Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the great firewall of China detects and blocks fully encrypted traffic [pdf]

gfw.report

Post reply on HN
Print view View original

51–60 of 289 posts

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#51

Post by fundatus »

apatheticonion wrote: post #42
__sy__ wrote: post #41

I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…

I tried to setup a shadowsocks server to bypass the GFW about 2 weeks ago. Server was hosted on my local network in Australia (with public IP), client was connecting from China (using the server IP). It was blocked immediately and the client could not connect. I had several unknown IPs try to connect prior to the attempted connection. I was stunned at how water tight the GFW is, it's really unfortunate as I would lov…

Last time I went to China (2018) you could simply get a China Unicom Hong Kong SIM card and then use that to roam in mainland China. With that you'd get the Hong Kong censorship level, which is much much less restrictive. No VPN or anything needed apart from the SIM card itself.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#52

Post by netheril96 »

amrocha wrote: post #12
vbezhenar wrote: post #9

Earlier quoted context omitted.

This is just some experimentation results, it's not algorithm.

An algorithm is just a bunch of rules to follow to perform an operation, so this looks like an algorithm to me.

You misunderstood your parent comment. What he/she meant is that the "algorithm" is only a guess from reverse engineering. The actual algorithm deployed at GFW can look significantly different.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#53

Post by pantalaimon »

helen___keller wrote: post #50
WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered. My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway. Most people are not persecuted for using a VPN, I assume that’s reserved for people who t…

I think China doesn’t care if foreigners use a VPN, it’s their own people they want to keep under control.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#54

Post by ehhthing »

__sy__ wrote: post #41

I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…

GFW only looks at connections with destination IPs outside of China, the private fibre line bypasses it entirely.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#55

Post by ehhthing »

helen___keller wrote: post #50
WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered. My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway. Most people are not persecuted for using a VPN, I assume that’s reserved for people who t…

Assuming what you mean is over mobile data (and not over wifi), mobile data works differently than typical internet. You can think of it like when you connect to a mobile network what you're actually doing is making an IPsec connection to your carrier, with all data flowing over that IPsec connection. As such any carrier with a roaming agreement in China will bypass the GFW entirely -- and this is by design, Chinese carriers have to whitelist the APNs of western companies they do business with.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#56

Post by Grimburger »

apatheticonion wrote: post #42
__sy__ wrote: post #41

I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…

I tried to setup a shadowsocks server to bypass the GFW about 2 weeks ago. Server was hosted on my local network in Australia (with public IP), client was connecting from China (using the server IP). It was blocked immediately and the client could not connect. I had several unknown IPs try to connect prior to the attempted connection. I was stunned at how water tight the GFW is, it's really unfortunate as I would lov…

That's a massive shame because shadowsocks has been the only real reliable method for a long time.

I used it successfully when I was in mainland China while VPN's, even the ones boasting they could get through the GFW were all hit or miss.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#57

Post by H8crilA »

proto_lambda wrote: post #30
dizhn wrote: post #15

Earlier quoted context omitted.

We have a satellite office in Dubai. I know their static IP. When they connect to our imap/smtp server they are coming in from another IP. I never looked into it deeply but assumed their connection is being diverted for inspection. (If true, they would probably not be below performing industrial espionage with the data they are accessing)

At that level, there is no reason to proxy it through a different IP address. If you control the network, you can just make the packets come from the original, real address.

It was probably written by junior devs, like most other software around the world.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#60

Post by Ballas »

blablablub wrote: post #36
Ballas wrote: post #2

Seems like UDP is completely exempt, which would allow UDP-based VPNs, like Wireguard through. SSH is also exempt...

Wireguard is detected within the first minute of usage and blocked. The ping is a dead giveaway.

Interesting. I was just going on my limited scan through the linked PDF, which evidently was not thorough enough.
Post reply on HN