Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

fermatslibrary.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#11

Post by gerdesj »

I've never been anywhere near the GFW but I do find OpenVPN listening on 443/tcp and a few other ports (tcp and udp) on the outside quite handy for drilling through firewalls. It supports basic auth proxies but CNTLM is in the toolbox as well. Add in NAT and a few routing entries on other hosts.

It also provides a simple way to detect a transparent MitM proxy. If OVPN fails to connect but an "unprotected" https connection gets through then the alarm bells go off and the presented SSL cert gets a serious examination. I keep a couple of thumbprints of known certs handy for this - the discipline of proper checking rather than a cursory glance at an image that the GUI throws up.

I use readily available stuff but looking into the description of how the obfs protocols work in Tor I'm impressed and rather glad that my life or liberty doesn't depend on my efforts. When I get it wrong I simply lose access to BBC iPlayer or whatever. When someone who is having to take this rather more seriously gets it wrong, they might not get a chance to repeat their mistake.

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#13

Post by mikeash »

gerdesj wrote: post #11

I've never been anywhere near the GFW but I do find OpenVPN listening on 443/tcp and a few other ports (tcp and udp) on the outside quite handy for drilling through firewalls. It supports basic auth proxies but CNTLM is in the toolbox as well. Add in NAT and a few routing entries on other hosts. It also provides a simple way to detect a transparent MitM proxy. If OVPN fails to connect but an "unprotected" https conne…

This sort of thing used to work, but doesn't anymore. The GFW is now smart enough to detect VPNs based only on the traffic they generate, not port numbers or other easily changed things. It's currently an arms race between VPN providers trying to mask their traffic and the firewall trying to uncover it, and the firewall is winning so far.

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#14

Post by pixl97 »

mikeash wrote: post #13
gerdesj wrote: post #11

I've never been anywhere near the GFW but I do find OpenVPN listening on 443/tcp and a few other ports (tcp and udp) on the outside quite handy for drilling through firewalls. It supports basic auth proxies but CNTLM is in the toolbox as well. Add in NAT and a few routing entries on other hosts. It also provides a simple way to detect a transparent MitM proxy. If OVPN fails to connect but an "unprotected" https conne…

This sort of thing used to work, but doesn't anymore. The GFW is now smart enough to detect VPNs based only on the traffic they generate, not port numbers or other easily changed things. It's currently an arms race between VPN providers trying to mask their traffic and the firewall trying to uncover it, and the firewall is winning so far.

Whelp, that's pretty much it for the internet. Won't be long before many more governments are licensing and using this technology. The question is how long before supposedly 'free' governments start.

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#15

Post by KayEss »

We have a client's system that seems to get probed for this sort of thing. We keep seeing URLs like the following being requested:

    htttps://www.example.com/http://www.baidu.com/cache/global/img/gs.gif
There are a number of variations including plain IP numbers and other URLs, like www.google.com being used.

I guess at some point somebody accessed the site from China.

EDIT: Just got another probe from 94.102.49.174 owned by Quasi Networks Ltd in the Seychelles.

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#16

Post by dylz »

KayEss wrote: post #15

We have a client's system that seems to get probed for this sort of thing. We keep seeing URLs like the following being requested: htttps://www.example.com/http://www.baidu.com/cache/global/img/gs.gif There are a number of variations including plain IP numbers and other URLs, like www.google.com being used. I guess at some point somebody accessed the site from China. EDIT: Just got another probe from 94.102.49.174 ow…

Quasi (aka Ecatel) is basically a den of ddos for hire, ddos, malware, botnet C&C, abuse reports ignored. Servers are in NL.

Probably not China.

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#17

Post by rahimnathwani »

mikeash wrote: post #13
gerdesj wrote: post #11

I've never been anywhere near the GFW but I do find OpenVPN listening on 443/tcp and a few other ports (tcp and udp) on the outside quite handy for drilling through firewalls. It supports basic auth proxies but CNTLM is in the toolbox as well. Add in NAT and a few routing entries on other hosts. It also provides a simple way to detect a transparent MitM proxy. If OVPN fails to connect but an "unprotected" https conne…

This sort of thing used to work, but doesn't anymore. The GFW is now smart enough to detect VPNs based only on the traffic they generate, not port numbers or other easily changed things. It's currently an arms race between VPN providers trying to mask their traffic and the firewall trying to uncover it, and the firewall is winning so far.

If you're in China, you might want to use Shadowsocks. The server is easy to set up on any VPS (no need for TUN/TAP), and there are clients for Android (Shadowsocks), iOS9+ (Potatso), linux and routers.

I've found plain OpenVPN over TCP or UDP stopped working a few years ago (even using remote-random to shuffle ports). PPTP mostly still works.

I haven't used other VPN protocols for a long while, and don't use commercial VPN providers, but occasionally hear from friends that they have temporarily issues (for hours or days, but not weeks).

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#18

Post by mikeash »

rahimnathwani wrote: post #17
mikeash wrote: post #13

Earlier quoted context omitted.

This sort of thing used to work, but doesn't anymore. The GFW is now smart enough to detect VPNs based only on the traffic they generate, not port numbers or other easily changed things. It's currently an arms race between VPN providers trying to mask their traffic and the firewall trying to uncover it, and the firewall is winning so far.

If you're in China, you might want to use Shadowsocks. The server is easy to set up on any VPS (no need for TUN/TAP), and there are clients for Android (Shadowsocks), iOS9+ (Potatso), linux and routers. I've found plain OpenVPN over TCP or UDP stopped working a few years ago (even using remote-random to shuffle ports). PPTP mostly still works. I haven't used other VPN protocols for a long while, and don't use commerc…

Thanks, I'll give that a shot next time. I think I tried PPTP when I was there last year without success, but I may be misremembering.

Re: Examining How the Great Firewall Discovers Hidden Circumvention Servers (2015)

#19

Post by lisivka »

pixl97 wrote: post #14
mikeash wrote: post #13

Earlier quoted context omitted.

This sort of thing used to work, but doesn't anymore. The GFW is now smart enough to detect VPNs based only on the traffic they generate, not port numbers or other easily changed things. It's currently an arms race between VPN providers trying to mask their traffic and the firewall trying to uncover it, and the firewall is winning so far.

Whelp, that's pretty much it for the internet. Won't be long before many more governments are licensing and using this technology. The question is how long before supposedly 'free' governments start.

It's easy to fix by mirroring their behavior: drop incoming connections from China until they drop their firewall.
Post reply on HN