9 ms·

My Experience With the Great Firewall of China

156 points by mrb 11y ago

theunixbeard 11y ago
Great write-up, I had no idea that China was using machine learning to detect VPN setups... I'd suggest the author make their Idea #4 random-padding code open source, but ironically if it became popular then surely the ML-based filters would eventually cripple it...
- ashmud 11y ago
  Some VPN configurations appear trivially easy to detect: https://news.ycombinator.com/item?id=9949559 https://news.ycombinator.com/item?id=9949559
  - est 11y ago
    Shadowsocks/proxy are easy to detect, just try connect to famous default ports like tcp 1080.
TeMPOraL 11y ago
A very interested and detailed writeup! I'm forwarding it to friends who just flew to China. One thing I was surprised to learn is the GPS shift problem - particularly that China has managed to figure out how to encrypt map coordinates[0], so that they still look right with a proper map. It looks like something trivial to solve, so I guess the only reason a solution isn't widely deployed is because it would be illegal to use in China. Another thing, slightly off-topic: > I learned through this experience that the GFW is unmistakably able to exploit side-channel leaks in TLS, such as packet sizes in order to detect the "TLS within TLS" characteristic of secure web proxies. This really surprised me. I had no idea the GFW had reached this level of sophistication. Come on. This is not sophistication. This is something a 10-year-old child could figure out if you gave him a set of connection logs and told to split it into two subsets. Looking at side channels is the obvious thing to do if you can't determine something from just reading it. I'll grant that implementing machine learning for this task may be sophisticated, but just noticing an obvious side-channel (and writing a simple check for it)? And this is not the first time I've seen people calling side-channels or looking at metadata "sophisticated". Is it because 99% of programming consists of writing absolutely trivial spec-following code that doing anything that's not in the standards is "sophisticated" nowadays? [0] - https://en.wikipedia.org/wiki/Restrictions_on_geographic_data_in_China#GCJ-02 https://en.wikipedia.org/wiki/Restrictions_on_geographic_dat...
- moonbug 11y ago
  It's plainly not encryption. The Chinese maps use a different reference datum (ellipsoid surface representing the shape of the Earth), and translation between coordinates in the two reference schemes (GCJ-02 in China and WGS-84 for GPS) is straightforward. Why Google and other mapping services don't apply this transform has more to do with business decisions and the hoops they have to jump through to be able to work in China at all.
  - TeMPOraL 11y ago
    You're right, it's not encryption. I trusted the linked Wikipedia article, which repeatedly calls it "encryption", and didn't double-check it. Here are some converter implementations in several languages: https://github.com/googollee/eviltransform https://github.com/googollee/eviltransform
- deleted 11y ago
  [deleted]
- outworlder 11y ago
  Or maybe because doing that on your home is trivial, but implementing it at country scale is not?
sdm 11y ago
Two notes: 1. Never use Google Maps in China; Google Maps in China are just hilariously wrong and out of date and will get you lost. Even if Google Maps wasn't blocked you wouldn't want use it in China. Apple Maps is the best English language solution, it's accurate and up to date; that or Baidu Maps if you read Chinese. 2. The OP is missing the point of the GFW. It's not really about censorship. It's mainly about providing a market for local tech startups and about keeping the lower classes from organizing and causing trouble. The party doesn't care is middle or upper class people access the outside internet. They know network effects will keep them using local tech and middle or upper class people are too bought into the system to rock the boat -- after all these people travel outside of China and have a decent knowledge of the world outside. Just assume anything you put through a VPN that advertises as going through the GFW is being monitored. Just like in the elsewhere you'd just assume anything you'd send through Google is being monitored. On sensitive days suddenly all these VPNs are blocked too so the GFW definitely does have the power to block them at will. Finally I find it a bit odd that someone so concerned with privacy uses so many Google Apps. Isn't that rather counter productive? Also, only web based gmail is blocked. Access from Mail.app or iPhone's Mail is not blocked. Sadly translate has been blocked for about a year now... all the more reason to never turn the VPN on your computer or phone off.
- tartuffe78 11y ago
  "It's not really about censorship... and about keeping the lower classes from organizing and causing trouble." That sounds like censorship to me.
  - 67726e 11y ago
    Well, yes, the GFW provides censorship but that's a part of the government's greater goal of pacification of the population. The post's point is pretty clear as it elaborates that the upper classes in society are not likely to care since they have a better life, and know how things really are.
- Zikes 11y ago
  > Finally I find it a bit odd that someone so concerned with privacy uses so many Google Apps. Isn't that rather counter productive? There's a fairly big difference between having a company consolidate your personal information and a country willing to throw you in a hole for thinking certain thoughts.
ClarenceC 11y ago
Also when traveling to China, remember to whip your machine before and after the trip, and do not leave them unattended in the hotel.
- zippy 11y ago
  https://www.youtube.com/watch?v=gOO1Z4u2Aq4 https://www.youtube.com/watch?v=gOO1Z4u2Aq4
- LorenPechtel 11y ago
  And why should I assume my machine is into BDSM? :)
guardiangod 11y ago
>To the GFW, these 8 ApplicationData records could look like 4 pairs of HTTP requests and responses in a keep-alive connection. However as research has shown [5] [6], side-channel leaks in TLS can be exploited, for example by looking at packet sizes. Doing so, we can see that they indeed match the expected sizes of the messages exchanged during a CONNECT request and a TLS handshake: As someone who crack (or at least block) VPN protocols for a living, I can indeed confirm this is 1 of the tricks used by all deep-inspection firewalls to detect VPNs. In fact, a very popular VPN software for Chinese citizens uses TLS-within-TLS (sometimes fake TLS) to hide its data. From the author's description, the traffics are similar enough IMO for the GFW to detects. (No, I don't work on GFW, but we block similar software. Sometimes we do comparison between various products to see how others block them.)
- epoxyhockey 11y ago
  I'm just curious.. Could you cite some legitimate reasons for why an entity would like to block VPN traffic?
  - mahouse 11y ago
    So they can know what you are doing? For example, if it's a business and they don't want their workers to spend all day on Facebook.
    - TeMPOraL 11y ago
      Which leads to absurd situation like a big Chinese company flying people from Europe to their Chinese offices to provide on-site support, and then having corporate firewalls more restrictive than the GFW itself, which renders said workers barely able to work at all...
      - justsayinghi 11y ago
        Any story you wanna share?
mike-cardwell 11y ago
http://www.jmarshall.com/tools/cgiproxy/ http://www.jmarshall.com/tools/cgiproxy/ Install that on your own server behind Basic Auth. Then it just looks like normal HTTPS traffic to any sniffer. Because that's exactly what it is.
- aexaey 11y ago
  There is an article[1] about finding out what location at google maps user is looking at, based on observing TLS packets and nothing else. If task at hand is to match encrypted connection to a smaller number of alternative (say identify accesses to popular place, like gmail/facebook login page, etc), same technique of observing packet size distribution over time should probably work quite reliably, and cgiproxy will do nothing to hide it. [1] http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps....
  - mike-cardwell 11y ago
    Interesting. CGIProxy could be easily modified to add random padding to the HTML or headers of responses. Probably a couple of lines of Perl.
    - JoshTriplett 11y ago
      You don't necessarily want random padding; you really want every single packet exactly the same size, potentially with dummy data transmitted to mask data rate as well.
    - gtank 11y ago
      There's a lot more to defeating traffic analysis than random padding: http://freehaven.net/anonbib/cache/oakland2012-peekaboo.pdf http://freehaven.net/anonbib/cache/oakland2012-peekaboo.pdf
outlace 11y ago
I went to China over the winter break. I'm a medical student and I used my school's VPN in China and it worked beautifully. Was able to access everything and the internet actually felt smoother/faster.
- Thriptic 11y ago
  They probably assume that VPNs to known .edu IP spaces can't be dropped without harming remote research
  - orf 11y ago
    I would say those VPNs are prime targets for interception.
    - stcredzero 11y ago
      So if those VPNs were compromised, the Chinese government would want those channels to be easy to use.
- outlace 11y ago
  Addendum: I also pay for roaming with my T-mobile plan, and I got Edge (E) network through (I think) China Mobile while I was in China, and interestingly enough, the internet through my mobile data plan was not censored at all in China.
marme 11y ago
FYI google maps in china is wrong because the chinese government wont let them fix it. You need special licenses and permission to display updated and corrected maps which the chinese government refuses to grant to google because google refuses to censor. If google updates the maps without permission the chinese government will just block their service entirely and issue fines to them. All maps are considered state secrets by the chinese government even simple road maps
- netheril96 11y ago
  The service is already blocked.
kweks 11y ago
I travel frequently to China; the best solution that I have found, that works out of the box on handset and laptop is shadowsocks, pointing to a secure [ie; your own] server. I recently used this in Iran with success as well.
- GhotiFish 11y ago
  won't that fall prey to some of the machine learning techniques China is using? The next day, the packet loss returned. But if I simply used a different port number for the proxy, everything would continue to work fine for another day or so. I think this time the GFW was not blocking me based on side-channel leaks, but based on network metrics. 100% of the network traffic to/from my server crossing the Chinese border was to my public IP in China, so the GFW probably learned my TCP endpoint was likely used as a private VPN, as opposed to being a public HTTPS site accessed by many client IPs.
  - est 11y ago
    Shadowsocks was designed to counter that.
  - kweks 11y ago
    As the sub-poster mentioned, shadow socks is designed to counter it. What is interesting is that the author (mainland Chinese) had a 'visit' from the 'police', who 'asked' him to abandon the project. He changed the default branch of his GH project to an empty branch, but the code still remains. Further, although his code is known, the GFW doesn't block its techniques.
b42 11y ago
If you liked the article you might enjoy this talk from last CCC: https://media.ccc.de/v/32c3-7196-how_the_great_firewall_discovers_hidden_circumvention_servers https://media.ccc.de/v/32c3-7196-how_the_great_firewall_disc...
- TheWoodsy 11y ago
  Cool stuff. Slides for the talk at https://events.ccc.de/congress/2015/Fahrplan/system/event_attachments/attachments/000/002/825/original/32c3-slides.pdf https://events.ccc.de/congress/2015/Fahrplan/system/event_at... Time to get my hack on. :]
jlund 11y ago
Helping people get around the Great Firewall was one of the main reasons I started working on Streisand[1]. OpenVPN (wrapped in stunnel), Shadowsocks, and Tor (with obfsproxy) are all still highly effective. The setup process is completely automated, and other connection options are available too. 1: https://github.com/jlund/streisand https://github.com/jlund/streisand
- hwdsl2 11y ago
  As an alternative, try my IPsec/L2TP VPN auto setup script [1] on GitHub. Part of the script was adapted [2] for use in Streisand. 1: https://github.com/hwdsl2/setup-ipsec-vpn https://github.com/hwdsl2/setup-ipsec-vpn 2: https://github.com/jlund/streisand/commit/fea4a9545bfa066db34c072a588e0ed275cfbf88 https://github.com/jlund/streisand/commit/fea4a9545bfa066db3...
jdlyga 11y ago
When I was in China, I used ExpressVPN. But even with a fast VPN like that, it's still so much slower in mainland China than in Hong Kong or elsewhere. It really isn't a problem if you're Chinese and mainly use WeChat, QQ, etc. But us westerners who use Facebook, Google, and Instagram are SOL.
- jdlyga 11y ago
  In other words, websites that are outside of mainland China seem to be significantly slower than websites in mainland China.
  - xiaoma 11y ago
    No. They tend to be blocked completely.
netheril96 11y ago
The best tools to evade GFW are `shadowsocks` and `openconnect` at this point. The first one is a proxy, but unlike TLS proxy, it does not have a handshake phase. Rather, it encrypts all data with a preshared key, and the server rejects the connection if decryption yields invalid data. The stateless nature makes it much harder to detect. The second one is a VPN over DTLS or TLS. Its security is even better than OpenVPN, as it supports ECDHE and AES-GCM from very early. No stunnel or obfuscation is needed at this point.

156 points by mrb 11y ago

Great write-up, I had no idea that China was using machine learning to detect VPN setups... I'd suggest the author make their Idea #4 random-padding code open source, but ironically if it became popular then surely the ML-based filters would eventually cripple it...

ashmud 11y ago
Some VPN configurations appear trivially easy to detect: https://news.ycombinator.com/item?id=9949559 https://news.ycombinator.com/item?id=9949559
- est 11y ago
  Shadowsocks/proxy are easy to detect, just try connect to famous default ports like tcp 1080.

TeMPOraL 11y ago

A very interested and detailed writeup! I'm forwarding it to friends who just flew to China. One thing I was surprised to learn is the GPS shift problem - particularly that China has managed to figure out how to encrypt map coordinates[0], so that they still look right with a proper map. It looks like something trivial to solve, so I guess the only reason a solution isn't widely deployed is because it would be illegal to use in China. Another thing, slightly off-topic: > I learned through this experience that the GFW is unmistakably able to exploit side-channel leaks in TLS, such as packet sizes in order to detect the "TLS within TLS" characteristic of secure web proxies. This really surprised me. I had no idea the GFW had reached this level of sophistication. Come on. This is not sophistication. This is something a 10-year-old child could figure out if you gave him a set of connection logs and told to split it into two subsets. Looking at side channels is the obvious thing to do if you can't determine something from just reading it. I'll grant that implementing machine learning for this task may be sophisticated, but just noticing an obvious side-channel (and writing a simple check for it)? And this is not the first time I've seen people calling side-channels or looking at metadata "sophisticated". Is it because 99% of programming consists of writing absolutely trivial spec-following code that doing anything that's not in the standards is "sophisticated" nowadays? [0] - https://en.wikipedia.org/wiki/Restrictions_on_geographic_data_in_China#GCJ-02 https://en.wikipedia.org/wiki/Restrictions_on_geographic_dat...

moonbug 11y ago
It's plainly not encryption. The Chinese maps use a different reference datum (ellipsoid surface representing the shape of the Earth), and translation between coordinates in the two reference schemes (GCJ-02 in China and WGS-84 for GPS) is straightforward. Why Google and other mapping services don't apply this transform has more to do with business decisions and the hoops they have to jump through to be able to work in China at all.
- TeMPOraL 11y ago
  You're right, it's not encryption. I trusted the linked Wikipedia article, which repeatedly calls it "encryption", and didn't double-check it. Here are some converter implementations in several languages: https://github.com/googollee/eviltransform https://github.com/googollee/eviltransform
deleted 11y ago
[deleted]
outworlder 11y ago
Or maybe because doing that on your home is trivial, but implementing it at country scale is not?

sdm 11y ago

Two notes: 1. Never use Google Maps in China; Google Maps in China are just hilariously wrong and out of date and will get you lost. Even if Google Maps wasn't blocked you wouldn't want use it in China. Apple Maps is the best English language solution, it's accurate and up to date; that or Baidu Maps if you read Chinese. 2. The OP is missing the point of the GFW. It's not really about censorship. It's mainly about providing a market for local tech startups and about keeping the lower classes from organizing and causing trouble. The party doesn't care is middle or upper class people access the outside internet. They know network effects will keep them using local tech and middle or upper class people are too bought into the system to rock the boat -- after all these people travel outside of China and have a decent knowledge of the world outside. Just assume anything you put through a VPN that advertises as going through the GFW is being monitored. Just like in the elsewhere you'd just assume anything you'd send through Google is being monitored. On sensitive days suddenly all these VPNs are blocked too so the GFW definitely does have the power to block them at will. Finally I find it a bit odd that someone so concerned with privacy uses so many Google Apps. Isn't that rather counter productive? Also, only web based gmail is blocked. Access from Mail.app or iPhone's Mail is not blocked. Sadly translate has been blocked for about a year now... all the more reason to never turn the VPN on your computer or phone off.

tartuffe78 11y ago
"It's not really about censorship... and about keeping the lower classes from organizing and causing trouble." That sounds like censorship to me.
- 67726e 11y ago
  Well, yes, the GFW provides censorship but that's a part of the government's greater goal of pacification of the population. The post's point is pretty clear as it elaborates that the upper classes in society are not likely to care since they have a better life, and know how things really are.
Zikes 11y ago
> Finally I find it a bit odd that someone so concerned with privacy uses so many Google Apps. Isn't that rather counter productive? There's a fairly big difference between having a company consolidate your personal information and a country willing to throw you in a hole for thinking certain thoughts.

ClarenceC 11y ago

Also when traveling to China, remember to whip your machine before and after the trip, and do not leave them unattended in the hotel.

zippy 11y ago
https://www.youtube.com/watch?v=gOO1Z4u2Aq4 https://www.youtube.com/watch?v=gOO1Z4u2Aq4
LorenPechtel 11y ago
And why should I assume my machine is into BDSM? :)

guardiangod 11y ago

>To the GFW, these 8 ApplicationData records could look like 4 pairs of HTTP requests and responses in a keep-alive connection. However as research has shown [5] [6], side-channel leaks in TLS can be exploited, for example by looking at packet sizes. Doing so, we can see that they indeed match the expected sizes of the messages exchanged during a CONNECT request and a TLS handshake: As someone who crack (or at least block) VPN protocols for a living, I can indeed confirm this is 1 of the tricks used by all deep-inspection firewalls to detect VPNs. In fact, a very popular VPN software for Chinese citizens uses TLS-within-TLS (sometimes fake TLS) to hide its data. From the author's description, the traffics are similar enough IMO for the GFW to detects. (No, I don't work on GFW, but we block similar software. Sometimes we do comparison between various products to see how others block them.)

epoxyhockey 11y ago
I'm just curious.. Could you cite some legitimate reasons for why an entity would like to block VPN traffic?
- mahouse 11y ago
  So they can know what you are doing? For example, if it's a business and they don't want their workers to spend all day on Facebook.
  - TeMPOraL 11y ago
    Which leads to absurd situation like a big Chinese company flying people from Europe to their Chinese offices to provide on-site support, and then having corporate firewalls more restrictive than the GFW itself, which renders said workers barely able to work at all...
    - justsayinghi 11y ago
      Any story you wanna share?

mike-cardwell 11y ago

http://www.jmarshall.com/tools/cgiproxy/ http://www.jmarshall.com/tools/cgiproxy/ Install that on your own server behind Basic Auth. Then it just looks like normal HTTPS traffic to any sniffer. Because that's exactly what it is.

aexaey 11y ago
There is an article[1] about finding out what location at google maps user is looking at, based on observing TLS packets and nothing else. If task at hand is to match encrypted connection to a smaller number of alternative (say identify accesses to popular place, like gmail/facebook login page, etc), same technique of observing packet size distribution over time should probably work quite reliably, and cgiproxy will do nothing to hide it. [1] http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps....
- mike-cardwell 11y ago
  Interesting. CGIProxy could be easily modified to add random padding to the HTML or headers of responses. Probably a couple of lines of Perl.
  - JoshTriplett 11y ago
    You don't necessarily want random padding; you really want every single packet exactly the same size, potentially with dummy data transmitted to mask data rate as well.
  - gtank 11y ago
    There's a lot more to defeating traffic analysis than random padding: http://freehaven.net/anonbib/cache/oakland2012-peekaboo.pdf http://freehaven.net/anonbib/cache/oakland2012-peekaboo.pdf

outlace 11y ago

I went to China over the winter break. I'm a medical student and I used my school's VPN in China and it worked beautifully. Was able to access everything and the internet actually felt smoother/faster.

Thriptic 11y ago
They probably assume that VPNs to known .edu IP spaces can't be dropped without harming remote research
- orf 11y ago
  I would say those VPNs are prime targets for interception.
  - stcredzero 11y ago
    So if those VPNs were compromised, the Chinese government would want those channels to be easy to use.
outlace 11y ago
Addendum: I also pay for roaming with my T-mobile plan, and I got Edge (E) network through (I think) China Mobile while I was in China, and interestingly enough, the internet through my mobile data plan was not censored at all in China.

marme 11y ago

FYI google maps in china is wrong because the chinese government wont let them fix it. You need special licenses and permission to display updated and corrected maps which the chinese government refuses to grant to google because google refuses to censor. If google updates the maps without permission the chinese government will just block their service entirely and issue fines to them. All maps are considered state secrets by the chinese government even simple road maps

netheril96 11y ago
The service is already blocked.

kweks 11y ago

I travel frequently to China; the best solution that I have found, that works out of the box on handset and laptop is shadowsocks, pointing to a secure [ie; your own] server. I recently used this in Iran with success as well.

GhotiFish 11y ago
won't that fall prey to some of the machine learning techniques China is using? The next day, the packet loss returned. But if I simply used a different port number for the proxy, everything would continue to work fine for another day or so. I think this time the GFW was not blocking me based on side-channel leaks, but based on network metrics. 100% of the network traffic to/from my server crossing the Chinese border was to my public IP in China, so the GFW probably learned my TCP endpoint was likely used as a private VPN, as opposed to being a public HTTPS site accessed by many client IPs.
- est 11y ago
  Shadowsocks was designed to counter that.
- kweks 11y ago
  As the sub-poster mentioned, shadow socks is designed to counter it. What is interesting is that the author (mainland Chinese) had a 'visit' from the 'police', who 'asked' him to abandon the project. He changed the default branch of his GH project to an empty branch, but the code still remains. Further, although his code is known, the GFW doesn't block its techniques.

b42 11y ago

If you liked the article you might enjoy this talk from last CCC: https://media.ccc.de/v/32c3-7196-how_the_great_firewall_discovers_hidden_circumvention_servers https://media.ccc.de/v/32c3-7196-how_the_great_firewall_disc...

TheWoodsy 11y ago
Cool stuff. Slides for the talk at https://events.ccc.de/congress/2015/Fahrplan/system/event_attachments/attachments/000/002/825/original/32c3-slides.pdf https://events.ccc.de/congress/2015/Fahrplan/system/event_at... Time to get my hack on. :]

jlund 11y ago

Helping people get around the Great Firewall was one of the main reasons I started working on Streisand[1]. OpenVPN (wrapped in stunnel), Shadowsocks, and Tor (with obfsproxy) are all still highly effective. The setup process is completely automated, and other connection options are available too. 1: https://github.com/jlund/streisand https://github.com/jlund/streisand

hwdsl2 11y ago
As an alternative, try my IPsec/L2TP VPN auto setup script [1] on GitHub. Part of the script was adapted [2] for use in Streisand. 1: https://github.com/hwdsl2/setup-ipsec-vpn https://github.com/hwdsl2/setup-ipsec-vpn 2: https://github.com/jlund/streisand/commit/fea4a9545bfa066db34c072a588e0ed275cfbf88 https://github.com/jlund/streisand/commit/fea4a9545bfa066db3...

jdlyga 11y ago

When I was in China, I used ExpressVPN. But even with a fast VPN like that, it's still so much slower in mainland China than in Hong Kong or elsewhere. It really isn't a problem if you're Chinese and mainly use WeChat, QQ, etc. But us westerners who use Facebook, Google, and Instagram are SOL.

jdlyga 11y ago
In other words, websites that are outside of mainland China seem to be significantly slower than websites in mainland China.
- xiaoma 11y ago
  No. They tend to be blocked completely.

netheril96 11y ago

The best tools to evade GFW are `shadowsocks` and `openconnect` at this point. The first one is a proxy, but unlike TLS proxy, it does not have a handshake phase. Rather, it encrypts all data with a preshared key, and the server rejects the connection if decryption yields invalid data. The stateless nature makes it much harder to detect. The second one is a VPN over DTLS or TLS. Its security is even better than OpenVPN, as it supports ECDHE and AES-GCM from very early. No stunnel or obfuscation is needed at this point.