Maria Xynou, Arturo Filastò2021-10-21
Signal Private Messenger, commonly used byhuman rights defenders worldwide, is widely considered thestate-of-the-art app for private and secure communications. But as itspopularity surgedrecently, we have started to observe itsblockingin several countries.
In this report, we share our analysis of OONI network measurement dataon the blocking of the Signal Private Messenger app in Iran, China,Cuba, and Uzbekistan.
Currently, circumvention is enabled by defaultfor Signal users in Iran, Egypt, Oman, Qatar, and the UAE. If Signalusers in other countries are unable to use the app, they can enable the“Censorship Circumvention” setting on iOS. On Android, Signal blockingcan be circumvented through the use of Signal TLS proxies.
Background
Methods
Findings
Iran
China
Cuba
Uzbekistan
Conclusion
Acknowledgements
Signal is a free and open source messaging appfor encrypted voice calls and instant messages, developed by anindependent non-profit organization (Signal Foundation, the successor of Open Whisper Systems).
Signal provides security by encrypting communications in transit(end-to-end encryption) and by ensuring that past communications aresecure even if encryption keys are stolen (forward secrecy). Over theyears, a number of high profile security experts and anti-surveillanceactivists have strongly recommended using the Signal app for private andsecure communications.
Edward Snowden(the whistleblower who became famous in 2013 after leaking secret NSAdocuments, exposing vast surveillance capabilities) hasstatedthat he uses Signal every day. Bruce Schneier, an internationally renownedsecurity technologist, said:
“I am regularly impressed with the thought and care put into both thesecurity and the usability of this app. It’s my first choice for anencrypted conversation."
Signal’s protocol for end-to-end encryption has been integrated byseveral other applications with large global user bases. Notably,WhatsApp integrated the Signal protocolin 2016, bringing end-to-end encryption to a billion users worldwide.
But even though Signal and WhatsApp now use the same protocol forend-to-end encryption, the Signal app is still considered more securebecause it’s open source, enabling independent security review of theoverall app (unlike WhatsApp, which is closed source). Both Signal andWhatsApp require a phone number for the creation of an account. It’sworth highlighting that WhatsApp only encrypts the content ofcommunications, while Signal encrypts both communication content andmetadata (such as who youcontact).
This means, for example, that WhatsApp knows who you communicate with,knows the name of each WhatsApp group and who is in it, and knows theprofile picture of every user and group. Signal, on the other hand,never knows who you communicate with and how often, does not know thename of any group or who’s in each group, and does not have access toindividual or group profile pictures. This difference between Signal andWhatsApp (in terms of access to metadata) is particularly important forvulnerable individuals and groups (such as human rights activists).
Signal is created by a non-profit organization whosemission is to “protect freeexpression and enable secure global communication”. WhatsApp, on theother hand, is owned by Facebook, whose business model is rooted inadvertising (fuelled by data mining). When WhatsApp first integrated theSignal protocol in 2016, they provided users the ability to opt-out ofsharing metadata with Facebook. However, the reference to this opt-outoption was removed from WhatsApp’s privacy policy in January 2021, sparkinga major public backlash.Yet, rather than changing the policy that sparked the controversy,WhatsApp extended the deadline that required users to accept the policy changes,without which the app is gradually rendered unusable.
As a result, Signal saw a new surge in global usageearlier this year. Signal was also endorsed by Elon Musk,among other influential people. Over the last months, millions of peopleworldwide haveflockedto Signal (andTelegram) over privacy concerns, triggered byWhatsApp’s latest privacy policy update.
But as Signal popularity increased, so have concerns that the app may betargeted for censorship – particularly as part of broader social mediablocks (which tend to occur during political events around the world). In recent months,our community members have reported that they could not use Signal incertain countries, requesting that we develop a new network measurementexperiment specifically designed to measure the reachability of theSignal Private Messenger app. Wereleased thistest in April 2021, and we sharethe findings from our analysis in this report.
Since 2011, the OONI team has developed free and open source software tests designed tomeasure internet censorship and other forms of network interference.These tests are shipped as part of the OONI Probe app, which is available for bothmobile anddesktop platforms.
More specifically, the OONI Probe app includestests for measuring the blocking of websites; the blocking ofinstant messaging apps(WhatsApp, Facebook Messenger,Telegram); the blocking ofcircumvention tools (Tor,Psiphon,RiseupVPN); and network speed and performance.
Every month, OONI Probe is run by users in around 200 countries and territories, who perform tests on theirlocal networks. As soon as they run OONI Probe, they immediately haveaccess to the test results directly in their OONI Probe app. To increasetransparency of internet censorship worldwide, OONI Probe measurementsare automatically sent to OONI servers,processed, and published as open data in near real-time. OONI data hassupported research and advocacyefforts worldwide, particularly those examining the blocking of social media apps.
In April 2021, we released a new OONI Probe test for the Signal Private Messenger App. We prioritizeddeveloping this test in response to community requests, and because westarted to hear reports of its blocking. As the global use of Signalincreased significantlyover the last months, so did the need to measure its reachability andprovide open data.Moreover, as Signal is increasingly being used by activist communities,the risk of it being blocked has increased – particularly duringpolitical events (such as elections andprotests).
The OONI Probe Signal testis designed to measure the reachability of the Signal messaging appwithin a tested network. To this end, this test checks whether it’spossible to establish a TLS connection (while validating the TLScertificate against the custom Signal CA root certificate) and send anHTTP GET request to the Signal server backends from the vantage point ofthe user. If the test successfully performs an HTTPS request to thetested Signal endpoints, the Signal app is considered reachable from thetested network. If, however, connections to any of the tested Signalendpoints fail, the Signal measurement is flagged as“anomalous”,indicating that Signal might be unreachable or blocked on the testednetwork.
It’s important to highlight though that false positives canoccur. OONI Probe Signal measurements may present anomalies due toseveral reasons which are unrelated to the intentional blocking ofSignal. For example, false positives can occur due to transient networkfailures, if the Signal backend infrastructure is down, or if Signalmakes changes to their infrastructure which affects how this test isperformed.
It is therefore necessary to look at measurements in aggregate inorder to check if the same types of anomalies are persistent on the samenetwork over time. In other words, if the testing of Signal providesanomalies (with the same errors in the raw network measurement data)every time that it is tested on a specific network, those measurementsmay provide an indication that access to Signal is blocked on thatnetwork (particularly if Signal is reachable on other networks). If,however, a large volume of Signal measurements show that the app isreachable on a network, the few anomalous measurements may be falsepositives.
As part of this study, we analyzed all OONI Probe Signal measurementscollected from around the world since the release of the OONI Probe Signal test, between 1st April2021 to 15th September 2021. This means that if Signal was onlyblocked in certain countries before this testing period, we do nothave relevant measurements and have therefore excluded those cases fromthis study. In December 2016, for example, Signalreportedthat its service was blocked in Egypt. In response, Signal added support for domain frontingto make Signal traffic look no different from a Google search; thiswould require censors to block Google in order to block Signal. ButEgypt did precisely that, inadvertently resulting in collateral damage.Recent OONI Probe Signal measurements from Egyptsuggest that the app is now reachable, which is why it has been excludedas a case study in this research.
Moreover, the volume of OONI measurements varies from country tocountry, and from network to network within countries. The availabilityof Signal measurements depends on when OONI Probe users run the Signaltest, which countries those OONI Probe users are in, and on which ASnetworks they run the test on. As a result, the decentralizedcrowdsourcing nature of Signal measurements means that there isvariance in global measurement coverage, presenting another limitationto the findings of this study.
To explore where Signal is potentially blocked, we started off bynarrowing down our analysis to the countries where the testing of Signalpresented a relatively high volume ofanomalies(in comparison to the overall number of “reachable” Signal measurementsper country). We further limited our analysis to the countries whichpresented the highest volume of anomalies, while excluding cases (andcountries) where anomalies appeared to be false positives, or whichreceived limited testing coverage (such asOmanandQatar).This left us withIran,China,Cuba,andUzbekistan– all of which presented a relatively high ratio of anomalousmeasurements, suggesting potential Signal blocking.
To explore further, we inspected the raw measurement data in anomalousSignal measurements fromIran,China,Cuba,andUzbekistanwith the goal of better understanding the means by which the Signalblocking is implemented in each of those countries. We share ouranalysis findings in the following sections.
OONI data analysis suggests that the Signal Private Messenger app has been blocked over the last months inIran,China,Cuba,andUzbekistan.
Our findings are summarized in the following chart, which illustratesthat the testing of Signalpresented anomalies in China, Cuba, Iran, and Uzbekistan during theanalysis period.
Source: OONI measurements on the testing of the Signal PrivateMessenger app in China, Cuba, Iran, and Uzbekistan between April 2021 toSeptember 2021, https://explorer.ooni.org/search?until=2021-10-01&since=2021-09-01&test_name=signal
As is evident through the above charts, the testing of Signal presentedsigns of blocking in China, Iran and Uzbekistan throughout the wholetesting period. This not only provides a strong signal of blocking(since we observe anomalies on multiple AS networks over a relativelylong timeline), but also suggests that the blocking of Signal is ongoingin these countries. In Cuba, on the other hand, the blocking of Signalappears to have been temporary, as most anomalous measurements werepresent in mid-July 2021 (while most measurements collected thereaftershowed that Signal was reachable).
Out of the four countries, Cuba and Uzbekistan received the leasttesting coverage, presenting a limitation in our findings. Signal wastested sporadically in Uzbekistan during our analysis period, butpresented signs of blocking every time it was tested. In Cuba, Signalwas primarily tested from mid-July onwards, likely in response tosocial media blocks amid mass protests.
In both China and Iran, the testing of Signal has presented a relativelyhigh volume of anomalies, with Iran receiving the most consistenttesting coverage throughout the analysis period. Measurements collectedfrom China and Iran therefore provide a strong signal regarding theblocking of the Signal messenger app.
Apart from these four countries, we also observe signs of potentialSignal app blocking in the United Arab Emirates (UAE)– the blocking of which wasreported as farback as 2017. OONI data (below)showsthat ISPs in the UAE only appear to be blocking Signal’s VoIP endpoint(sfu.voip.signal.org), while all other tested endpoints werereachable. It’s worth highlighting though that the OONI Probe Signal test only issues a single HTTPSrequest to the endpoints, which means that it might not be able tocapture the blocking if it only happens after a certain amount oftraffic is exchanged with the endpoints.
While it’s possible that the UAE may be blocking the VoIP service ofSignal, we have excluded the UAE from the case studies of this reportbecause the country received relatively limited Signal testing coverageduring our analysis period, and many of the anomalous measurements werequite inconclusive. In recent weeks though, Signal measurement coveragehas increased significantly in the UAE, with most measurements suggesting Signal blockingin the country.
It’s worth noting that the UAE (along with Egypt, Oman, Qatar, and Iran)is among the countries for which Signal enables censorship circumvention by default.Egypt, though, has been excluded from the case studies of this reportbecause recent OONI measurements suggest that Signal now worksin the country. While bothOmanandQatarpresent signs of potential Signal blocking, they have both been excludedfrom this report’s case studies because they received very limitedSignal testing coverage during our analysis period.
In the following sections, we provide a per-country breakdown of ouranalysis and findings for Iran, China, Cuba, and Uzbekistan.
Iran
OONI data strongly suggests that Signal is blocked in Iran.
The blocking of Signal in Iranreportedlybegan in January 2021, once Iranians flocked to the messaging platformover privacy concerns following WhatsApp’s controversial privacy policy update.In response, Signal immediately added support for a simple TLS proxy that can be usedto circumvent the block and securely route traffic to the Signalservice. While this has hopefully enabled many Iranians to circumventthe block and use Signal, OONI datashowsthat the blocking of Signal continues to be enforced in Iran.
Signal has been tested in Iran quite consistently between April 2021 toSeptember 2021, during which most measurements presented signs ofblocking. The blocking of Signal in Iran is not only suggested by therelatively large volume of anomalous measurements, but also by the factthat such anomalies were found on multiple AS networks in the country,as demonstrated through the following chart.
Source: OONI measurements on the testing of the Signal PrivateMessenger app across AS networks in Iran between April 2021 to September2021, https://explorer.ooni.org/search?until=2021-10-01&since=2021-09-01&test_name=signal&probe_cc=IR
The above chart shows that the Signal messenger app was found blockedconsistently on all measured networks in Iran between April 2021 toSeptember 2021. These include 32 distinct AS network vantage points.
On many networks, the blocking of Signal appears to beperformedat a DNS level by returning the IP address 10.10.34.35, which iscommonly used to serve the Iranian blockpage.
Specifically, the domain names api.directory.signal.org,storage.signal.org, cdn.signal.org, uptime.signal.org,cdn2.signal.org, and sfu.voip.signal.org all resolve to the IP10.10.34.35. The following snippet (taken from a relevant OONI measurement)illustrates this.
It’s worth noting though that the domain nametextsecure-service.whispersystems.org does not appear to beaffected by DNS level interference and is not impacted by the block.
Iran appears to block Signal by means of bidirectional DNS injection, assuggested by the fact that DNS queries from outside the country also result ininjected responses, even though they target a publicly routed IP in Iran thatdoes not run a DNS server.
$ dig +short signal.org @tehran.ir 10.10.34.35Recent OONI measurements suggest that Signal remains blockedon many AS networks in Iran.
China
OONI data also indicates that Signal is blocked in China,the blocking of whichreportedlybegan in mid-March 2021.
The following chart aggregates Signal measurement coverage from 28distinct AS networks in China between April 2021 to September 2021.
Source: OONI measurements on the testing of the Signal PrivateMessenger app across AS networks in China between April 2021 toSeptember 2021, https://explorer.ooni.org/search?until=2021-10-01&since=2021-09-01&test_name=signal&probe_cc=CN&only=anomalies
As is evident through the above chart, the testing of Signalconsistently presented signs of blockingon most AS networks in China during our analysis period.
China appears to block of Signal at a DNS levelby returning IP addresses which are not associated with the Signalbackend services. But instead of returning the IP of a blockpage, weobserve the typical pattern of the Great Firewall of China, returningIP addresses inside of random IP ranges.
Similarly to Iran, China appears to block Signal by means of bidirectional DNSinjection, as suggested by the fact that DNS queries from outsidethe country also result in injected responses, even though they target apublicly routed IP in China that does not run a DNS server.
$ dig +short cdn.signal.org @14.121.1.069.171.233.24$ dig +short cdn.signal.org @14.121.1.0202.160.128.210Moreover, we observe that the block also targets non-existentsignal.org subdomains, such as doesnotexist.signal.org:
$ dig +short doesnotexist.signal.org @14.121.1.0202.160.128.16Recent OONI measurements suggest that Signal remains blockedon many AS networks in China.
Cuba
OONI data suggests that Signal was temporarily blocked in Cuba in mid-July 2021,amid mass anti-government protests.
As Cuba only has one AS network (AS27725 - ETECSA), we cannot provide aper-AS breakdown of measurement coverage, similarly to Iran and China.We instead share the overall Signal measurement coverage from Cubabetween April 2021 to September 2021 through the following chart.
Source: OONI measurements on the testing of the Signal PrivateMessenger app in Cuba between April 2021 to September 2021, https://explorer.ooni.org/search?until=2021-10-01&since=2021-09-01&test_name=signal&probe_cc=CU
We clearly observe a spike in anomalous Signal measurements from Cuba,starting on 12th July 2021. Very few Signal measurements werecollected from Cuba in previous months, but many of them suggest thatSignal was previously accessible. The spike in anomalous measurements on12th July 2021 coincides with the mass anti-government protests(triggered by a shortage of food and medicine and the government’sresponse to the COVID-19 pandemic), which started on 11th July 2021.
Amid the protests, social media blocks were widely reported inCuba. OONI data from this period not only suggests that access toSignal was blocked,but also indicates that other social media platforms were blocked aswell, such asWhatsApp,Telegram,facebook.com,andtiktok.com.
Anomalous Signal measurementsshowthat the TLS handshake to the Signal backend service failed consistentlywith a connection_reset error. This is likely an indication of theuse of Deep Packet Inspection (DPI) technology targeting the SNI fieldof the TLS handshake.
OONI data suggests that the blocking of Signal only lasted a few days,as most measurements collected thereafter showed that Signal was reachablefrom Cuba (as illustrated through the previous chart). However, wecontinue to observe a low percentage of anomalous measurementsin the months since. It’s quite unclear though if ETECSA isintentionally trying to block Signal, or if these anomalous measurementsare caused by some misconfiguration of their filtering equipment.
Uzbekistan
OONI data indicates that Signal is blocked in Uzbekistan.
The following chart aggregates Signal measurement coverage from 8distinct AS networks in Uzbekistan between April 2021 to September2021, all of which present signs of blocking.
Source: OONI measurements on the testing of the Signal PrivateMessenger app across AS networks in Uzbekistan between April 2021 toSeptember 2021, https://explorer.ooni.org/search?until=2021-10-01&since=2021-09-01&probe_cc=UZ&test_name=signal
Unfortunately, Signal hasn’t received much OONI Probe testing coveragein Uzbekistan during our analysis period. However, it’s important tohighlight that every time that Signal was tested, it presented signsof blocking. The raw measurement data, coupled with the fact that suchanomalies were present on 8 distinct AS networks, provides a fairlystrong indication of intentional blocking.
When attempting to perform a TLS handshake to all Signal backendservices, the connection constantly times out after writing the firstdata packet to the network, as illustrated through OONI databelow.
This indicates that the blocking of Signal might be implemented throughthe use of Deep Packet Inspection (DPI) technology configured toselectively drop packets.
Recent OONI measurements suggest that Signal remains blockedin Uzbekistan.
Since April 2021, OONI data analysis suggests that access to the SignalPrivate Messenger app has been blocked in (at least) 4 countries:Iran,China,Cuba,andUzbekistan.
Between April 2021 to September 2021, the testing of Signal consistentlypresented signs of blocking on multiple AS networks in Iran, China, andUzbekistan. In Cuba, Signal only appears to have temporarily been blocked in mid-July 2021amid mass anti-government protests.
The technical means of blocking varied between countries. In Iran, OONIdatashowsthat many ISPs blocked Signal by means of DNS based interference,returning the IP address 10.10.34.35 (which is known to serve the Iraninan blockpage).China appears to block Signal by means of DNS injection,returning IP addresses inside of random IP ranges.
When Signal was temporarily blocked in Cuba, the TLS handshake to the Signal backend service consistently failedwith a connection_reset error, suggesting the potential use of DeepPacket Inspection (DPI) technology. Uzbekistan appears to use DPItechnology configured to selectively drop packets, as attempts toperform a TLS handshake to Signal backend services resulted in connection timeoutsafter writing the first data packet to the network.
Signal offers two ways for circumventing blocking: domain fronting andTLS proxies. Support for these varies between Android and iOS.
Domain fronting is currently enabled by defaultfor Signal users (on both Android and iOS) in Iran, Egypt, Oman, Qatar,and the UAE (though the Signal account needs to be using a phone numberfrom those countries). This should probably be enabled for Signal usersin Uzbekistan, China, and Cuba too. On iOS, Signal users from anycountry can enable domain fronting by switching on the “CensorshipCircumvention” setting in the app.
Signal TLS proxiesare currently only supported on Android. You can help Android Signalusers circumvent blocking (if they have a phone number which is not fromIran, Egypt, Oman, Qatar, and the UAE) by running a Signal TLS proxy and sharing withthem the mobile deep link: https://signal.tube/#<your_host_name>.
You can also help monitor the blocking of Signal by running OONI Probe and contributingmeasurements.
To test Signal automatically every day, enable automated testingin the OONI Probe desktop app. Otherwise, you can tap the “Run” buttonin the OONI Probe Dashboard to run OONI’s Signal test (along with othertests). As soon as OONI Probe testsSignal, you will immediately have access to the test result inside yourapp. Unless you opt-out of publication, your Signal test result willalso be published as open datain near real-time.
As we tend to observe a spike in the blocking of instant messaging apps during political events around theworld, measuring the reachability of Signal is more important than ever– especially now that it’s being used by millions of usersworldwide who rely on the app for private and secure communications.
We thank OONI Probe users who contributedmeasurements, supporting this study.
We also thank Signal for their tireless effortsin bringing end-to-end encryption to the masses worldwide.
