{"id":4838,"date":"2024-04-26T18:46:13","date_gmt":"2024-04-26T18:46:13","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=4838"},"modified":"2025-06-03T08:40:51","modified_gmt":"2025-06-03T08:40:51","slug":"policy-monitoring-march-2024-next-generation-filtering","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2024\/04\/26\/policy-monitoring-march-2024-next-generation-filtering\/","title":{"rendered":"Next-Generation Filtering; Phishing with Governable Templates Analytical\u00a0"},"content":{"rendered":"

Filterwatch\u2019s research indicates that the \u201cnext-generation proxy,\u201d a topic of discussion among Iranian authorities, is a multifaceted initiative. It is not only a part of the Supreme Council of Cyberspace\u2019s resolutions aimed at boosting domestic internet traffic and enhancing censorship measures but also builds upon a foundation laid by previous technical projects.<\/span><\/p>\n

This approach essentially consists of replicating a non-Iranian service or website by establishing a counterfeit version. This is done through an intermediary that receives user requests, inspects them, and if necessary, censors them before sending them to the original service. It then delivers the possibly censored response back to the user.<\/span><\/p>\n

Such methods not only facilitate extensive spying on users but also effectively represent the implementation of phishing on a large scale.<\/span><\/p>\n

Phishing is a type of social engineering attack that is typically carried out via email with the goal of stealing login credentials. It involves creating a fake and copied version of the desired service or website to deceive users and gather their sensitive information.<\/span><\/p>\n

Therefore, this new method not only jeopardizes the security and privacy of citizens but also represents a new form of censorship.\u00a0<\/span><\/p>\n

Resolution on strategies to increase the share of domestic traffic and counter circumvention tools<\/b><\/h4>\n

The approval of the <\/span>resolution<\/span><\/a> (<\/span>Alternate link<\/span><\/a>), officially titled \u201cStrategies to Increase the Share of Domestic Traffic and Counter Circumvention Tools,\u201d on February 18, 2024, marked a major development in Iran\u2019s internet access policy landscape this February. The resolution, which bans VPNs and <\/span>mandates<\/span><\/a> the use of native shells for accessing services of filtered platforms, gained significant attention. According to Article 4 of the resolution, Iranian users must access services from well-known foreign platforms via \u201cgovernable platforms.\u201d<\/span><\/p>\n

About a month after the resolution was passed, Mohammadamin Aghamiri, the Secretary of the Supreme Council of Cyberspace, informed the IRIB News Agency on March 17, 2024, that foreign services would be provided \u201cthrough technical tools\u201d, where filtered platforms will be <\/span>accessible<\/span><\/a> on domestic platforms 'in accordance with Iranian laws and regulations<\/span><\/p>\n

While public demonstrations of such tools have yet to be seen, within the disclosed emails from the Working Group for Identifying Examples of Criminal Content overseen by the Prosecutor\u2019s Office, a notable proposal exists. This <\/span>proposal<\/span><\/a>, known by its trade name as the Next Generation Proxy, was put forth in a confidential letter by \u2018Yaftar Research Pioneers in Computing\u2019 on August 12, 2020, to the Prosecutor\u2019s Office. The <\/span>disclosure<\/span><\/a> of these emails was made by the hacker group \u201c<\/span>Anonymous<\/span><\/a>\u201d in November 2022.<\/span><\/p>\n

In this proposed <\/span>plan<\/span><\/a>, the platform Pinterest, which is an American image-sharing social network, is examined as an example. The introduction of the plan states that this system 'is capable of replacing one website or web service with another under a different name and address.\u2019<\/span><\/p>\n

\"\"<\/a>
Loading...<\/figcaption><\/figure>\n

Such projects have also been implemented in the past. For example, the application \u201c<\/span>Golden Telegram\u201d<\/span><\/a> (Telegram talai) developed by the company \u201c<\/span>Rahkar Sarzamin Houshmand<\/span><\/a>\u201d, as an alternative to Telegram, under the supervision of the Ministry of Intelligence in 2018, was <\/span>removed<\/span><\/a> from Google Play in May 2019 after multiple reports of security breaches and privacy violations were published.\u00a0<\/span><\/p>\n

How does the Yaftar\u2019s Next Generation Proxy system work?<\/b><\/h4>\n

According to the plan, the user first connects to a similar Iranian domain of the original service. For example, instead of connecting to <\/span>https:\/\/www.pinterest.com<\/span><\/a>, they are redirected to <\/span>https:\/\/www.pinterest.ir<\/span><\/a>. The Yaftar's Next Generation Proxy system replaces the user requests with the original domain, i.e., .com, and sends it to the original domain. It receives the response from <\/span>https:\/\/www.pinterest.com<\/span><\/a>, filters it, and then sends it to the user at <\/span>https:\/\/www.pinterest.ir<\/span><\/a>.<\/span><\/p>\n

\"\"<\/a>
Loading...<\/figcaption><\/figure>\n

Management Module: Access to User Traffic Statistics<\/b>\u00a0<\/span><\/h4>\n

The interface module receives information about the system and its functions and displays it for human operators. Information such as statistical reports on request rates, the number of packets received and sent, and the volume of data exchanged can be analyzed in this module. Filtering policy rules are also reviewed and applied through this module.<\/span><\/p>\n

Hardware and Requirements for Project Implementation<\/b>\u00a0<\/span><\/h4>\n

For the implementation of the pilot version of this project, which can serve 100 users, one hundred valid IPs, the required bandwidth, and seven virtual machines have been specified.<\/span><\/p>\n

About \u201cYaftar Pajouhan Pishtaz Rayanesh\u201d company<\/b>\u00a0<\/span><\/h4>\n

Yaftar Research Pioneers in Computing (Yaftar Pajouhan Pishtaz Rayanesh), also <\/span>known<\/span><\/a> simply as Yaftar, was established in 2013 and shortly thereafter, in 2014, it started <\/span>projects<\/span><\/a> such as monitoring \u201cindecency and unveiledness (lack of hijab)\u201d on the internet and has become one of the contractors for internet filtering in Iran. In the hacked documents from the Prosecutor's Office, there is a directive dated November 3, 2022, <\/span>issued<\/span><\/a> by the Working Group for Identifying Examples of Criminal Content, or the Filtering Committee, emphasizing the use of filtering contractor companies (Yaftar Research Pioneers in Computing and Dowran Data Processing) for blocking VPNs.<\/span><\/p>\n

A Plan for the Islamic Republic, Contrary to the Laws of the Islamic Republic<\/b>\u00a0<\/span><\/h4>\n

In Yaftar\u2019s proposal, the proxy system accesses user information without their consent or knowledge, and the system intermediary is also facilitated to store, process, and use this information. Meanwhile, unauthorized eavesdropping on people\u2019s communications content and storing it without the permission and knowledge of the users is considered a crime according to Articles 730 and 740 of <\/span>the Islamic Penal Code<\/span><\/a> (<\/span>Alternate link<\/span><\/a>).<\/span><\/p>\n

According to the principles of protecting personal data, any access, use, collection, storage, and processing of users' personal data must occur with their knowledge and <\/span>permission<\/span><\/a>.\u00a0<\/span><\/p>\n

The executive directive for improving the protection of users' privacy, which was <\/span>approved<\/span><\/a> (<\/span>alternate Link<\/span><\/a>) in December 2023 by the Supreme Council of Cyberspace ,also states that domestic online platforms and service providers must collect user information with their consent. Any new use of data that has been previously collected also requires renewed permission from the user.\u00a0<\/span><\/p>\n

Based on what is evident in this proposal, the Yaftar filtering system even contradicts the laws of the Islamic Republic itself.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Filterwatch\u2019s research indicates that the \u201cnext-generation proxy,\u201d a topic of discussion among Iranian authorities, is a multifaceted initiative. It is not only a part of the Supreme Council of Cyberspace\u2019s resolutions aimed at boosting domestic internet traffic and enhancing censorship measures but also builds upon a foundation laid by previous technical projects. This approach essentiallyContinue reading \"Next-Generation Filtering; Phishing with Governable Templates Analytical\u00a0\"<\/span><\/a><\/p>\n","protected":false},"author":40,"featured_media":4843,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4],"tags":[177,176,159,94,145,143,175],"class_list":["post-4838","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network-monitor","tag-anonymous","tag-golden-telegram","tag-internet","tag-internet-shutdown","tag-iran-cyber-hack","tag-iran-hacks","tag-proxy","entry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t