PaperlayerView exact revision on arXiv

Source-linked AI summary

Evaluating Practical Enumeration and Blocking Attacks on the Snowflake Circumvention System

Linden Chen, Ryan Sangha, Cecylia Bocovich, Ram Sundara Raman

arXiv:2609.12242v2cs.CR

TL;DR

The paper asks whether malicious clients can enumerate Snowflake proxies and block them without substantial collateral damage. It combines bounded live measurements with large-scale simulation, finding that churn limits enumeration over time but network-level blocking can disrupt many observed proxies with limited overlap among popular web domains.

  • Problem

    The paper asks how resistant Snowflake is in practice to active enumeration and blocking by censors posing as legitimate clients, a question not empirically tested by analyses focused on traffic characteristics.

    Source: §1 · p. 1

  • Method

    The authors combine bounded live broker measurements with controlled simulation to study deployed proxy churn and demand effects alongside broader attacker settings.

    Source: §1 · p. 2

  • Results

    Blocking the top 1% of observed ASes disrupts over 30% of observed proxies, affects no Tranco Top 100 domains, and overlaps 2.45% of Tranco Top 1M domains.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Snowflake is not trivially enumerable, but practical attackers can identify networks hosting many proxies and enable network-level disruption with relatively low collateral cost.

    Source: §10 · p. 14

    The study does not perform real-world blocking, and its collateral analysis measures web-domain overlap rather than broader social, economic, or connectivity costs.

    Source: §8 · p. 13

Abstract

from arXiv · show

Proxy-based Internet censorship circumvention tools like Snowflake rely on large, dynamic pools of third-party proxies to resist IP-based blocking. We focus on two assumptions underpinning the security of Snowflake: that adversaries cannot easily enumerate proxy IPs, and that blocking those proxies would incur unacceptable collateral damage. In this paper, we test these assumptions by studying practical enumeration and blocking attacks against Snowflake conducted by malicious clients. We combine bounded, ethical real-world measurements with large-scale simulation to evaluate both present-day enumeration and blocking risk and broader attacker capabilities. Over 48 days of real-world measurements from May--June 2025, our attack enumerated over 21,000 unique proxy IP addresses belonging to almost 1,000 autonomous systems. Despite this high number, we find that proxy churn limits the overall effectiveness of enumeration over time, and reduces the impact on clients of individual proxy addresses being blocked. However, at the network level, blocking the top 1% of observed autonomous systems blocks more than 30% of observed Snowflakes while affecting 0% of Tranco Top 100 domains and ~2.5% of Top 1M domains. We discover that the broker's load-aware matching reveals stable, high-capacity proxies to attackers early, especially during periods of elevated demand such as the censorship even in Iran of June 2025, subsequently exposing the networks that contribute disproportionately to system connectivity. In simulation, increasing attacker scale sharply improves both enumeration and blocking success, while higher proxy churn significantly reduces blocking effectiveness. We conclude by discussing and evaluating practical mitigations, some of which have been integrated into Snowflake.

1 Introduction

The paper tests whether malicious clients can enumerate Snowflake proxies and use that visibility for blocking, combining bounded live measurements with simulation. It finds that churn limits enumeration over time, but broker matching exposes stable, high-capacity proxies and concentrated networks that can be blocked with limited web-domain overlap.

Empirical real-world evaluation of a deployed circumvention tool

  • Two low-rate malicious clients enumerated over 21,000 unique proxy IPs across almost 1,000 ASes during 48 days of live measurements.The measurements ran from May to June 2025.Source: §1 · p. 2

Full-scale controlled analysis of enumeration and blocking

  • The authors combine bounded, ethical live measurements with a Snowflake-specific simulator to study enumeration and blocking under broader attacker settings.The simulator supports full-scale experiments and evaluates attacker scale, proxy churn, connection duration, and candidate defenses.Source: §1 · p. 2

Empirical real-world evaluation of a deployed circumvention tool

  • Blocking the top 1% of observed ASes disrupts over 30% of observed proxies, affects no Tranco Top 100 domains, and overlaps 2.45% of Tranco Top 1M domains.The broker’s load-aware matching surfaces stable, high-capacity proxies with disproportionate blocking value; elevated demand during the June 2025 Iran shutdown shifted visibility toward a smaller, more stable, infrastructure-heavy subset.Source: §1 · p. 2
  • The study finds that proxy churn limits enumeration, while broker load-aware matching repeatedly exposes stable, high-capacity proxies with disproportionate blocking value.The June 2025 Iran shutdown shifted attacker visibility toward a smaller, more stable, infrastructure-heavy subset of proxies.Source: §1 · p. 2

Security implications and actionable mitigations

  • The authors quantify malicious proxies’ disproportionate share of client assignments and discuss rate limiting and broker-scheduled polling as defenses.They worked with Snowflake maintainers on mitigations, including patches for broker-scheduled polling that have progressively been integrated into the codebase [Reference Blinded].Source: §1 · p. 2

2 Background

The background describes censorship methods and circumvention approaches, then explains Snowflake’s rendezvous and matching design. Snowflake relies on a broker to match clients with available volunteer proxies before they establish direct communication.

2.1 Internet Censorship & Circumvention

  • Internet censorship can use DNS manipulation, IP blocking, and HTTP(S) or other application-layer blocking.Source: §2.1 · p. 2
  • Circumvention tools use proxy routing, steganography, or packet manipulation; Snowflake combines ephemeral volunteer proxies with traffic obfuscation.Snowflake is the paper’s focus among these approaches.Source: §2.1 · pp. 2–3

2.2 Snowflake

  • Snowflake’s rendezvous phase matches clients with available proxies through a centralized broker, followed by WebRTC connection establishment and data transfer to a Tor bridge.The paper focuses mainly on rendezvous and connection establishment.Source: §2.2 · p. 3
  • NAT compatibility shapes broker matching: unrestricted proxies are typically high-capacity standalone hosts, while restricted or unknown proxies are more plentiful browser extensions or mobile apps.Source: §2.2 · p. 3
  • Clients send SDP offers while proxies poll with NAT and self-reported load metadata; the broker prioritizes lower-load proxies and relays signaling before client-proxy communication proceeds directly.Source: §2.2 · p. 3

3 Threat Model

The threat model considers client-side enumeration of broker-returned proxy addresses and subsequent blocking of proxy IPs or networks. It also examines a malicious proxy that exploits the broker’s lack of proxy-side rate limits to influence matching.

3 Threat Model

  • An adversary acting as a client can enumerate proxy IPs returned by the broker, learning network concentrations and identifying blocking targets.The paper treats enumeration and blocking as linked attacks; successful blocking may make proxy-based circumvention unusable.Source: §3 · p. 3
  • The enumeration attacker needs no privileged access or large infrastructure and can repeatedly poll the public broker interface as an ordinary client.Snowflake has no client-poll rate limits, so multiple clients can increase coverage.Source: §3 · p. 3
  • The blocking attacker can block individual enumerated proxy IPs or entire AS-level networks, but simulations assume blocked proxies are inaccessible to all clients.Nation-state adversaries can exercise these blocking capabilities.Source: §3 · p. 3
  • A malicious proxy can exploit the absence of proxy-side rate limits to influence its heap position and target clients rather than proxies.The paper considers this as a separate case study.Source: §3 · p. 3

4 Methods and Experiments

The study pairs ethically bounded measurements of the live broker with controlled simulation to capture deployed behavior while testing broader conditions. The simulator preserves broker interactions at full network scale but abstracts away dataplane behavior, so its absolute coverage and retry estimates are model-dependent.

4 Methods and Experiments

  • The study pairs live measurements, which capture broker behavior and deployment effects, with simulation for counterfactuals and conditions that cannot be safely manipulated in production.The simulation design is grounded in live observations; the study received safety-board review, used bounded low-rate live probers, and ended measurements during heightened demand.Source: §4 · pp. 3–4

4.1 Real-world Measurements

  • Two low-rate probers targeted Snowflake’s restricted and unrestricted pools, and the 48-day measurement recorded 13,152 and 8,291 unique proxy IP hashes, respectively.The study stored keyed hashes and AS numbers rather than raw proxy IPs; it stopped during increased demand associated with Iran’s shutdown.Source: §4.1 · p. 4

4.2 Simulation Experiments

  • The simulator runs Snowflake broker code with lightweight client and proxy abstractions, preserving broker matching and asynchronous interactions at 100% network scale.It abstracts away full Tor and WebRTC traffic, latency, packet loss, and transport failures, so absolute coverage and retry values are model-dependent.Source: §4.2 · pp. 4–5

4.2.1 Default Simulation Settings.

  • Default simulations model three proxy classes, a 2.7% hourly churn rate, roughly 61,600 clients, and 32 attackers polling once per simulated second after warm-up.The simulator uses public metrics for proxy counts and client NAT types; connections have a default mean duration of three hours with a 30-minute standard deviation.Source: §4.2.1 · pp. 5–6

4.2.2 Simulation Experiments.

  • Experiments vary attacker fractions, proxy churn, and matched-proxy connection durations to measure effects on enumeration, blocking, and retry behavior.Attacker fractions include 0.001%, 0.01%, 0.1%, and 0.5%, alongside the default 0.05%; churn settings range from 0.675% to 10.8% per hour.Source: §4.2.2 · p. 6

5 Results

Real-world measurements show that proxy churn slows sustained IP discovery, while network concentration makes ASN-level blocking powerful with comparatively low domain collateral. Simulations show that attacker scale, churn, and session duration shape enumeration and client retry burden.

5.1.1 Proxy Enumeration.

  • Over 48 days, attackers enumerated 13,152 restricted and 8,291 unrestricted proxy IPs, but new discoveries per 1,000 successful responses fell from 67.3 to 17.7.Attackers reached 50% of their final observed IP tallies by May 26 and 80% by June 8; churn limits sustained visibility.Source: §5.1.1 · p. 6
  • The broker's load-aware matching exposes stable, high-capacity proxies disproportionately: the top 1% of returned proxies comprise 35.8% of observed restricted and 28.3% of unrestricted pools.The most frequently returned proxy appeared 15,830 times in the restricted pool and 6,663 times in the unrestricted pool.Source: §5.1.1 · pp. 6, 8
  • During Iran ramp-up, active proxy IPs fell 38.1%; ISP observations declined 46.5%, while Hosting observations fell 5.5%, consistent with lightweight ISP proxies being occupied by increased demand.ISP proxies can serve one client, whereas larger standalone proxies in Hosting networks can handle multiple clients.Source: §5.1.1 · pp. 6–7, Figure 3 · p. 7

5.1.2 Proxy Blocking.

  • Blocking the top 1% of observed ASNs covers 30.1% of restricted and 30.9% of unrestricted proxies, affecting 0% of Top 100 and 2.45% of Top 1M domains.ISP networks host more than 80% of observed proxies and induce less than 10% domain collateral; hosting networks contribute fewer proxies but much higher collateral.Source: Figure 5 · p. 8, §5.1.2 · pp. 8–9, Figure 6 · p. 9
  • ASN blocking raises expected retries by June 24 to 1,349 for restricted and 3,014 for unrestricted proxies, while IP blocking reaches 26.5 and 24.6, respectively.An IP blocklist covers 79.3% of next-day observed proxies, falling to about 65% after two weeks, so it must be refreshed.Source: §5.1.2 · p. 8, Figure 4 · p. 8

5.2.1 Enumeration Attack.

  • In 30-day simulations, enumeration reached 70.71% with two attackers and 93.88% at a 0.01% attacker fraction; the default setting reached 94.65%.At the simulated attacker scale, higher churn slightly increased cumulative coverage, but with only two attackers it reduced enumeration success.Source: §5.2.1 · p. 9

5.2.2 Blocking Attack.

  • Blocking harm rises with lower churn: 0.25× churn yields 99.80% unsuccessful requests and a median 14 retries, while 4× churn yields 31.42% and a median 1 retry.With 30m ± 5m sessions, unsuccessful requests reach 99.70% and median retries reach 200; in the default case, the day-30 unsuccessful-request rate is 86.16% with a median of 3 retries.Source: §5.2.2 · pp. 10–11

5.2.3 Case Study: Slower Churn Standalone Proxies.

  • For standalone proxies, reducing churn to one-tenth of default lowers day-30 enumeration coverage from 94.21% to 89.43% but increases mean client retries by 5.At day 5, coverage is 51.95% at one-tenth churn versus 67.88% at the default rate.Source: §5.2.3 · p. 11, Figure 9 · p. 11

6 Practical Malicious Proxy Attack

A malicious proxy can exploit the broker’s load-based priority ordering to attract client assignments. In simulation, two such proxies received nearly one-fifth of requests, creating both privacy and availability risks.

6 Practical Malicious Proxy Attack

  • Because the broker does not rate-limit proxy polls, a malicious proxy can report −1 clients and move to the front of its priority heap.Benign proxies report at least 0 clients.Source: §6 · p. 11
  • Two aggressively polling malicious proxies received 19.8% of client requests on average over a 15-day simulation.Both proxies reported −1 clients, placing them ahead of benign proxies in the broker’s priority heap.Source: §6 · p. 11
  • A malicious proxy can learn client IP addresses or refuse to relay traffic, exposing clients to targeted monitoring or forcing retries.The authors say the attack can disproportionately reveal client IPs, which could be correlated with other network observations.Source: §6 · p. 11
  • The negative-client-count exploit was known to maintainers, and the authors’ evaluation quantifies its effects.The authors informed the maintainers promptly.Source: §6 · p. 11

7 Defenses and Mitigations

The proposed defenses target attacker access to rendezvous requests, repeated exposure of stable proxies, and the persistence of blocklists. The section weighs rate limiting, broker-scheduled proxy polling, and increased proxy churn against deployment constraints and client impact.

7 Defenses and Mitigations

  • The defenses target attacker request share, broker-amplified exposure of stable proxies, and how quickly blocklists decay.The authors note that sufficient attacker activity can enumerate most proxies even under substantial churn, while blocking harm depends on repeated exposure and proxy usefulness over time.Source: §7 · p. 11

7.1 Rate Limiting Client Polls

  • IP-based client rate limits are difficult to apply fairly because retries may be needed, users share IPs, and client-identifying signals can be unreliable or spoofed.Snowflake explored but ultimately decided not to limit client polling.Source: §7.1 · p. 12
  • Privacy-preserving effort limits, such as proof of work, anonymous credentials, or retry tokens, are proposed as alternatives to raw-IP rate limits.The authors note that balancing enumeration resistance with honest-client availability remains difficult.Source: §7.1 · p. 12

7.2 Broker-Scheduled Proxy Polling

  • Broker-scheduled equal-rate proxy polling is proposed to prevent high-capacity or aggressive proxies from polling more often and crowding out others.The authors recommend setting the equal polling rate as low as client demand allows.Source: §7.2 · p. 12
  • Longer equal polling intervals reduced unsuccessful benign requests and the upper tail of client retries in simulation.The evaluation compared 10-, 120-, and 240-second intervals; Figure 10 shows unsuccessful-request percentages and retry distributions.Source: §7.2 · p. 12, Figure 10 · p. 12
  • Dynamic broker-scheduled polling can reduce malicious proxies’ ability to crowd out honest proxies and support broker-side tracking of availability and assignments.The authors report that Snowflake progressively implemented broker-scheduled polling and broker-side rate limits, while interval selection and adjustment remained ongoing work.Source: §7.2 · p. 12

7.3 Increase Proxy Churn

  • Increasing proxy churn significantly reduced the attempts needed for a client to match with an unblocked proxy in prior simulations.The authors suggest Spot VMs could increase churn while retaining unrestricted NAT benefits associated with VPS hosting.Source: §7.3 · p. 12

8 Discussion

The discussion argues that proxy-pool size alone does not determine enumeration resistance: broker exposure patterns, capacity, address staleness, and network concentration also matter. It also frames ethical constraints and several scope boundaries for interpreting the measurements and simulations.

Implications for Proxy-Based Circumvention Systems

  • Enumeration resistance depends on which proxies the broker repeatedly exposes, their client capacity, how quickly observed addresses become stale, and network concentration—not just pool size.Stable, high-capacity Snowflake proxies are exposed more often, making partial enumeration useful; the authors suggest this lesson may extend to Psiphon, depending on its discovery and matching design.Source: §8 · pp. 12–13

Ethical Measurement of Live Circumvention Systems

  • The study’s safety-first design constrained the strength and duration of live measurements to avoid harming a deployed system used by at-risk users.The authors present bounded measurements, operator coordination, and simulation as a model for future deployed-system studies.Source: §8 · p. 13

Limitations and Future Work

  • The study did not perform real-world blocking, and its collateral analysis covers web-domain overlap rather than broader social, economic, or connectivity costs.The simulator also abstracts away full WebRTC/Tor traffic, packet loss, and latency, and simplifies churn; its results are primarily comparative trends, not precise absolute estimates.Source: §8 · p. 13
  • Findings reflect Snowflake’s current design and deployment and may change as defenses are integrated.The authors note that future work can evaluate changes using their open-source tools.Source: §8 · p. 13

9 Related Work

Prior work studied traffic fingerprinting, active probing, bridge discovery, and proxy-distribution strategies. This paper distinguishes its focus on broker-based enumeration and network blocking of Snowflake, combining live measurements, behavior-grounded simulation, and collateral-damage analysis.

9 Related Work

  • Earlier work detected circumvention through traffic features or active probing, while this study enumerates proxies by querying Snowflake’s centralized broker.Prior work includes traffic fingerprinting [22] and defenses against active probing.Source: §9 · p. 13
  • Unlike Internet-wide scanning that located 86% of hidden Tor bridges, this work actively enumerates proxies through Snowflake’s broker.The authors distinguish Snowflake’s ephemeral proxies and broker-reported prioritization from Tor bridges’ longer-term fingerprints and directory authorities.Source: §9 · p. 13
  • Tor-bridge discovery differs from Snowflake enumeration because Snowflake has a much larger, more dynamic proxy pool and CAPTCHA-based countermeasures are unsuitable.The passage contrasts roughly 2.5K Tor bridges with more than 100K Snowflake proxies.Source: §9 · p. 13
  • Proxy-distribution studies model strategies or simulate them, while this work adds live-system measurements, behavior-grounded large-scale simulation, and network-blocking collateral analysis.Related work includes game-theoretic proxy distribution, SpotProxy, and later extensions of the simulation framework.Source: §9 · pp. 13–14

10 Conclusion

The study finds that Snowflake can be enumerated and disrupted at the network level, while attacker scale and proxy churn shape attack success. It evaluates practical mitigations intended to reduce attacker visibility and blocking impact.

10 Conclusion

  • Malicious clients can quickly enumerate stable, high-capacity proxies, and AS-level blocking can be effective with limited collateral cost.Attacker scale and proxy churn significantly affect attack success.Source: §10 · p. 14
  • The paper combines a bounded 48-day live measurement with full-scale controlled simulation to assess enumeration and blocking risk in deployed Snowflake.Source: §10 · p. 14
  • The authors discuss and evaluate practical mitigations that can reduce attacker visibility and blocking impact.Source: §10 · p. 14

Generative AI Usage

This section describes the study’s artifacts and ethical safeguards, then reports network-level blocking and blocklist-stability findings. It also documents AI assistance used in developing and presenting the simulation work.

Generative AI Usage

  • The authors used generative AI primarily to assist with simulation-tool performance optimizations, documentation, plots, and writing, with generated content reviewed manually.The core design and initial implementation were carried out manually by the authors.Source: Generative AI Usage · p. 15

A Open Science

  • The authors made the simulation and measurement code and data available, while withholding raw proxy IP addresses and keyed hashes.The artifacts include a modified probing client, aggregate measurement data, and simulation code and data.Source: A Open Science · pp. 15–16

B Ethical Considerations

  • The researchers used two bounded, low-rate probers and shifted resource-intensive analyses to simulation to limit risk to the broker, proxies, and users.The conservative design limited modeling of stronger adversaries using many clients at higher rates.Source: B Ethical Considerations · p. 16
  • To protect volunteer proxy operators, the study stored keyed IP hashes rather than raw addresses and released aggregate data rather than individual hashes and timestamps.The random key remained in RAM and was discarded when the program exited.Source: B Ethical Considerations · p. 16
  • Live measurements ended after capturing initial behavior under elevated demand during the Iran shutdown, shortening the planned longitudinal study to reduce burden on the ecosystem.The authors had initially planned six to twelve months of longitudinal probing.Source: B Ethical Considerations · p. 16
  • Publication and artifact release could ease enumeration or blocking, but the authors judged privacy-preserving publication and coordinated disclosure to have greater long-term benefit.They note that the described attacks use public interfaces and could be independently discovered by a capable adversary.Source: B Ethical Considerations · pp. 16–17

C Real-World Blocking Attack: Network Blocking Strategies

  • Blocking the most frequent observed AS covers about 30% of proxies, while the top 5% of observed ASes cover more than 50%.Frequency-based ordering is more effective than ordering by AS population or cone size; targeting large-population networks may increase collateral for gaming and file-sharing applications.Source: C Real-World Blocking Attack: Network… · p. 17, Figure 11 · p. 17

D Real-World Blocking Attack: Blocklist Stability

E Simulation Attack: 30m Default Connection Duration Results

With a 30-minute connection-duration setting, the direction of enumeration and blocking trends remains consistent with the 180-minute baseline. Shorter connections substantially increase the absolute blocking impact on clients.

E Simulation Attack: 30m Default Connection Duration Results

  • A 30-minute connection duration preserves the baseline trends: more attackers increase enumeration coverage, while higher churn slightly increases cumulative coverage.New proxies without active clients receive high priority in the broker heap and are readily exposed to attackers.Source: E Simulation Attack: 30m Default… · p. 18
  • Before day 5, the cumulative unsuccessful-request rate approaches 100%, and mean retries among requests requiring at least one retry exceed 100 under default attacker and churn settings.Source: E Simulation Attack: 30m Default… · p. 18
  • Shorter connections increase blocking harm because clients and proxies re-enter the rendezvous process more often, leading clients to encounter blocked proxies repeatedly.Increasing attacker fraction or reducing proxy churn raises unsuccessful rendezvous attempts and client retry burden.Source: E Simulation Attack: 30m Default… · p. 18

F Simulation Enumeration Attack: Proxy-Type Results

Simulation results show that enumeration trends generally hold across Snowflake proxy types, with pool size qualifying the effect of attacker scale. Blocking disproportionately burdens restricted-NAT clients compared with unrestricted-NAT clients.

F Simulation Enumeration Attack: Proxy-Type Results

G Simulation Blocking Attack: Client NAT-Type Results

  • Restricted-NAT clients generally experience more unsuccessful requests and a higher retry burden than unrestricted-NAT clients across settings.Unrestricted clients can match with the larger, more dynamic restricted-proxy pool; restricted clients use the smaller unrestricted-proxy pool, which is easier to enumerate.Source: G Simulation Blocking Attack: Client… · p. 18, Figure 17 · p. 21
Loading 2609.12242v2…