35 ms·

Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.

by vanous 9y ago

Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal...

lngnmn 9y ago
DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
- kbaker 9y ago
  The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with. There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back. And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
- cameldrv 9y ago
  The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do. Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
  - lngnmn 9y ago
    There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services. AWS traffic also never will be blocked. Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.
  - tankenmate 9y ago
    http://ipop-project.org/ http://ipop-project.org/

by vanous 9y ago

lngnmn 9y ago

DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.

kbaker 9y ago
The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with. There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back. And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
cameldrv 9y ago
The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do. Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
- lngnmn 9y ago
  There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services. AWS traffic also never will be blocked. Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.
- tankenmate 9y ago
  http://ipop-project.org/ http://ipop-project.org/