations) that appear within standard words, were found within a domain name, that web host was inaccessible through the IBB Anonymizer service. Along with manually chosen words (such as "playboy" from "boy"), we used Princeton's WordNet lexical database to generate a set of larger words containing apparently-banned substrings. Each of these words was then used as search terms in a standard Google search to generate lists of non-pornographic URLs. We ran each search with Google's inurl: modifier to generate a list of highly ranked domain names with the specified keyword in the domain as well as any directory or filenames within the URLs. Finally, we scrubbed the Google results to include only domains that contain the relevant keyword, as the IBB Anonymizer does not filter URL paths beyond the domain name that contain the banned keywords.

When we ran the Google searches we asked for Google's "safe search" to be on, thus generating search results that were not deemed by Google's automated system to be pornographic. Of course, Google is not 100% effective in screening out all pornographic content, and so some of the results below contain pornographic web sites.