Tracking VPN and Proxy Users

There are similar challenges for network administrators in corporate networks and those running firewalls for authoritarian regimes about the use of proxies and VPN services.  The issue is that not only do they allow individuals the freedom to conduct their internet activity without being tracked, a VPN will also prevent most aspects of logging taking place too.

If you imagine a company network it means that an individual could potentially conduct all sorts of behaviour from a company computer whilst sitting in a corporate office whilst at work.   They could be downloading films, streaming Netflix or something perhaps much more sinister even.  Obviously this is potentially a risk to both the network infrastructure and also potentially to the company’s reputation.

So how do you block the use of VPNs and proxies?  For a corporate network there are actually many more options, and the simplest is probably to stop any sort of VPN and proxy being used in the first place.   You can lock down the advanced settings in a web browser quite simply, for example the Internet Explorer Administration Kit (IEAK) allows you to configure and deploy an IE package which cannot be modified onto every client in your organisation.  This stops proxies being used manually and VPN clients can be blocked by ensuring that  standard users have no administrative access to their desktops.

It is certainly easier to block any installation than trying to track the use of VPNs particularly some of the most sophisticated ones.   For example although you could potentially monitor logs in firewalls and routers for specific IP addresses which looked like VPNs some services allow you to switch to a range of IP addresses – Hide My VPN like the one in this video demonstrates:

As you can see if a service is rotated then identifying the VPN by it’s IP address is much more difficult.  However blocking installation of the highlighted service Identity Cloaker can also be difficult as it has a mobile version which can be run directly from a USB disk.

You can see that proxies are fairly irrelevant today as they can be easily blocked, also most content filters can detect their use too.   Significantly their use has now dropped globally for additional reasons mainly that they are mostly detected by websites which operate regional restrictions.   It is the more sophisticated Virtual private networks which are the difficulty, particularly those equipped with various VPN hider technologies and advanced encryption.

VPN Blocking on the Rise

For years people have used VPNs for all sorts of reasons, but it’s origin lay quite simply in the security they provided.  International companies will normally insist that their employees use VPN services when remotely connecting back to their servers using the internet.  It makes sense, otherwise important information and credentials would be trusted to the owners of coffee shop wifi or the administrator of your local Premier Lodge or hotel chain.

The concept is simple, create an encrypted tunnel which ensures that all the data which normally is passed in clear text instead is encrypted and unreadable.  Of course, this security means that as well as being safe from computer criminals and identity thieves – it’s also secure from intelligence services and state controlled snoopers too.  It should come as no surprise that anyone who opposes free speech generally hates VPNs and the protection that they give.

So when we hear stories about different organisations and companies from the Netflix to the Chinese Government trying to block VPNs what are they doing.  Well it depends, obviously the situation that leads to thousands of BBC iPlayer VPN not working is going to be slightly different to the Chinese throwing billions at the great firewall of China.   However the general techniques are basically the same as a small company want to achieve the same thing.

One of the most common options is to block the ports used by these services.  Most VPN tunnelling protocols operate on standard ports, e.g using PPTP or LTP.  They need to establish these connections to transfer and receive data, without them the service won’t function.  Other methods include identifying and blocking specific IP addresses or ranges which are being used by VPN services.   It is these two methods that are mostly used by the big media companies like Hulu and the BBC.

These methods can be time consuming though and it’s possible to switch address and some services allow you to configure alternative ports too. The Chinese Government as you would expect have gone one step forward and use more sophisticated techniques like deep packet inspection.   These involved looking at the data itself to identify if a VPN is being used to transport it.  For example if you are unable to read any data because none of it’s in clear text then there is the likelihood that it is being encrypted.   Of course, there are other methods which encrypt data like SSL so you need to be careful that you don’t block other traffic, it’s a risk that the Chinese would probably be happy to take however.

Even these methods are not foolproof and VPN companies can scramble things like the meta data to make identifying the use of a VPN even harder.  It is worthwhile noting that many people in China still use VPNs routinely and so if the huge resources available to the Chinese State can’t block their use – we should be ok to have a BBC VPN like this for the foreseeable future.

 

 

TCP Extensions – Virtual Circuits

TCP provides lots of additional services which have been added over it’s lifetime one of the more useful ones is that of the virtual circuit transport service. There are three distinct phases in the life of any TCP connection – establishment, transferring data and termination.    There are many applications including things like remote login and those that enable file transfer which are perfectly suited to using a virtual circuit type service.    Many other applications are suited better towards a transaction based service which is basically a client request followed by a server response.  This can be explained by briefly detailing it’s characteristics:

1: Any overhead of connection establishment and the subsequent termination should be minimized.  Ideally one request should be sent followed by the corresponding receive before any other packets are sent.

2: Latency should be reduced to the sum of the round trip time (RTT) plus the server processing time (SPT).

3: Server should be capable of detecting duplicate requests and not processing them again.

A very important application uses this type of service which forms the very backbone of the internet – the Domain Name System (DNS).   Other common applications such as the BBC VPN many people use to bypass the numerous region locking systems which exist online.   The other important decision that an application developer must consider is whether to use UDP or TCP for the transport.  The difficulty is that TCP simply provides too many features for an efficient transaction whilst  UDP doesn’t really provide enough.   Normally UDP is used simply because it avoids the overhead of TCP connections but this involves adding the features that are required like retransmission, dynamics timeouts and congestion avoidance.

The solution that is a better alternative than this is to provide an additional transport layer to provide more efficient handling for the transactions.  The transaction protocol which is commonly used now by many applications is called T/TCP defined in RFC 379 – extending the TCP protocol for transactions.

Remember most TCPs require 7 segments to open and close a connection.  An additional three more segments are added to deal with the requests and replies (initial and the one responding to the ACK).  In addition it may be necessary to add extra control bits to deal with other functionality and connection information required to complete the transactions properly.

Further Reading:

James Hibbert: Polskie Proxy, Haber Press, 2017

 

 

BBC News Streaming from Outside the UK

The BBC haven’t always streamed the BBC News over the internet, in fact it was noticeably missing from the initial releases of the BBC iPlayer for a few years. There are a few other programmes which were omitted, for example there was always a delay put on Match of the Day presumably for contractual reasons. However now that BBC has it’s own dedicated 24 hour News channel, it’s great news to see that it’s simultaneously broadcast live online on their web site.

You can see the tab illustrated which leads to the live TV streaming section including the BBC News channel.   However many people outside the UK will have problems finding this link as it simply doesn’t exist on the version you get outside the UK.  It’s called the ‘International version’ and anyone not in the UK will be redirected to this site.   The site is good but it’s missing all the TV stations and the BBC iPlayer functionality, even if you go there directly you’ll get blocked whenever you try and play anything.

Here’s a quick video entitled – BBC News Streaming over the Internet which you can also watch below:

As you can see the trick is to hide your location before you connect to the website. By logging on to a server physically located in the UK, you can access any of the BBC without issue simply because it will see the server’s UK address and not your real one. It has the added bonus of adding a layer of security and privacy to your internet connection too. This is because the connection between your computer and the VPN server is entirely encrypted which means both your identity is private but also all credentials you pass through the VPN are safe too.

It should be added that all the media companies try and block access to their sites through intermediary servers like proxies and VPNs. However there are still several companies who’s servers work perfectly well for accessing the BBC from anywhere in the world.

Irish Proxy for Watching RTE PLayer Live

RTE is the national broadcaster of the Republic of Ireland and has been involved in broadcasting TV channels since 1961.  It was actually an early adopter of radio broadcasting yet Ireland was relatively slow in getting involved in TV broadcasts – the BBC was involved in the 1920s for example.  There was some television broadcasting in Ireland through the Northern Ireland services run by the BBC although this was completely unofficial.

The Irish Government until the late 1950s considered TV to be a luxury which wasn’t a priority however it changed it’s opinion as the popularity rose.  A committee was formed to investigate how to set up an Irish broadcasting service (for the lowest possible outlay) and it’s initial form was something like the commercial services from the UK.

The first broadcast was on New Year’s Eve, 1961 at 19:00 hours and included a speech from the President who described what the service would be.   Many other messages were then broadcast from religious figures before a live concert was shown live from the Gresham Hotel in Dublin.

Irish proxy

Temple Bar, Dublin

The Irish people took to the new medium almost immediately particularly as a way to discuss topics and current affairs.   Suddenly topics like abortion, religion and contraception were discussed openly in chat shows and tv studios broadcast across Ireland.  The origin of many of these chat shows lies with the first and arguably the most famous one – The Late Late Show which began in July 1962 and which still runs today.

Although RTE was relatively late to the world of TV broadcasting, however it caught up quickly.  In 1962, RTE expanded it’s broadcasts to include 625 line transmissions several years ahead of the BBC for instance.  In 1969, RTE broadcast the Wimbledon finals in colour over the next few years more and more broadcasts were transmitted in colour.

Rte has expanded it’s channels over the last few years and also branched out into the world of internet broadcasting. RTE Player is the channels broadcasting application and it can be found at the following address – http://www.rte.ie/player/.

Unfortunately the channel is not directly available over the internet outside Ireland although they can be accessed in certain areas. In Northern Ireland particularly near the border there is some overspill of the signal. Also the channels were made available over Sky although there has been some disputes over licensing so certain events usually sports shows are not available in Northern Ireland.

There is however a method where you can watch RTE Player from outside Ireland.   This involves hiding your location behind an intermediate server which means that you can appear to be from whatever country you require.  So to access RTE Player you would merely connect through to an Irish proxy server first there is also an explanation here – http://www.iplayerabroad.com/bbc-iplayer-ireland/.

What happens is that the proxy acts as a buffer between the RTE web site and your computer.   When the website performs a lookup on the connecting IP address it will receive that of the server and not the client.  As long as that server is based in the Republic of Ireland then all of the RTE website will be accessible.

This method works for all geo-restricted sites although there are a few exceptions.    Many websites now are able to detect and block the use of proxies, and most users have switched to using VPN.  These encrypted and secure services are much more difficult to detect than simple proxy servers and can be used in the same way to hide a user’s physical location.

If you’re looking for a mixture of high security and fast servers, then may we suggest trying out Identity Cloaker.   It’s an amazing program with servers in the US and most European countries including Ireland and UK.

Try the 10 day trial out here to see how good it is.