DEFENSES
amp-cache AMP cache proxying
7 papers on file
- 2025-iran-shutdown-measurement Characterizing Iran's Phased National Internet Shutdown in 2025: A Progressive and Distributed Action
- 2025-gusgustavo-iran-using-champa [Iran] Using Champa proxy
- 2025-miaan-stealth-blackout Iran's Stealth Blackout: A Multi-stakeholder Analysis of the June 2025 Internet Shutdown
- 2025-nourin-nobody Is Nobody There? Good! Globally Measuring Connection Tampering without Responsive Endhosts
- 2024-calle-toward Toward Automated DNS Tampering Detection Using Machine Learning
- 2023-raman-global Global, Passive Detection of Connection Tampering
- 2021-bock-weaponizing Weaponizing Middleboxes for TCP Reflected Amplification
9 findings tagged here
-
Champa implements adaptive request-rate control: when the AMP cache returns an unexpected response (e.g., HTTP 302), the client halves its polling rate. Once the polling interval exceeds one second the client is considered fully rate-limited and must restart after a multi-hour cooldown. This mechanism keeps the client from burning through its allowance when cache responses degrade.
-
Champa's AMP-cache tunnel delivers at most ~15 KB/s throughput before AMP rate-limiting activates. Sessions last approximately 15 minutes before the rate limit triggers; after that, users must stop the client and wait several hours before resuming.
-
As of June 2025, Iran blocks GitHub.com and Telegram but leaves the IP address of google.com reachable and Google Drive accessible. This selective blocking pattern created the operational window for Champa: because google.com is reachable, its AMP cache (cdn.ampproject.org) can be reached by fronting on that IP, then used to proxy connections to otherwise-blocked destinations.
-
Because GitHub is blocked in Iran, Champa distributes binaries through three alternative channels: a Telegram bot (@getchampabot), Google Drive folders, and curl commands documented in the GitHub issue thread itself. The issue thread remains accessible via Google cache / AMP even when GitHub's domain is blocked, creating a bootstrapping loop.
-
Champa routes connections by specifying an AMP cache URL (https://cdn.ampproject.org/) with google.com as the front domain, then uses the SOCKS5 proxy interface locally. The server's public key is hardcoded in the connection string, providing a fixed authentication token that prevents trivial impersonation of the proxy by a censor injecting a fake server response during active probing.
-
UP channels based on free third-party content hosting (video, audio, images, ML models) provide no-cost scalability: steganographic videos once uploaded are free to distribute to arbitrarily many users, and the channel sustains adversarial financial denial-of-service attacks without incurring operator costs. This contrasts with meek, SQS, AMPCache, and Skyhook, which face financial DoS risk because adversaries can drive up hosting costs by using those channels as intended.
-
Among surveyed channels, Skyhook, PushRSS, SQS, AMPCache, and Meek satisfy all three UP channel properties (unidirectional, no client auth, higher bandwidth); CloudTransport and Raven do not because they require authenticated user accounts; Tor's email- and Telegram-based bridge distribution also fails the no-auth requirement. The analysis was prompted in part by the 2022 GFW entropy-based blocking event, which required software updates to be pushed to users before fully-encrypted protocols could resume functioning.
-
The paper surveys the rendezvous channel design space and identifies at least six prior carrier approaches: domain fronting via CDNs, AMP cache proxying, Amazon SQS queues, push notification services, email tunneling (Mailet, SWEET), and cryptocurrency covert channels (MoneyMorph). Pub/Sub adds bidirectional real-time messaging with broad IoT/enterprise adoption as a new carrier class not previously evaluated for circumvention rendezvous.
-
By 2009, the top 150 autonomous systems carried approximately 50% of all Internet traffic globally, up from roughly 30% in 2007. Akamai alone claimed approximately 20% of all web traffic, and the proposed Level 3 / Global Crossing merger would have covered over half the world's IP addresses.