This paper is nice, but it goes over some finer technical things.
So, not about the great wall, but there's projects out there, like this one https://github.com/salesforce/ja3 , which talk about how you can fingerprint fully encrypted traffic(TLS/HTPS). There's a great section in the Readme "How it works" that goes over it. Would be surprising if the great wall doesn't do this, when some open source firewall will.
How the great firewall of China detects and blocks fully encrypted traffic [pdf]
61–70 of 289 posts
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#62I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…
MS and other vendors recommend doing something similar (connecting via Hong Kong): https://learn.microsoft.com/en-us/azure/virtual-wan/intercon...
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#63Can you bring a Starlink and then just don't really care?
Nope. Starlink shuts down over china on the satellite side. Tesla has a huge presence there and they also threatened to shoot the satellites down (which they've done before) if starlink provided internet access there
To clarify for readers: China has never shot down someone else's satellite. They've only destroyed one satellite ever and it was their own.
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#64Earlier quoted context omitted.
Trying to get off the hook on a technicality isn't going to work. Lots of people use VPNs completely in the open without getting jailed, because they're not otherwise of interest, but if you are being targeted, nobody is going to care about your "sshing to aws" excuse. And ssh tunneling web traffic looks quite different from normal ssh usage anyways.
> And ssh tunneling web traffic looks quite different from normal ssh usage anyways. Could you explain this further, this seems counter to my understanding of encrypted traffic!
Open network tools in your browser and go to Reddit, count total traffic. Now compare it with a typical SSH session, even with 'tail -f' some logs.
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#65The exact reverse engineered algorithm of the GFW is on page 4. It looks very reasonable (given what they are trying to achieve with it).
The easiest bypass I can think of would be to tunnel your connections via TLS. For example socks server tunneled via SSH which in turn is tuneled via TLS to your gateway.
Or perhaps you can somehow get your SSH client to transmit "GET " at the beginning of the connection, have the server ignore those 4 bytes, then proceed as usual.
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#66I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…
I wonder if the whole tor obsf4 and snowflake business works with the GFW.
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#67Earlier quoted context omitted.
I tried to setup a shadowsocks server to bypass the GFW about 2 weeks ago. Server was hosted on my local network in Australia (with public IP), client was connecting from China (using the server IP). It was blocked immediately and the client could not connect. I had several unknown IPs try to connect prior to the attempted connection. I was stunned at how water tight the GFW is, it's really unfortunate as I would lov…
Last time I went to China (2018) you could simply get a China Unicom Hong Kong SIM card and then use that to roam in mainland China. With that you'd get the Hong Kong censorship level, which is much much less restrictive. No VPN or anything needed apart from the SIM card itself.
"you'd get the Hong Kong censorship level, which is much much less restrictive."
Didn’t that changed since 2018?
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#68I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…
When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered. My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway. Most people are not persecuted for using a VPN, I assume that’s reserved for people who t…
That's roaming, not a VPN.
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#69I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…
Why don’t they just detect and block all VPNs? In Dubai, that’s what seemed to be happening
Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]
#70I’ve done so much experimentation with GFW pre pandemic while staying in China for extended period of times. I was always amazed at how quickly they would catch up on my shadowsocks, random ssh tunnels…etc. 48 hours top before I had to rotate IPs. This report seems to indicate this is now instant? Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when r…
GFW only looks at connections with destination IPs outside of China, the private fibre line bypasses it entirely.
> the private fibre line bypasses it entirely
Well, I'm sure the Chinese are tapping it. ;-)
Its more that they are just not actively acting on the content.