The new VPN attack can be successful. Bypassing locks will be increasingly difficult, experts say

The Russian authorities have been increasing the degree of control over the Internet for the past few years. Roskomnadzor is especially trying to control the VPN. The authorities tried to force the services to comply with the laws on locks that refused also blocked, and last spring, Roskomnadzor began to fight not with individual services, but to prohibit entire protocols for using the VPN. This did not last long, but now, it seems, the censors have returned to this practice on an even larger scale.

On Monday, August 7, users of VPN services from Russia noticed problems with the servers. One of the first to pay attention to the IT specialist Philip Kulin, he wrote about this in his telegram channel -and hundreds of users shared their observations.

The picture was conflicting: the VPN could work for the subscribers of one operator, but could not, in one region some users had difficulties with the connection, while others did not experience technical problems. The mediazone correspondent conducted a small survey on Twitter with the same result.

On the same day in the evening, the creator of the Antizapret blocking service under the pseudonym Valdikss published a post in which he said that he tested different types of connection and blocking them. He came to the conclusion that mainly connecting from Russia to servers abroad among subscribers of mobile operators and that these locks are markedly different from what was before.

This time, not popular commercial services that are available to everyone, but private servers, which users independently set up from foreign providers, fell under the blow. The nature of the blocking has also changed: according to Valdikss , now Roskomnadzor, using DPI and TSPU, evaluated the type of traffic and immediately blocked it if it was defined as a connection via VPN . The popular protocols Wireguard , L2TP and OpenVPN were blocked.

According to the technical director of Roskomvoboda and the founder of Privacy Accelerator Stanislav Shakirov, these were “not blocked blocks”. In his opinion, the censors are trying to make the VPN lock affect only private individuals, but does not affect the work of corporate clients.

The creator of the Redshield VPN Vladislav Zdolnikov agrees with him: in his opinion, the authorities did not previously block the VPN protocols because they "agreed with a large business to exclude addresses so as not to bring their service tunnels." Back in 2021, it was known that the Central Bank sent letters to banks with a request to name the VPN services that they use so as not to harm credit organizations.

VPN - Virtual Private Network , or “Virtual Private Network” - a common name for technologies with which computers can be combined via the Internet into a “private” network, as if they were connected directly, even if they are far from each other. In such a network, you can combine any devices or even whole local networks, for example, you can create a single space for offices or branches of the same company. The VPN connection itself is encrypted, therefore, only encrypted traffic is visible to an outside observer, for example, a provider. Thanks to this, the VPN began to be used to bypass locks: if you install a direct connection with the access point on the Internet in another country, the provider will not know which sites the user enters, and therefore will not be able to block access.

DPI - Deep Packet Inspection , or “Deep Statement of Packages” - since the information is transmitted on the Internet in the form of short data blocks called packages, there are methods for analyzing their contents, even if it is encrypted in a reliable way. The observer cannot read the contents of the packages, but it can understand, for example, with which site the user contacts and what data exchange protocol. Often DPI is also called the device itself installed by an Internet provider that studies user traffic to distribute the load on the network or block prohibited information.

TSPU- “technical means of counteract threats”-devices that Roskomnadzor installs by Internet providers as part of the “sovereign Internet” law in order to be able to control the traffic of users: to study using DPI , slow down and even fully block.

DNS - Domain Name System , or “Domain Name System”-a kind of Internet phone book connecting the “addresses” of sites and servers in numerical values ​​with the usual users of web addresses. Typically, a request with the address to a specific site goes in an unpleasant form, and the provider can easily find out which resource the user visits - this is how the DNS sites are blocked. Modern DNS technologies via HTTPS (Doh) and DNS through TLS (DOT) are trying to complicate such a peeping, encrypting DNS requests themselves; Last fall, the Ministry of Communications submitted a bill in which it proposed to punish for the use of such technologies.

Experts are looking for ways to bypass new locks

The NTC.Party technical forum already provides methods for deceiving DPI technology, to which Roskomnadzor resorted. In particular, commentators advise sending harmless requests so that the locking system marks the connection as permitted, and then connect via VPN , however, this method requires serious skills and is not suitable for ordinary users.

The authors of the VPN Generator channel announced the decision, "for the sake of stopping which it will be necessary to steal the entire Internet at all." They also described the side consequences of new locks: “Many people had a video surveillance (stealing, a geese-run!), Ordinary businesses cannot reach their servers and the connectivity between branches has been destroyed.”

Shakirov from Roskomvoboda advises ordinary users to install several programs for VPN , for example Psiphon , Lantern , Amnezia and Tor : “So far, one always worked, no matter what happens.”

“If suddenly nothing works, you need to wait a few days, because for some time the developers of all these systems need to update their software,” he explains. -Firstly, it takes time to write it. Then, for some time, the release of updates to the Apple Store and Google Play . ”

Experts also pay attention to the ShadowsCks and XTLS protocols: they allow you to install a VPN connection that is difficult to detect by Roskomnadzor.

They appeared in China to overcome the “great Chinese Faerwole”, and are now widely used in Russia. For example, the OUTLINE project based on ShadowsCks lies at the basis of the Petersburg publication "Paper". True, as they believe in Roskomvobod, it is these protocols that can become the next goal of the authorities.

What will happen next

“To crush massively so that the connections do not work for most people, they have already done - the filters are written and work. The reliability of the bypass methods is small in time - it took me three full days to build the modification of the OpenVPN protocol with the bypass on the server side, which would work on all providers under the blocking (filters slightly different from the provider to the provider), explains Valdiks , the creator of the interval service of the locks Antizapret . - Prospects for users - the use of non -commercial VPN protocols, but special means of bypassing of locks - ShadowsCks , VMess , Trojan and comrades. They are supported in fewer devices (are hardly present in any official firmware of routers), but they are developed taking into account censorship and are actively modified. ”

Shakirov from Roskomasvoboda is convinced that ultimately the “Chinese model” of the Internet will be introduced in Russia, that is, almost autonomous existence, when world services like YouTube or Facebook are blocked and replaced by domestic analogues. However, he believes that the ways to go around the blocking will still remain, but each time it will be necessary to resort to more and more difficult manipulations.

Vladislav Zdolnikov agrees with him. “With complication of access, the number of people who will receive alternative information will inevitably decrease,” he said.

According to Philip Kulin, such a qualitative transition in blocking can stimulate IT companies to combat censorship: “So to say, the RKN war with the VPN until the day before was a“ strange war ”. So, pushed each other in the chest. And now - war. ”

In this, he also supports healthy people. “Now in the Russian IT community there is a difficult process of humility, which can be observed in specialized chats,” the specialist states. “For several years, no one wanted to believe that the authorities would reach this, and almost no one wanted to study new tools for themselves, but now awareness of the need comes.”

He thinks that the OpenVPN and Wireguard protocols will be blocked, which means that almost all the services that remained unnoticed by Roskomnadzor will now not be available to users from Russia. He adds that in the Redshield VPN they began to work on ways to disguise the VPN to some other type of traffic: from the point of view of analysis of data from Roskomnadzor, it looks like a user opens a regular permitted site.

Editor: Dmitry Treshchin

Updated at 19:03. Added comment by Valdikss .