Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/23/2018
06:00 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Wickr Adds New Censorship Circumvention Feature to its Encrypted App

Secure Open Access addresses void created by Google, Amazon decision to disallow domain fronting, company says.

Wickr has added a new Secure Open Access capability to its instant messaging app, which the company says enables encrypted communications that is far more resilient to Internet traffic restrictions and censorship attempts than typical domain-fronting approaches.

The new feature is based on the open source Psiphon Internet censorship circumvention tool developed by the University of Toronto's Citizen Lab for users of Windows and mobile devices. It uses domain fronting as just one of multiple techniques, including SSH and VPN technology, for directing encrypted traffic around blocking attempts.

"Think of it as a 'smart VPN' that relies on an agile and smart access engine that optimizes the Wickr app," says Michael Hull, president of Psiphon. "In a nutshell, [Secure Open Access] enables Wickr users anywhere in the world — whether business teams or individuals — to stay connected and end-to-end secure."

Wickr sees Secure Open Access as filling a void that Amazon and Google created earlier this year when they stopped supporting domain fronting on their platforms.

Domain fronting is a technique for hiding traffic to a specific host server and service by forwarding it through a proxy domain belonging to a Google, Amazon, or other ISP and content distribution network. Encrypted communications apps, like Signal and Telegram, and services, like The Onion Router (TOR), that are banned in certain countries, for instance, have used Google.com as a domain front for routing traffic to their servers.

A message sent via Signal would appear like regular HTTPS traffic to Google, while the actual domain to which it was headed would be encrypted in the HTTP host header and therefore invisible to a censor. To block the traffic, a censor would have to block all traffic to Google.com.

Many security researchers and privacy rights advocates have touted domain fronting as giving people — especially in oppressed societies — a way to access blocked apps and services. So Google's and Amazon's decision to disallow their domains from being used for domain fronting was widely considered as a major setback for Internet privacy and free speech.

The problem with traditional domain fronting is that it typically relies on the infrastructure of a single cloud provider — like a Google or an Amazon — to hide traffic, Hull says.  "This practice inevitably faced restrictions as it gained popularity simply because it put providers' customers at risk of losing service [and] connectivity as a result," he says.

Wickr's Secure Open Access is built to be adaptive and resilient to emerging traffic restrictions, according to the company. Instead of relying on a single cloud provider's infrastructure, Secure Open Access uses thousands of servers worldwide to enable uninterrupted, end-to-end encrypted messaging, calling, and file and screen sharing.

When a user launches Secure Open Access on his or her mobile device, the client initiates connections with up to 10 different servers simultaneously. The servers are chosen at random from a cached list of servers and a mix of different protocols, according to Wikr.

The goal behind making multiple simultaneous connections is to minimize wait times in case certain servers or protocols are blocked. Wickr Open Secure Access also is designed to pick the closest data center and lower-latency direct connections over domain-fronted connections to speed communications.

"To accomplish what Wickr Secure Open Access does, a user would have to run a few dozens of VPNs," says Chris Lalonde, Wickr's chief operating officer. Users would need to test how the VPNs work in a particular location before launching a secure communication application.

"With Wickr, they can now stay connected and continue to do work on any network, all in one app, on any device, by just enabling Secure Open Access feature," he says.

Lalonde says Wickr's new feature can help teams and organizations operating in any part of the world to communicate and collaborate securely without fear of interruption. "This capability is designed to mirror today’s global workforce that is traveling, collaborating across different geographies, and needs to protect business IP, sensitive data, and critical enterprise deals from countless threats and data breaches."

Related Content:

 

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26252
PUBLISHED: 2021-01-20
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server ...
CVE-2020-26278
PUBLISHED: 2021-01-20
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is suppli...
CVE-2021-1235
PUBLISHED: 2021-01-20
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an af...
CVE-2021-1241
PUBLISHED: 2021-01-20
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2021-1247
PUBLISHED: 2021-01-20
Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.