Mullvad VPN new feature

[techdaddy]

Last week I was listening to episode 973 and the news about VPNs. I've been a user of Mullvad VPN since 2020 when I first heard it mentioned on the Security Now podcast. Today I was notified about a client update to Mullvad VPN. I was reading the release notes and noticed a new feature they just added. It's called Defense against AI-guided Traffic Analysis or DAITA.

The TL;DR version is this: new AI traffic analysis can allow ISPs and other organizations to observe encrypted traffic. Then based on the packet size and other patterns determine the website visited. Mullvad says, "When visiting websites (or doing any other activity that causes significant traffic), DAITA modifies the traffic pattern by unpredictably sending cover traffic in both directions between client and VPN server. This distorts the recognizable pattern of a website visit, resisting accurate identification of the site".

I don't think this will mitigate the concern with modifying the route tables of VPN connections; however, it's still a cool feature.

A blog post on their site can be seen here if you want to read more. I just thought this might be of interest to everyone here.

 

[SeanBZA]

So basically sending dummy packets that are dropped both sides, to keep the channel looking busy during low traffic periods. On a mobile network going to really rack up the data usage.

 

[techdaddy]

So basically sending dummy packets that are dropped both sides, to keep the channel looking busy during low traffic periods. On a mobile network going to really rack up the data usage.

Yes I think they even mention that it would use more bandwidth. However, I don’t think it’s sending traffic to make it look busy during low traffic periods. Let’s say website A has certain images and text. When someone requests it there is 1.45MB of data that has to be sent. Then website B has different images and text so its data is 2.19MB the DAITA will makes the size the same (probably by rounding up since going down would be problematic). So it might round both sites up to 2.5MB thereby making it more difficult to determine the exact site just by the size.

 

[SeanBZA]

Yes bulking up the image size works, but most common is to simply make larger blocks and send those, filling up the unused space with random data.