Brightview's countermeasure requiring a minimum probe TTL of 24 (to prevent low-TTL scans from stopping at the proxy) was bypassed by sending probes with TTL=128 and examining the TTL of returned SYN/ACK packets. The UK web proxy consistently returned TTL=49 (64−15 hops), while Russian destination servers returned TTL=45–49 or TTL=113–238 depending on initial OS TTL settings. The two populations were cleanly distinguishable, defeating the fix with no change to scan logic beyond raising the probe TTL.

A hybrid two-stage blocking system (IP-redirect first stage, URL-proxy second stage) can be exploited as an oracle to enumerate blocked IP addresses by sending TCP packets with a TTL sufficient to reach the first-stage redirector but insufficient to reach the destination. Non-redirected IPs return ICMP TTL-expired from an intermediate router, while redirected IPs return a SYN/ACK from the web proxy impersonating the destination. A live scan of a /24 subnet confirmed 17 redirected IP addresses, yielding 91 associated hostnames across 9 of those IPs.

§5.2 defense

Using a simple dialup connection, the CleanFeed oracle scan enumerated IP addresses at up to 98 addresses/second. At this rate, the ~8.3 million Russian IP addresses (the IWF reported 25% of known illegal sites were hosted in Russia) could be scanned in under 24 hours, and the full routable IPv4 space (32% of 2^32 addresses) in approximately 160 days. A suitable filtered dialup account was available for free, with phone costs under £15.

§5.2 evaluation

The CleanFeed first stage populates its IP blocklist by automatically resolving hostnames from the IWF database via DNS. Content providers can serve false DNS results pointing to high-traffic third-party IP addresses (e.g., Google cache servers at 66.102.9.104), causing the first stage to redirect legitimate traffic through the proxy. Automated IP-update processes cannot reliably distinguish a genuine IP migration from a spoofed DNS result, and this can cause legitimate sites to be blocked collaterally.

§4.3 detection

The hybrid two-stage design's architectural vulnerability is that circumventing either stage independently defeats the system: end-users can tunnel via Tor or JAP to bypass both stages entirely, while content providers can serve different content to IWF crawlers versus real users, exploiting the fact that only 33% of IWF hotline reports were substantiated as potentially illegal. The system's precision is entirely contingent on content-provider cooperation, which cannot be assumed.

§4, §6 defense

The GFI's HTTP and HTTPS filters are now stateful (requiring initial SYN packet with matching sequence numbers) and have been activated on all TCP ports—not only standard ports 80 and 443 as reported by prior studies. This is a significant departure from previous work that found stateless HTTP/HTTPS blocking limited to standard ports. The HTTP filter injects a 403 Forbidden blockpage (not RST packets as used by the GFW), while HTTPS injects a single RST+ACK packet. The GFI also exhibits TCP non-compliance (not requiring a full three-way handshake to trigger filtering), enabling outside-in measurement without in-country servers.

2025-tai-irblock §2.1, §3.2 dpirst-injectionpacket-injectionmiddlebox-interference

The "port shadow" exploit abuses five shared, limited resources in Linux conntrack/Netfilter (and analogous frameworks in BSD, Windows) to let an off-path attacker intercept or redirect encrypted VPN traffic, de-anonymize a VPN peer's source IP, or portscan a peer hidden behind a VPN server — all without compromising the VPN's cryptographic layer. Four concrete attacks are demonstrated; formal model checking with bounded model checking verified six process-isolation mitigations that prevent the shared-resource collision.

2024-mixon-baca-snitch Abstract, §3, §5 middlebox-interferencepacket-injectionflow-correlation

In Brunei, censorship is confined to AS10094, which serves approximately 70% of the country's Internet users. The censor injects RST packets bearing a distinctive fingerprint — the censored query's IP ID field — in response to HTTP requests containing censored Host headers, and censors on all ports without residual censorship. A SYN followed immediately by a PSH+ACK with a censored payload is sufficient to trigger blocking without a completed TCP handshake.

2023-nourin-detecting §3 rst-injectionpacket-injectionmiddlebox-interference

Geneva — originally designed to evolve censorship-evasion packet sequences — was repurposed by inverting its fitness function to discover censorship-triggering packet sequences instead. Training against non-responsive IP addresses allows Geneva to attribute all responses to middleboxes, enabling fully automated discovery of triggering strategies without any endpoint cooperation.

2023-nourin-detecting §2 measurement-platformpacket-injectionmiddlebox-interference

Tajikistan routes virtually all national egress and ingress traffic through a single state-run AS (AS51346, Tojiktelecom) under a 2016 national decree, creating a centralized chokepoint. The censor injects RST+ACK packets with a unique 22-byte all-zero payload, censors on all ports, and requires two PSH+ACK packets containing the censored content before injecting — possibly modeling typical multi-resource HTTP browsing behavior.

2023-nourin-detecting §3 rst-injectionpacket-injectionmiddlebox-interference

Internet-wide IPv4 scanning found 386,187 IP addresses yielding amplification factors ≥ 100× via TCP middlebox reflection, with 82.9% of responses from the top 1 million IPs confirmed as originating from on-path middleboxes rather than endpoints. Nation-state censorship infrastructure dominates: China's GFW alone accounts for approximately 154 million responding IP addresses sharing a 3× RST+ACK (54 bytes each) fingerprint.

2021-bock-weaponizing §5.3, §5.5, Table 4 middlebox-interferencerst-injectionpacket-injectionmeasurement-platform