Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoodbyeDPI: Deep Packet Inspection circumvention utility

github.com

Post reply on HN
Print view View original

111–120 of 124 posts

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#111

Post by izacus »

kevin_thibedeau wrote: post #16
izacus wrote: post #9

Earlier quoted context omitted.

More importantly, it's widely deployed by HNers in US to snoop though everything you do on your phone, tablet and computer if you dare to use their wifi. The ops topics are full of people claiming how critically important it is for them to sniff through everything you do on "their" network for security. You don't need to go to Russia, China or India to have your privacy violated. Just go to work.

Your privacy isn't violated if you avail yourself of someone else's property.

The networks of ISPs you're "availing yourself to" are their property.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#112

Post by blacksmith_tb »

wruza wrote: post #61
liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

religiously route all my traffic through a VPN that I own and control Can you please share an easy way to do that? I’m usually not afraid of wading through configuration swamps, but when it comes to openvpn, I curl up in a corner crying.

I have had good luck with Algo: https://github.com/trailofbits/algo

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#113

Post by neurostimulant »

witrak wrote: post #64
psydvl wrote: post #60

Earlier quoted context omitted.

Default user just want to access blocked resources. Free VPN... Can we trust them? Paid VPN are paid.

>Free VPN... Can we trust them? Paid VPN are paid. Paid VPNs are paid. Can we trust them more?

People who live in a country with strict censorship often can't pay foreign vpn company due to the lack of payment processors support. Can't pay with visa/mastercard if you live in Russia or Iran.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#114

Post by OmarAssadi »

ValdikSS wrote: post #105
OmarAssadi wrote: post #75

Earlier quoted context omitted.

For what it’s worth as well, there are other solutions than whole-network VPNs and such. Personally, I chose to generate a domain list for V2Ray from the Russian government’s blocklist when I lived there [1]. I prefer to do that typically because it avoids the pain of the ever-growing whitelists and it allows me to keep the traffic encrypted in case someone does actually figure out that you’ve bypassed DPI. And if yo…

GoodbyeDPI also includes Russian blacklist built from zapret-info, to apply censorship circumvention only for the websites from the list, to reduce the risk of breaking the website due to mangled traffic. The newest issue are unlisted filtering performed on so-called TSPU DPI boxes. Two years ago we had only ISP DPI boxes, but now there's a government TSPU black box which they control themselves and block the website…

Yeah, I've come across your tool a few times before and seen the default lists. Really useful stuff, by the way!

Interesting, though. I had heard talks about introducing proper government-level filtering -- I think after the Telegram/AWS/etc blocks in, like, 2018 (?), but I wasn't aware of anything actually going into effect.

If you've got time to answer or link me anything, I am a little curious. How are the TSPU boxes setup? Are these provided by the government to different datacenters/IXs or at some sort of higher level than that? And are they currently just used to filter additional out-of-registry domains/IP addresses or do they also filter the semi-public, known blacklist? Is there anything like the unofficial Chinese gfwlist that tries to maintain a list of the out-of-registry stuff?

I haven't lived in Russia in a little while now, but when I was last there, although virtually every residential ISP enforced the government list, a number of the domestic server providers weren't, so a good option for low-latency and keeping a Russian IP address was just renting a gigabit VPS from the city next to me and using it as a proxy server.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#115

Post by jimmySixDOF »

patrakov wrote: post #71
oarsinsync wrote: post #59

Earlier quoted context omitted.

Encapsulating TCP in TCP results in exponential backoff and retransmissions in the event of loss.

SSH tunneling is encapsulating byte streams in TCP, not TCP (which means "packets with sequence numbers, acknowledgements, and retransmissions") in TCP, and therefore doesn't suffer.

Well the byte stream includes everything you throw in (TCP/UDP/L2), so while the tunnel will not suffer from any signaling issues in the payload flow, the opposite is not true - the internal traffic is affected by any TCP problems on the SSH tunnel so a short blip on the tunnel can cause a cascade of blips depending on whats in there.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#116

Post by denkmoon »

0xedd wrote: post #73
denkmoon wrote: post #21

Earlier quoted context omitted.

Sad to see this downvoted without any response, because as far as I see he's exactly right.

No. That's just propaganda. The purpose is to further vendor lock you. MS has a minute share in the world of OS, completely outclassed by Linux. They're trying to force their way in by fooling people like you that something like Pluton is required. The only reason they dominate the PC market share is because their spyware OS is installed by default and people don't go around switching OSes. An anecdote about security…

What? Secure Boot doing anything to force you into Microsoft solutions is a hardware vendor/supplier issue. They're the one that configure the secure boot parameters, and with minor exception (don't buy bad products...) they do not lock you out of booting non-Microsoft solutions.

I fail to see in any way how preventing the loading of unsigned drivers in the secure boot chain is "vendor lock-in".

Furthermore, that signature does _not_ have to be Microsoft's. You can sign a driver with a private CA and provided that signer is in the trust store, it will be loaded.

>at my workplace, one of the top 5 security firms in the world

Cool, my dad works for Nintendo tho. Agree with other poster, not sure if you even know what Secure Boot is. Seems like you read an article on Slashdot about it 10 years ago.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#117

Post by ValdikSS »

OmarAssadi wrote: post #114
ValdikSS wrote: post #105

Earlier quoted context omitted.

GoodbyeDPI also includes Russian blacklist built from zapret-info, to apply censorship circumvention only for the websites from the list, to reduce the risk of breaking the website due to mangled traffic. The newest issue are unlisted filtering performed on so-called TSPU DPI boxes. Two years ago we had only ISP DPI boxes, but now there's a government TSPU black box which they control themselves and block the website…

Yeah, I've come across your tool a few times before and seen the default lists. Really useful stuff, by the way! Interesting, though. I had heard talks about introducing proper government-level filtering -- I think after the Telegram/AWS/etc blocks in, like, 2018 (?), but I wasn't aware of anything actually going into effect. If you've got time to answer or link me anything, I am a little curious. How are the TSPU bo…

https://bitbucket.org/anticensority/russian-unlisted-blocks/... — my list of unlisted blocks

>How are the TSPU boxes setup? Are these provided by the government to different datacenters/IXs or at some sort of higher level than that?

They are provided by the government and should be installed topologically close to the client, before CGNAT. This is a modified RDP.RU EcoFilter, and currently are required to be installed only on residential connections, not in DCs/IXes. ISPs do not have any configuration access, and it's prohibited to route traffic not via the boxes. The abbreviation TSPU means Technical Measures to Combat Threats, and these boxes are capable of collecting, saving and centralized sharing of NetFlow data, but currently are almost always used only for blocking, however the general idea is to centrally control BGP flows and collect SNMP data from other ISP routers.

The company which controls the boxes is called Center of Public Network Monitoring and Control (ЦМУ ССОП, Центр мониторинга и управления сетью связи общего пользования).

>do they also filter the semi-public, known blacklist?

Yes, they do. I suppose the idea is to replace filtering DPI boxes which were installed on the ISP network all these years with this one. Right now most ISPs have both TSPU and one of commercial DPI systems.

More information in English from Alexander Isavnin on RIPE: https://ripe83.ripe.net/archives/video/630/

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#118

Post by tambourine_man »

pelasaco wrote: post #89
tambourine_man wrote: post #31

Earlier quoted context omitted.

Thank you, I do too. I though it was only me. SSH is very simple and there’s almost nothing a SSH tunnel can’t do.

> SSH is very simple and there’s almost nothing a SSH tunnel can’t do. You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DPI solutions.. so its easy to block/filter/log your traffic or even pinpoint you in an adverse environment.

Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#119

Post by SergeAx »

liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

But why exactly do you do this? Own a server somewhere, admin it, replace or repair it in case of trouble - what for?

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#120

Post by patrakov »

tambourine_man wrote: post #118
pelasaco wrote: post #89

Earlier quoted context omitted.

> SSH is very simple and there’s almost nothing a SSH tunnel can’t do. You cannot disguise your SSH traffic mimicking HTTPS traffic which help you to bypass DPI solutions.. so its easy to block/filter/log your traffic or even pinpoint you in an adverse environment.

Please expand. How can an Apache server, for instance, know if I’m accessing through and SSH tunnel. And how would that be different on a Wireguard VPN?

No post body was provided.
Post reply on HN