11–20 of 289 posts
Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...
The algorithm found seems so unintuitive that I wonder if it was not found by the AI. " Allow a connection to continue if the first TCP payload (pkt) sent by the client satisfies any of the following exemptions: Ex1: popcount(pkt) len(pkt) ≤ 3.4 or popcount(pkt) len(pkt) ≥ 4.6. Ex2: The first six (or more) bytes of pkt are [0x20,0x7e]. Ex3: More than 50% of pkt’s bytes are [0x20,0x7e]. Ex4: More than 20 contiguous by…
This is just some experimentation results, it's not algorithm.
Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...
The algorithm found seems so unintuitive that I wonder if it was not found by the AI. " Allow a connection to continue if the first TCP payload (pkt) sent by the client satisfies any of the following exemptions: Ex1: popcount(pkt) len(pkt) ≤ 3.4 or popcount(pkt) len(pkt) ≥ 4.6. Ex2: The first six (or more) bytes of pkt are [0x20,0x7e]. Ex3: More than 50% of pkt’s bytes are [0x20,0x7e]. Ex4: More than 20 contiguous by…
Do you mean "found" by the CCP, or "found" by the researchers? In the case of the CCP it was likely generated through basic statistical analysis, and tuned to minimize side effects and collateral damage below some threshold of acceptability (~0.6% of global traffic unintentionally blocked). In the case of the researchers, the paper details the basic statistical analysis used to discover these rules.
I remember having to deal with the early GFW about 20 years ago when I was working for a company that had some employees on a site in Shanghai. Every morning, our colleagues in China would open their mail client and it would connect to our server abroad. The first person would usually be OK, but for everyone else, the connection would fail. At the time, almost nothing was known of the GFW and it wasn't as clever as i…
Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...
VPN authors should chose the maximum collateral damage strategy to frustrate GFW authors, make China as close as possible to completely cutting off outside internet. No need to completely evade fingerprinting, instead, do the complete opposite, and try to mimic common protocols, and critical applications as much as possible.
That is, assuming entry nodes are available as e.g. nginx proxies inside the Chinese ASNs and are allowed to operate serving websites to ASNs from foreign countries.
I'm mentioning nginx because there were some related bypass vulnerabilities in the past, and one could argue that they just missed updating them.
Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...
I'd go for ssh if I was trying to bypass it. At least legally I can claim that I'm just sshing to my aws server and not be jailed for using vpn.