Rage-coding the mother of all VPNs

Transcript

as Kandari from Rebellion Systems. >> Thank you. >> Hello everyone. Um, welcome to this talk. So I'm going to talk about the math scientist shed that matters and this is more of the story that I went through in the last few months. So just a bit about myself. Um, I'm a Cheyenne Scander. I'm a security researcher, a hacker, educator and human- centered technologist. I did my PhD on blockchains unforeseen consequences which is like front running oracle failures and the dark side of permissionless. Um in the last decade I've been doing like smart contract security. I built enterprise staking infrastructure for Ethereum. Um and also

for the context of this talk I've been co-ounded and chained which was like a DAO using crypto to route through geopolitical ex exclusion. Um, and also I've been teaching Farcy speakers and Iranians about crypto cryptostack and technology since 2015 through something called Coinron Academy and also Shia podcast. But my le latest obsession is moave mother of all VPNs. Um, so just to give you the context um in internet shutdowns is not a new thing. It's not a one-off thing. So Iran has been going dark um for the last 15 years or even 20 years and there have been many incidents they every time they learn what what connections were leaked

and they basically make it harder make it bigger and make it more complete and uh they learn from every shutdown and every internet filtering and this year has been one of the worst uh on the record. Um basically most of 2026 Iran has been offline. Um it happened it started with January 8th and 9 which was the Iran street protests against the government and they shut down everything this time. This time was like SMS phones in even intranet that usually works. They were all cut down and during that those two days around 30,000 to 70,000 people were killed in the streets. Um and then internet came back for a bit and then the war began and internet went blackout. There was 88 days of full

internet shutdown. uh which later in late May which is 3 weeks ago internet came back in a really weird state. Um and what I mean of weird state is um so two weeks ago Azarbaijan end up being the number three country for the chat GPT usage which they have like 10 million 10 million people population so that's not really possible and we we notice that Iran's traffic is being routed through Azeran for some reason um and this is before you say this is like a Iran's problem it's not we we seeing that through becoming a default uh global default we've seen in Nepal after the social media ban And there was like 3,000% VPN demand getting VPN demand in Uganda in United Kingdom.

We're seeing that with the social with the age verification. Um and Iran after it restored there was a thousand% VPN demand extra VPN demand and all these uh peaks are basically a population trying to flee to free internet. So it's almost a digital immigration happening and we're seeing like also governments are trying not to ban VPNs but also uh DOSVPN infrastructures with Russia and we've seen conversations in US about banning VPNs. Uh so basically this is a different flag but the same playbook. It's control the network you can control the people and this is not going away like as you've seen the other talks in the last today and yesterday VPN is becoming one of the main topics

and um I want to use the um Corey Dr.ification framework to just talk about some of the web three aspects. So for just to for a refresher to be on the same page basically he talks about like let's say social media on Facebook that um Facebook started saying MySpace is so um spying on you come join me and be a Facebook user. So you be you're good to users, you capture the users, you lock them in and you start to abuse the users to for your business customers, show them ads and then you end up abusing the business customers to extract more value from them for the shareholders and then the platform starts to rot. It become a giant pile of And the way he talks

about is like when they start talking about metaw that's where this happened. we're seeing is a similar thing happening with um internet infrastructure but for this crowd basically I wanted to talk about like web 3. So in web 3 I feel like we forgot the promise. We're talking about privacy but like basically say cipher punk started with writing code. They were like we want p communication privacy. We want to define our privacy with cryptography with remorers signatures electronic money. Um and basically we want to communicate through borders without being under surveillance. Um and now 10 30 years later um basically we captured all the user all the builders through this promise of the private

communication privacy but then um we captured these users um sorry builders and then VCs kind of took over and they started to optimize for what could be priced and sold. Um and the thing is basically financial privacy can be business can be have a business model and can have be priced and sold but communication privacy for someone let's say in Thrron doesn't have a business model um and we couldn't forgot about that now we have like privacy for enterprise which I don't know exactly what that means and u but the people that need it they still don't can access it and this is cy don't is not cippher punk anymore in my opinion

Um so just to show what what the gap is. So basically we start to build for the top of the stack. We built um for app layer um for protocol layer for transport which are all good. Like we build wallets, DAPs, um L2s, IPFS, we build like the ENS like they're all good. I'm not going to lie. But we forgot the bottom side. So we forgot how if those bottoms get cut down, nothing matters on top. um and it al just vanishes. And this is not necessarily a failure of um imagination of like the technical failure. This is a failure of imagination of what who the adversary is and what extent they they could go.

Um and this is kind of like my personal story here. So I'm Iranian dasphora. I spend like over a decade teaching far speakers about crypto stack, tech stack, cryptography. And when these blackouts happened, um it was all worthless. No one could use anything on web 3 and I couldn't even reach my own family. I it's not like my message were blocked. It was not being delivered. Um and I end up like after the initial shock that was gone um I started rage coding. I I felt helpless. I was like I needed to do something and I started rage coding and it wasn't necessarily for any financial future. It was like for a better now for getting someone through. Um, and to be honest, I didn't have any hope that it's

going to work. It was just for my own sanity. And then I put it out there, tweeted about this, and I saw people actually getting through. People are getting to internet, free internet to this software I was building. Um, and around late February when the full internet shutdown happened, everything went silent and I just broke. I failed. I I felt like I was defeated. Um, basically I closed my laptop, walked for a few days, came back, look at some of the charts on those servers, um, cuz I was already donating to the anti-serveance, anti-censorship protocols. And I realized people from Myanmar are connecting, people from Russia, China, even UK are going through these traffic.

But my I made this application initially for Iranian users, but there were none of them. Um, so I was I started continuing the work. I fixed bugs. I added more protocols. I read so many Chinese and Russian websites and Telegram messages to like understand how they get through these and kept adding these um and later in May when connection came back it started working again I saw Iran in the charts again and it made me so happy um so I continued on this and just to say what this is basically it's um the idea of Moab or mother of all VPN is not really elegance it's redundancy um so you can use like basically one command to run all possible protocols I

could find. So I wasn't going for the best VPN protocol. I was going for all of them. Any protocol that is out there. Um so you run one command, it sets up everything for you. And in in security a lot of times we say the system is secure till there's one security hole and hacker can gets in. I'm kind of looking the other way around. The sensor has to block all the protocols but you only need one to get through. So this is like kind of that way. So any stranger can become like a VP VPN provider for the whole um population, for the whole neighborhood, for the whole household.

Um and Moav like mother of all VPN started as a joke, but then it became the thesis of the this application. Um and it only needs like a really uh small VPS or Raspberry Pi. You kind of set it up. And the specific problem I was trying to solve then it's really hard to explain for people outside Iran. So in an internet shutdown, it's not like everything's unplugged. Um people inside start running scanners for the whole internet. It's similar to like you looking at the stars to find life. They were like trying to ping some server that is alive for them. And when sometimes they could sometimes like one example was the um Azure cloud in North Africa. The some IP range in there was pinging. Um and then we have two br two

really brutal problem. one can we get an IP address in that range which is a technical problem for outside Iran it's possible through brute force whatever means the other problem is like when you get an IP address you're basically beating the clock there is a time that that IP address would be blocked and you need you want to get traffic through as soon as possible and basically this one command you already have configurations for your family friends and also contributing to tour snowflake conduit and siphon all these to to get traffic through and then you have a day that you come and there's no traffic. You you notice that like that server has been that IP has been blocked but for a few days you gave internet to people that needed it. Um and just to show like how it works basically there is like one box

every route out. Um I just realized I modified this uh slides but this is like older version but so the the blue box there this box is MOAV. So um basically if you have like inside Iran, China, Russia, most people on their phone have some kind of VPN apps and there are some collection here. So whatever you have in Moav there is something for you to use. At the same time, we're contributing to siphon and tour through snowflake. That means you become part of the infrastructure for anti-serve anti censorship internet. And um these are the parts I really love that it becomes part of the infrastructure.

And just to show it's not just slideware. Uh so when you run the command you get this this um yeah sorry you get um this um terminal UI that helps you set up everything and you have a admin dashboard that gives you like some information about what what is happening on that server and you have like a graphon metrics really detailed in like which countries what protocols are working so you have better sense of who's using your servers and how this traffic is going through and that's where I was seeing like no Iran and China and Myanmar and I realized people are actually using this and um there is a arm race here. So in in a lot of these places there is deep

packet inspection that start to like understand the packets and traffic and it starts blocking obvious traffics like OpenVPN wire guard and these kind of thing that are obvious gets blocked really fast and one by one. Um but we see that this creative resilience that routes around it. Um so one of the things is SNI spoofing which is like a lot of these infrastructure need let's say the smart TVs they want smart TVs to be updated but no one have access internet so they left like update.samsung.com samsung.com open you change the traffic to look like those updates but goes through mo server and like you have access internet goose relay is one of the ones that I really like um is that Google is was blocked but Google

infrastructure was open some of the parts so you they use scriptgoogle.com to be able to route traffic through Google infrastructure um and also balvpn is one of the ones I really love is ballet is one of the state approved um chat apps it's fully backtored But people start using the web RTC video call media there to get traffic through and um it's similar to protozoa which is a academic paper that was used in China and Russia and also DNS tunnels. DNS is the last thing that the governments can kill and um you cannot still use that to move around text and uh one of the things about this is like these were mostly built by people inside these um internet

shutdowns. Um, so I want to put this out there and talk about what's actually out there and what is not. And I want to be really honest here because if I oversell any of these, people would get hurt like they actually trust that technology. Um, another example is a GitHub um over channel that like GitHub was also filtered, GitHub CI was open. So people did basically TCP over Git, which means they would like commit a Git with a URL. the GitHub action would download a file and they could like clone and pull the server. That was like another interesting way of doing this. The feed is something that saved a lot of lives that use telegram or news over DNS. So you could get some news about which regions of the city you have to evacuate

on some others. Netagram I'll mention in a minute a few call to actions here is more so there is like Starlink neighborhood um sharing which there's an NASNet and some other similar projects that you could share your Starlink connection to your neighborhood or to your friends that you want but there's a high risk of being arrested if it gets detected. Uh we know that there is like power line networking um possible why don't we have similar networks into share internet to the building without that detection without using the other infrastructure. This is more part of like pirating the infrastructure that exists. Um we've seen like dialup revival revival in like age of 2011 that they use dialups to be able to like um create new connections. Um and offline

payments also have a whole slide about this. And one thing to know is um so the tools that worked were actually built by people living inside these blackouts. And there are research around this that which they call this grassroot infrastructuring survival work uh which we need to like look into more in the space and um so net is another project I rage code in the same period. So the only time in that period that someone could connect was calling from inside landline to outside actual landline calls and I was still working as on these VPN and I wanted them to test um so I was like maybe there is a way to use phone to move data and that's where I built net

nec means voice and basically the idea is like you paste your configuration like any data you want here it turns it into voice and then it uses the same technology as NASA uses for Voyager from Interstellar to communicate over the phone cuz phone is noisy. You need to be able to convert that. Um it's really slow also they need internet to load this first time. Um it works fully offline even has like npm package you can use and um it's it might take around one one six minutes or 1 kilobyte but still like it works. Um this is another like this is where a friend of mine called this is mass scientist and that's where I got this word from. Um

and these are something that I want to also talk about in in this web web three conference more offline payments. So a signed transaction is just data right like you should be able to like use your wallet sign a transaction send it with a carrier pigeon net like Bluetooth whatever and then somewhere somewhere else that is online you should be able to broadcast it. Um, and it's kind of embarrassing that we don't have it right now. Like with Bitcoin, there's partially signed Bitcoin transaction that it kind of is, it works. We have Cashew, which is like a closest to what I have in mind. It's Bitcoin only and the mint needs to be online, but for EVM wallets like Metam Mask, you can't even build an offline transaction. If you're

offline, you cannot even build a transaction, which it because it needs wants to get none gas estimate. There are all these technical possibility there but we don't have it and even if you if let's say if you do this you cannot export that data to give it you to your friends to your through netogram to other ways to broadcast it and it's really embarrassing my in my opinion and that ends stable coins even not feasible to do offline I know there's like some trust anchors like double spending there are these issues but the small value payments can work today and they can save lives in these regions uh it's about just wartime um wartime or internet shutdowns. We've seen in like Spain and Portugal there was like days

long uh power outages like in those your wallets do not work even if you have a way to communicate uh because you don't have internet on those devices and basically my ask is like if you're working on a wallet not necessarily a new wallet I don't want a new wallet for this I want metam mask rabi all these to have an option to export your signed transaction to use in other means and if you can using zk yes escros state channels make it possible today to do $100 like maximum $100 of like offline transactions because if $5 transaction can buy food in these regions but at these points banks are out internet is out there is no way to do value transfer

um and another one is like we have pop-up cities we run pop-up cities why not pop-up mesh um so why do we use discord in these when we have we have delta chat metrics jity we have bhat we have all these so we can have a network like this that has its own payment network and everything payment network for this kind of situation doesn't need to go through the network through the internet and there are some relays um some interesting thing so did you know there's like two mesh networks already here and you're not even aware of one is bhat which it's only me and Floren Florian from uh freedom browser that we every day we say yo um and also yesterday I have a meshastic note with

me which uses Laura technology And um yesterday I was able to connect to what's love from Logos and I went to the office and they're trying to do really interesting uh ways of using this mesh and that's one of the parts I came to this space these experimentations this crazy that we want to build. Um so let's for the next pop-up city have our own mesh have our own chat and after we're done it's all evaporates and we don't need that anything else. uh and those that's makes people to be build better tools being work accessible have these apps if the internet goes down so be able to use them um and for back to the activist morale is like you don't have to win the VPN and

internet censorship you just have to make it expensive for the sensor for the government to censor you and we've seen this before like two two decades ago they only started to block DNS queries and people start building like DNS over HTTPS DNS tunnels. Then it was like deep packet inspection, fingerprinting that you cannot go to like facebook.com. People started using proxies and SNI spoofing and now we have like IP blocks which we use Cloudflare and Cloudfront to like bypass those for the total blackouts. If we create those mesh networks, we don't need a global uh wide internet. We just need these local mesh that works and they can just communicate and live their lives. uh this would really save lives and we just need to

keep the uh keep raising the price on censorship. And one thing I learned about this last few months is the community is the infrastructure is not the side effect. And uh while I was making net I was re way beyond my um knowledge on like signal processing and someone showed me a few papers about Voyager how they use this and that actually made Neog possible. Uh there was like developers that are outside there. Um there was actually someone um NIM developer that helped me with more of like making it more secure. I don't even know who that person is but they helped me. Um there are activists like there are so many people inside Iran and China that helped me test these in the situations that I could not test and also translators

there. This whole community is the infrastructure and just we should be aware that these tools would die the moment the people maintaining them burn out. In March I almost did. So take care of each other in these situations and just to say where we're taking MOAB like I'm taking Moab in that is um so the idea was like it helps everyone to get access to internet for their VPN but then I realized well we have all these protocols we can have a moave client to use all these protocols and use the ones that actually get through um so if you if you're in a region that you want to test it or if you just want to test it let me know I can send you VPN configs from these test servers. It's easy for

you to also run it, but I can also provide that. Another thing I want to do is u try tougher transport layers, more VPNs. If you know any exotic VPN you want to add, put the GitHub issues, I'll me and cloud get on it. Um I want to implement Nim and Sent Sentinel and recently I was talking like NosisVPN as a relayer. The only thing is like I don't want to add complexity. I want to keep the server running to any non- techy can run those servers. So any non- tech person with a Linux or Raspberry Pi could become VPN infra VPN infrastructure. I just want to abstract away the key management and everything from that. Um yeah so and the other thing is I want to be able to create a cluster. There's someone actually helping me from web3

privacy talk that we talked to have a secure way of running a clusters of these servers. So a lot of people can request configurations on telegram. That's another thing that we want to build next. And um basically call to action on this room is just to know that the tool that breaks in the crisis that it was built for is worse than no tool cuz someone trusts it to like for it to work and build for the people that gets cut off. Um so go if you have a small VPS or Raspberry Pi deploy VP deploy mo today. That's only what it takes this command and um it runs conduit snowflake. you already become part of the infrastructure and before you go to sleep someone's behind

these walls is is breathing through through your bandwidth and build for the harder problems like just don't build another yet defy project just build the next the plumbing for the next internet shutdown um do work on offline payments we need those work on mesh exotic routing those um hardware layer that is out of our control and really now because the next um next crisis in is inevitable. It's going to happen. And also fund the gap. So if you have like any treasuries, any grants, bounties, like fund them toward these project like Masanet is one of the big ones that is helping a lot of people.

Direct to cell is trying to get um satellites and Starlink to help with a lot of people getting communication mo. Um, and another thing, if you have access to some funds for like next hackathon prize, just put one crazy idea there and say like create a mesh, create a offline transaction that goes through this other random protocol. Make it like exciting for a lot of people to be able to like bring out their math scientist app. Um, and basically, um, I'm going to take it if you want to take a picture. Yeah. So basically what I'm asking is the cipher punks end their manifesto by cipher punks write code they they valued privacy they wrote code that became right now tour became signal became a lot of things that we use we

need to continue that because we inher inherited that u and basically what I'm asking is like become the infrastructure run moav and um yeah thank you for being here I'm almost out of time thank Um, any questions or Okay, thank you.