Уровень 0 · материалов: 6
В кластер входят документы, описывающие технические методы обнаружения VPN, утечки данных через сетевые параметры и способы обхода механизмов защиты конфиденциальности трафика.
Общие признаки: детекция VPN, утечки трафика, анализ пакетов, деанонимизация, сетевые протоколы
Группа выше: Даркнет и обнаружение средств анонимности
Смысл: The main idea is that network-level parameters like MSS and MTU, combined with OS fingerprinting, can be used to reliably detect VPNs and proxies even when the user attempts to hide their identity.
The author explains how to detect VPNs (specifically OpenVPN) and proxies by analyzing packet MSS/MTU values and discrepancies between TCP fingerprints and browser User-Agents.
Смысл: The main idea is to highlight how mobile network operators may use transparent proxies and specific NAT rules that can interfere with VPN tunnels and modify packet headers without the user's knowledge.
An engineer discovers that a mobile operator uses a 'Harmony proxy' to intercept HTTP traffic and applies inconsistent NAT rules, causing intermittent VPN failures.
Смысл: The main idea is that Tor and VPNs do not protect against active traffic shaping attacks where an adversary controls both an exit node and monitors the entry point. By manipulating packet characteristics, an attacker can create a traceable 'fingerprint' to deanonymize users.
Low-latency anonymity tools like Tor are vulnerable to traffic shaping attacks that use packet size and timing signatures to deanonymize users.
Смысл: The main idea is to describe the development of a VPN client that specifically addresses the 'leakage' of local SOCKS ports on Android, which current detection tools use to identify VPN usage and uncover the server's external IP.
The author created TeapodStream, an Android VPN client that prevents VPN detection by using randomized, authenticated local SOCKS ports.
Смысл: The main idea is that standard Android VPN split-tunneling can be bypassed at the kernel level, and the only effective solution is to implement a userspace network stack that manually verifies the ownership (UID) of every packet entering the tunnel.
The author created a custom Go-based tun2socks implementation to prevent Android apps from bypassing VPN split-tunneling rules using the SO_BINDTODEVICE system call.
Смысл: The main idea is that to defeat client-side spyware that leaks VPN exit IPs, users must decouple the connection point from the exit point using a three-tier proxy architecture, ensuring the device never 'sees' the final IP address used to access the open internet.
To prevent spyware from reporting your VPN's exit IP to authorities, implement a three-stage VPN chain where the final exit node is hidden from the client device.