Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoodbyeDPI: Deep Packet Inspection circumvention utility

github.com

Post reply on HN
Print view View original

81–90 of 124 posts

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#81

Post by karmanyaahm »

pklack wrote: post #65
luke727 wrote: post #56

Earlier quoted context omitted.

"prevent injection of a driver that can divert all my shit at the kernel level" is exactly what you want secure boot protecting you from. The only thing Secure Boot is doing here is preventing you from loading a driver not blessed by Microsoft. They would happily bless "a driver that can divert all my shit at the kernel level", but it costs too much for the maintainer of WinDivert.

It is kind of sad that no one seems to bother enough to actually learn how to use Secure Boot to their advantage. Everyone is just disabling it the first time it gets in their way. Reminds me of how Firewalls used to be treated like 20 years ago. Yes, by default most implementations will only accept signatures from Microsoft. But the thing is: You can always enroll your own keys. My Laptop is currently booting a non-…

I think that for the vast majority of threat models, the insecurity of having your own signing certificate (it needs to be hot if it's going to be automated) is not much different from the risk of not having secure boot at all. Also, the effort v. security balance.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#82

Post by Diris »

wruza wrote: post #61
liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

religiously route all my traffic through a VPN that I own and control Can you please share an easy way to do that? I’m usually not afraid of wading through configuration swamps, but when it comes to openvpn, I curl up in a corner crying.

This is probably the easiest way. It uses wireguard instead of openvpn but I'm pretty sure it's better https://github.com/angristan/wireguard-install

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#83

Post by guardiangod »

mytailorisrich wrote: post #79
vbezhenar wrote: post #70

Earlier quoted context omitted.

Can you update ASICs with new firmware?

No but I suspect many hardware products use FPGAs, which can be updated as you would firmware, and indeed are often updated during firmware updates.

Your suspicion is wrong. Sorry.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#84

Post by mytailorisrich »

guardiangod wrote: post #83
mytailorisrich wrote: post #79

Earlier quoted context omitted.

No but I suspect many hardware products use FPGAs, which can be updated as you would firmware, and indeed are often updated during firmware updates.

Your suspicion is wrong. Sorry.

I actually work in the field (networking) and FPGAs are very common in professional telecommunication equipments, hence my suspicion/guess that DPI are the same, especially since I'm also guessing that this is the sort of thing that may be updated often. So I think my 'suspicion' is at least as good as yours.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#85

Post by Avamander »

progbits wrote: post #37
rixrax wrote: post #33

Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?

Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.

I suspect it's not even about not being able to, there's very little motivation. I had a brief contact with ZScaler who operates approximately in this area of traffic inspection, they literally have no clue and they don't care. Their service can be hot flaming trash but people will still pay them money because they check some boxes. I'm sure it applies to other companies in the same area as well.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#86

Post by Avamander »

laughinghan wrote: post #20
blahgeek wrote: post #6

Haha that’s cute. Here in china the GFW now simply routes the IPs to blackhole. False positive by virtual host or CDN you ask? They don’t care :)

That's what domain fronting is for, and even though the GFW attempts to filter by SNI, genetic algorithms like Geneva are able to find workarounds: https://geneva.cs.umd.edu/papers/foci21.pdf

ESNI/ESH is coming soon, I guess we'll see soon enough how that plays out.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#87

Post by Avamander »

userbinator wrote: post #7

Looks like it uses WinDivert as the filtering driver, which says on its site that "Windows Server 2016 systems must have secure boot disabled"; not entirely surprising and a reminder of what a lot of the "security" stuff is really securing.

Wow, it's like the average vendor's support of SELinux or AppArmor. "Just turn it off" facepalm

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#88

Post by Avamander »

0xedd wrote: post #73
denkmoon wrote: post #21

Earlier quoted context omitted.

Sad to see this downvoted without any response, because as far as I see he's exactly right.

No. That's just propaganda. The purpose is to further vendor lock you. MS has a minute share in the world of OS, completely outclassed by Linux. They're trying to force their way in by fooling people like you that something like Pluton is required. The only reason they dominate the PC market share is because their spyware OS is installed by default and people don't go around switching OSes. An anecdote about security…

I'm not sure if you don't know or don't want to know what SB does, but it's not propaganda, neither is it vendor-locking. Most widespread vendor locks don't use SB, neither is the functionality only usable for that (well duh, it could be, because you can choose your root of trust, but you can choose the root).

You might as well call other tech Linux doesn't play well with "vendor-locking" as this point with no concern, even if there are no real "locks" like that, just lack of support. "TME doesn't work? Literally vendor-locking and Microsoft propaganda!1!"

Security corporations, known for their cargo culting in addition to the usual corporate bullshit, aren't a great example. But bringing then up like they somehow were... makes you wonder indeed.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#89

Post by pelasaco »

tambourine_man wrote: post #31
5e92cb50239222b wrote: post #26

Earlier quoted context omitted.

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally co…

Thank you, I do too. I though it was only me. SSH is very simple and there’s almost nothing a SSH tunnel can’t do.

> SSH is very simple and there’s almost nothing a SSH tunnel can’t do.

You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DPI solutions.. so its easy to block/filter/log your traffic or even pinpoint you in an adverse environment.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#90

Post by Avamander »

jeroenhd wrote: post #45

> Active DPI is more tricky to fool. Currently the software uses 7 methods to circumvent Active DPI: > TCP-level fragmentation for first data packet > TCP-level fragmentation for persistent (keep-alive) HTTP sessions > Replacing Host header with hoSt > Removing space between header name and value in Host header > Adding additional space between HTTP Method (GET, POST etc) and URI > Mixing case of Host header value >…

> DPI middleboxes are truly terrible. They're incompatible with even basic TCP without any good reason.

Thanks to them things like TCP Fast Open are unfortunately still a rarity.

> I wonder if these ISPs use the same vendors as your average "enterprise" network.

Most likely, yes. Takes a bit too much effort to handle the bandwith necessary, that everyone would be able to do and sell it as a service.

Post reply on HN