Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the great firewall of China detects and blocks fully encrypted traffic [pdf]

gfw.report

Post reply on HN
Print view View original

71–80 of 289 posts

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#71

Post by EGreg »

H8crilA wrote: post #65

The exact reverse engineered algorithm of the GFW is on page 4. It looks very reasonable (given what they are trying to achieve with it). The easiest bypass I can think of would be to tunnel your connections via TLS. For example socks server tunneled via SSH which in turn is tuneled via TLS to your gateway. Or perhaps you can somehow get your SSH client to transmit "GET " at the beginning of the connection, have the…

This is what I have a question about.

Can China pressure every domestic company to use their certificate authority allowing them to decrypt all TLS traffic, or be blocked? And block all sites outside China?

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#73

Post by EGreg »

dizhn wrote: post #15
Renaud wrote: post #10

I remember having to deal with the early GFW about 20 years ago when I was working for a company that had some employees on a site in Shanghai. Every morning, our colleagues in China would open their mail client and it would connect to our server abroad. The first person would usually be OK, but for everyone else, the connection would fail. At the time, almost nothing was known of the GFW and it wasn't as clever as i…

We have a satellite office in Dubai. I know their static IP. When they connect to our imap/smtp server they are coming in from another IP. I never looked into it deeply but assumed their connection is being diverted for inspection. (If true, they would probably not be below performing industrial espionage with the data they are accessing)

Speaking of satellites, the ones in geosynchronous orbit, how can Chinese block those?

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#74

Post by H8crilA »

tgv wrote: post #27
JPLeRouzic wrote: post #7

The algorithm found seems so unintuitive that I wonder if it was not found by the AI. " Allow a connection to continue if the first TCP payload (pkt) sent by the client satisfies any of the following exemptions: Ex1: popcount(pkt) len(pkt) ≤ 3.4 or popcount(pkt) len(pkt) ≥ 4.6. Ex2: The first six (or more) bytes of pkt are [0x20,0x7e]. Ex3: More than 50% of pkt’s bytes are [0x20,0x7e]. Ex4: More than 20 contiguous by…

Looks more like it was found using random forests.

Lol you guys never worked with real data :D

There's at least 1'000 such algorithms at each google-like company.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#76

Post by H8crilA »

JPLeRouzic wrote: post #7

The algorithm found seems so unintuitive that I wonder if it was not found by the AI. " Allow a connection to continue if the first TCP payload (pkt) sent by the client satisfies any of the following exemptions: Ex1: popcount(pkt) len(pkt) ≤ 3.4 or popcount(pkt) len(pkt) ≥ 4.6. Ex2: The first six (or more) bytes of pkt are [0x20,0x7e]. Ex3: More than 50% of pkt’s bytes are [0x20,0x7e]. Ex4: More than 20 contiguous by…

It's extremely intuitive. You're trying to filter unusual, encrypted traffic.

First rule exploits the IND-CPA property of most encryption. You want to kill traffic that has about 4 bits set to 1 per byte, i.e. traffic that "looks random".

The following rules are exemptions for permissible encrypted or compressed traffic (note that compression, while not IND-CPA, results in high entropy and thus will trigger the first rule).

This could work very well, which is confirmed by the researchers in this paper.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#77

Post by H8crilA »

EGreg wrote: post #71
H8crilA wrote: post #65

The exact reverse engineered algorithm of the GFW is on page 4. It looks very reasonable (given what they are trying to achieve with it). The easiest bypass I can think of would be to tunnel your connections via TLS. For example socks server tunneled via SSH which in turn is tuneled via TLS to your gateway. Or perhaps you can somehow get your SSH client to transmit "GET " at the beginning of the connection, have the…

This is what I have a question about. Can China pressure every domestic company to use their certificate authority allowing them to decrypt all TLS traffic, or be blocked? And block all sites outside China?

1 - I believe they do it

2 - they obviously do not want to block all traffic, since they can do it any day, but they don't.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#78

Post by f4c39012 »

dizhn wrote: post #15
Renaud wrote: post #10

I remember having to deal with the early GFW about 20 years ago when I was working for a company that had some employees on a site in Shanghai. Every morning, our colleagues in China would open their mail client and it would connect to our server abroad. The first person would usually be OK, but for everyone else, the connection would fail. At the time, almost nothing was known of the GFW and it wasn't as clever as i…

We have a satellite office in Dubai. I know their static IP. When they connect to our imap/smtp server they are coming in from another IP. I never looked into it deeply but assumed their connection is being diverted for inspection. (If true, they would probably not be below performing industrial espionage with the data they are accessing)

I've debugged connection issues with someone in China. The same person, using the same browser and at the same time, showed up in the logs of two cloud apps with different IP addresses. The applications were adjacent in the cloud, same network config and everything. We figured there was always redirection, and we were never seeing their "true" IP address.

A simpler test is to search "what is my IP" and compare the values returned by different services.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#79

Post by supriyo-biswas »

EGreg wrote: post #71
H8crilA wrote: post #65

The exact reverse engineered algorithm of the GFW is on page 4. It looks very reasonable (given what they are trying to achieve with it). The easiest bypass I can think of would be to tunnel your connections via TLS. For example socks server tunneled via SSH which in turn is tuneled via TLS to your gateway. Or perhaps you can somehow get your SSH client to transmit "GET " at the beginning of the connection, have the…

This is what I have a question about. Can China pressure every domestic company to use their certificate authority allowing them to decrypt all TLS traffic, or be blocked? And block all sites outside China?

Kazakhstan had attempted a similar move[1], albeit through PSAs rather than convincing device manufacturers to add certificates to end-user devices.

[1] https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#80

Post by seanmcdirmid »

FaultBit wrote: post #24
WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

A lot of people actually use VPNs in China (since 2010 even), and some of them call it "加速器" which basically means "booster" (for your internet). Some use it for lower latencies when playing foreign games. The issue is that VPN connections get easily blocked. We aren't really worried about legal issues. Except for that one time when police (of a certain district, not everywhere in China) knocked on people's doors to…

Surely Xinjiang has stricter rules and more aggressive enforcement than the other provinces/regions? They always put a hardliner in as party head.
Post reply on HN