GoodbyeDPI: Deep Packet Inspection circumvention utility • Hacker News Board

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#101

Post by diasan » Sat, Jul 23, 2022, 6:56 PM UTC

liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

The problem / disconnect with that DPI is dead article is that corporations still want to use use, as they control their employees computers.

Hence I've recently been asked to implement a URL inspecting firewall, which implies a HTTPS intercepting MiTM proxy. They will probably require some exception list where things get passed through 'unmolested', but for a white listed sub-set of sites (say well known health, banking, etc).

The one thing which can break that is cert pinning, but then the corporations can simply mandate that apps requiring/using cert pinning not be used from the corporate machines.

There are some bumps in the techniques caused by HTTPS RRs, AltSvc and HTTP/3, but they will be worked around, at worst by forced downgrades.

The "they'll never no argument" carries no weight, as employers up front tend to inform their employees that the communications are monitored, hence giving the corporation legal cover.

That said, I do generally agree with the aim of that article, but changing the corporate mindset is a different (non technical) problem; it is all about providing the corporation with a colorable argument towards reducing their liability in certain scenarios.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#102

Post by from » Sat, Jul 23, 2022, 7:05 PM UTC

liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

> I religiously route all my traffic through a VPN that I own and control.

But then you are losing the anonymizing effect of the VPN. If you are doing something illegal this is obviously bad but I guess it otherwise doesn't really matter. Companies like Mullvad have tens of thousands of users which means that the actions of one VPN IP address can not be attributed to just one person. You're just transferring the ability to surveil you from your ISP to whoever hosts your VPN server.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#103

Post by guardiangod » Sat, Jul 23, 2022, 7:22 PM UTC

mytailorisrich wrote: post #84

guardiangod wrote: post #83

Earlier quoted context omitted.

Your suspicion is wrong. Sorry.

I actually work in the field (networking) and FPGAs are very common in professional telecommunication equipments, hence my suspicion/guess that DPI are the same, especially since I'm also guessing that this is the sort of thing that may be updated often. So I think my 'suspicion' is at least as good as yours.

As long as we are pulling ranks,

I worked in a DPI/firewall company and my work ran on the ASIC accelerator, so nah, my 'guess' is probably better.

FPGA is not worth the trouble. You get neither the (line) speed of ASIC, nor the flexibility of running everything in the CPU. Most serious DPI hardware vendors have stopped using it.

But you are right that it's no fun trying to workaround ASIC bugs.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#104

Post by checkyoursudo » Sat, Jul 23, 2022, 7:23 PM UTC

liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

Why not run everything through TOR then? Or is that too limiting?

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#105

Post by ValdikSS » Sat, Jul 23, 2022, 7:26 PM UTC

OmarAssadi wrote: post #75

patrakov wrote: post #18

Earlier quoted context omitted.

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

For what it’s worth as well, there are other solutions than whole-network VPNs and such. Personally, I chose to generate a domain list for V2Ray from the Russian government’s blocklist when I lived there [1]. I prefer to do that typically because it avoids the pain of the ever-growing whitelists and it allows me to keep the traffic encrypted in case someone does actually figure out that you’ve bypassed DPI. And if yo…

GoodbyeDPI also includes Russian blacklist built from zapret-info, to apply censorship circumvention only for the websites from the list, to reduce the risk of breaking the website due to mangled traffic.

The newest issue are unlisted filtering performed on so-called TSPU DPI boxes. Two years ago we had only ISP DPI boxes, but now there's a government TSPU black box which they control themselves and block the websites/VPNs/SSH/IP ranges out-of-the-registry.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#106

Post by ValdikSS » Sat, Jul 23, 2022, 7:30 PM UTC

rixrax wrote: post #33

Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?

No, unfortunately almost no of these naive methods longer works. However the protocol spoofing ("fake packet" in GoodbyeDPI) with Auto-TTL is pretty effective on most ISPs of Russia, Korea, Indonesia, Turkey.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#107

Post by ValdikSS » Sat, Jul 23, 2022, 7:31 PM UTC

progbits wrote: post #37

rixrax wrote: post #33

Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?

Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.

That was true 3-4 years ago but nowadays they're getting surprisingly good, and that's alarming.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#108

Post by ValdikSS » Sat, Jul 23, 2022, 7:35 PM UTC

mmwelt wrote: post #11

Doesn't work in China, though: https://github.com/ValdikSS/GoodbyeDPI/issues/123

If anyone gets me a network link to China, I'm ready to test and implement new techniques.

Last time I asked why such tools are not built in China, the developer of very popular anti-censorship tool told me that there are punishment for censorship circumvention in China, and such tools which openly punch DPI could be more dangerous for the end user in the legal sense.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#109

Post by mytailorisrich » Sat, Jul 23, 2022, 7:36 PM UTC

guardiangod wrote: post #103

mytailorisrich wrote: post #84

Earlier quoted context omitted.

I actually work in the field (networking) and FPGAs are very common in professional telecommunication equipments, hence my suspicion/guess that DPI are the same, especially since I'm also guessing that this is the sort of thing that may be updated often. So I think my 'suspicion' is at least as good as yours.

As long as we are pulling ranks, I worked in a DPI/firewall company and my work ran on the ASIC accelerator, so nah, my 'guess' is probably better. FPGA is not worth the trouble. You get neither the (line) speed of ASIC, nor the flexibility of running everything in the CPU. Most serious DPI hardware vendors have stopped using it. But you are right that it's no fun trying to workaround ASIC bugs.

Well you made a laconic, non-substantive reply so you ought to expect pushback.

FGPAs allow near-ASIC speeds with effectively the flexibility of software in that they can be updated via firmware upgrades, with much cheaper dev. costs than ASICs. They do have a higher unit cost than ASICs but only at high volume. For anything that is 'low' volume an ASIC may not make financial sense at all in any case.

I am no expert in DPI specifically but Google suggests that using FPGAs for DPI is an active commercial topic.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#110

Post by ValdikSS » Sat, Jul 23, 2022, 7:40 PM UTC

kebman wrote: post #57

Sorry, might be a dumb question, but isn't this simply a matter of encrypting your packets or using a VPN?

Several issues:

* VPNs are mostly not free, and with current situation in Russia, you can't easily pay for the Europe/US service due to absent Visa/MC service

* Popular VPN providers are getting blocked in Russia recently

* For the major websites, such as Instagram and Twitter, VPN access almost instantly triggers additional checks, cellphone number validation, account block, etc.

* VPN connection increases latency and reduces speed

While GoodbyeDPI is free and autonomous.

AND it can unblock VPNs, too! For example, the latest build can unblock blocked ProtonVPN by inserting fake TLS packet during OpenVPN TCP handshake.