4 ms·

not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN a

not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?

vanous 9y ago
Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal...
- lngnmn 9y ago
  DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
  - kbaker 9y ago
    The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with. There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back. And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
  - cameldrv 9y ago
    The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do. Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
    - lngnmn 9y ago
      There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services. AWS traffic also never will be blocked. Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.
    - tankenmate 9y ago
      http://ipop-project.org/ http://ipop-project.org/
deleted 9y ago
[deleted]
wolfgang42 9y ago
You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).
- d-sc 9y ago
  China could simply require business that use ssh to register and/or ssh through one of their firewall servers.
- greglindahl 9y ago
  ssh sessions reveal enough that an interactive session, a file transfer (scp), and sshuttle routing someone web browsing look quite different from one another. Sure, you can multiplex and throw in extra traffic, but it's not trivial.
- baybal2 9y ago
  They do block SSH at random. Having it on port other than 22 helps some times.

vanous 9y ago

Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal...

lngnmn 9y ago
DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
- kbaker 9y ago
  The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with. There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back. And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
- cameldrv 9y ago
  The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do. Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
  - lngnmn 9y ago
    There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services. AWS traffic also never will be blocked. Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.
  - tankenmate 9y ago
    http://ipop-project.org/ http://ipop-project.org/

deleted 9y ago

[deleted]

wolfgang42 9y ago

You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).

d-sc 9y ago
China could simply require business that use ssh to register and/or ssh through one of their firewall servers.
greglindahl 9y ago
ssh sessions reveal enough that an interactive session, a file transfer (scp), and sshuttle routing someone web browsing look quite different from one another. Sure, you can multiplex and throw in extra traffic, but it's not trivial.
baybal2 9y ago
They do block SSH at random. Having it on port other than 22 helps some times.