As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?
China systematically hijacks internet traffic: researchers
11–20 of 54 posts
Re: China systematically hijacks internet traffic: researchers
#12As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?
If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!
Re: China systematically hijacks internet traffic: researchers
#13As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?
If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!
[citation needed]
Like whoa, are you even aware of what you are suggesting? This is completely false.
Re: China systematically hijacks internet traffic: researchers
#14As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?
If I had to do it, I'd go full thin client. Store nothing. Bring a laptop that is basically a bare bones Linux + xfce desktop, and the ability to connect to external VPN + vnc-over-ssh2 session to a system you trust. Keep in mind that a rootkit installed on your thin client is a possibility, for keystroke logger or whatnot, so if you don't keep it with you and don't treat its physical security as a concern, all bets are off.
Re: China systematically hijacks internet traffic: researchers
#15From an ISP perspective this is really hard to hide. If somebody announces my /16 from Pakistan and traffic goes there, it's going to get noticed. Like the time PTCL broke YouTube...
You basically can't bgp hijack without breaking basic internet connectivity for the legit users of the IP space (where it is intended to be announced to peers and transits), so anything lasting more than 30 seconds will generate a huge flurry of phone calls and noc emails.
There are third party services you can pay, and software you can set up yourself to watch for bgp announcements for "your" Arin/ripe/apnic/whatever prefixes, and generate alerts based on that. Pretty common stuff with Linux based systems (FRR, etc) that can hold the entire global v4+v6 routing table in RAM and do quick analysis on it.
Google "bgp hijack", this is a well known issue in the ISP operational community. RPKI validation of announced routes and best common practices for what you accept from your bgp neighbors go a long way.
Re: China systematically hijacks internet traffic: researchers
#16Earlier quoted context omitted.
If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!
[citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
No need to decrypt SSL, there are easier ways: https://xkcd.com/538/
Re: China systematically hijacks internet traffic: researchers
#17Earlier quoted context omitted.
[citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
No need to decrypt SSL, there are easier ways: https://xkcd.com/538/
Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.
Re: China systematically hijacks internet traffic: researchers
#18As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?
Buy a feature phone and dump it once you return.
Re: China systematically hijacks internet traffic: researchers
#19Earlier quoted context omitted.
[citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
No need to decrypt SSL, there are easier ways: https://xkcd.com/538/
Naturally! Well - except for the diplomatic disaster this would turn into if you did it on foreigners.
I think most people exaggerate the technical capabilities of the Chinese government and how interesting they are for them. Sure, we shouldn't be naive, but a drop of realism is always good.
Re: China systematically hijacks internet traffic: researchers
#20Traffic heading to China gets intercepted-- you don't say?