Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China systematically hijacks internet traffic: researchers

itnews.com.au

Post reply on HN
Print view View original

41–50 of 54 posts

Re: China systematically hijacks internet traffic: researchers

#41

Post by rurban »

Taniwha wrote: post #6

And the US and the rest of the 5-eyes don't? that doesn't make it right, just more wrong, if you're angry that China is doing this then you should be equally because the US and 'friends' are doing it to you too

Not only the 5 eyes, France and Germany do it. Most middle east Arabian states do it. Russia does it. Iran does it. Don't know about India, Pakistan, Indonesia, but it should be assumed that the gov secret population control services are selectively redirecting and sniffing up most of the traffic there also, at least on the European scale, i.e. ~10%.

Re: China systematically hijacks internet traffic: researchers

#42

Post by 68c12c16 »

walrus01 wrote: post #39
68c12c16 wrote: post #38

Earlier quoted context omitted.

FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN... A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page whil…

It isn't that they need to inspect the contents of the packets, tcp and udp flow analysis will reveal VPN traffic patterns even if the crypto is perfect. What I've seen reported is that people using openvpn see it work for a while, then increasing latency and packet loss, then eventually total lack of ability to move traffic between the two endpoint IPs.

that's true...they have been studying the packet flow patterns for a while -- such as this research,

http://security.riit.tsinghua.edu.cn/share/classify_encrypte...

But if the government completely blocks out VPN uses in the country, lots of international business operating there will suffer and then they will complain, which is not something the government can ignore (at least not always)...VPN whitelist could be a solution, but I don't know how well that is implemented (if it has been implemented) -- not to mention keeping a perfect consistent whitelist at that scale would be difficult...in addition, there is always some false positive/negative in their flow pattern analysis -- those are statistical approaches after all...so there is some grey area here...

Anyway, back to that openvpn experiment I did with my friend, many websites were still accessible with my openvpn tunnel -- although Google was not among those sites -- this seems to imply that they were doing some package semantic analysis (i.e. deep packet inspection)...

Re: China systematically hijacks internet traffic: researchers

#43

Post by knightofmars »

Taniwha wrote: post #6

And the US and the rest of the 5-eyes don't? that doesn't make it right, just more wrong, if you're angry that China is doing this then you should be equally because the US and 'friends' are doing it to you too

Tu Quoque

You avoided having to engage with criticism by turning it back on the accuser - you answered criticism with criticism.

Pronounced too-kwo-kwee. Literally translating as 'you too' this fallacy is also known as the appeal to hypocrisy. It is commonly employed as an effective red herring because it takes the heat off someone having to defend their argument, and instead shifts the focus back on to the person making the criticism.

https://yourlogicalfallacyis.com/tu-quoque

Re: China systematically hijacks internet traffic: researchers

#44

Post by [deleted] »

dangrover wrote: post #34
HippoBaro wrote: post #27

Earlier quoted context omitted.

(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy. A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer i…

Used to live in China. Can vouch completely for the Shadowsocks approach. It can't be blocked yet. Set up an endpoint at home or on EC2 and configure Streisand. Works great on mobile and desktop.

[deleted]

Re: China systematically hijacks internet traffic: researchers

#45

Post by lbriner »

vegardx wrote: post #19
anyzen wrote: post #16

Earlier quoted context omitted.

No need to decrypt SSL, there are easier ways: https://xkcd.com/538/

Naturally! Well - except for the diplomatic disaster this would turn into if you did it on foreigners. I think most people exaggerate the technical capabilities of the Chinese government and how interesting they are for them. Sure, we shouldn't be naive, but a drop of realism is always good.

The difference is in the degree! I don't think the Chinese could or would decrypt all foreigners traffic (and I did mean TLS but use the more well-known SSL name) but if the question is "As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?", the answer is very clearly don't connect to the internet.

I don't know the person who asked the question, whether he is a realistic government target or just some normal person but there are enough reports of cache poisoning, VPN control/blocking and Chinese hijinks to know that if you are worried about them, don't connect. Mind you, the same fear applies to the US and UK as well.

Re: China systematically hijacks internet traffic: researchers

#46

Post by 68c12c16 »

HippoBaro wrote: post #27
sethbannon wrote: post #11

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy. A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer i…

shadowsocks is on their radar now...and they have been able to detect its usage with some success, unfortunately...

i.e. The Random Forest Based Detection of Shadowsock's Traffic, https://ieeexplore.ieee.org/document/8048116/

I don't really understand what kind of scientists would do such researches to help the government carry out the censorship more efficiently, over their fellow people...it's either those intellectuals have no brain, or no heart...

Re: China systematically hijacks internet traffic: researchers

#47

Post by shawnz »

HippoBaro wrote: post #35
shawnz wrote: post #29

Earlier quoted context omitted.

But shadowsocks is a VPN. What makes it better than other offerings?

Shadowshocks is not a VPN at all. It's a connectionless SOCKS5 proxy. No hand-check, no key exchange, no protocol agreement. VPN is not made to be undetected, only secure in the sense of data encryption. Shodowsocks has broader objectives. See https://shadowsocks.org/ for info.

> It's a connectionless SOCKS5 proxy.

On your local workstation, it exposes itself as a SOCKS5 proxy. But to communicate with the shadowsocks server, it uses a proprietary protocol which is not SOCKS5 and does have a key exchange process. Either way, these details don't affect its ability to be detected.

> VPN is not made to be undetected

"VPN" is not just one technology. Many vendors of VPN software do claim that their software is made to be undetectable. One example is shadowsocks, but there are other vendors who also claim that.

Re: China systematically hijacks internet traffic: researchers

#48

Post by kklimonda »

jstanley wrote: post #32
qubax wrote: post #31

Earlier quoted context omitted.

Just like programming languages can only have two out of three concepts ( soundness, completeness, decidability ), the creators of the internet had to choose two out of three concepts ( openness, robustness, security ). It's theoretically impossible to have a language that is sound, complete and decidable. It's probably also impossible to have an internet that is open, robust and secure.

I don't think that argument holds water. Which one of "open, robust, secure" do you think Tor doesn't meet? You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).

How does one use Tor without the internet?

Re: China systematically hijacks internet traffic: researchers

#49

Post by lordlimecat »

68c12c16 wrote: post #38
sethbannon wrote: post #11

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN... A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page whil…

They will detect the VPN trivially if you try to layer them. They only need to see either the pattern of traffic or the outermost layer's handshake.

OpenVPN has been offlimits in China for like 8 years now.

Re: China systematically hijacks internet traffic: researchers

#50

Post by lordlimecat »

elorant wrote: post #18
sethbannon wrote: post #11

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

Buy a feature phone and dump it once you return.

Buying a SIM in china requires you to register your passport.
Post reply on HN