7 ms·

China's Great Firewall Tests Mysterious Scans On Encrypted Connections

97 points by bdr 15y ago

chaosprophet 15y ago
Appears to be down. Google Cache: http://webcache.googleusercontent.com/search?q=cache%3Awww.forbes.com%2Fsites%2Fandygreenberg%2F2011%2F11%2F17%2Fchinas-great-firewall-tests-mysterious-scans-on-encrypted-connections%2F&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&pws=0 http://webcache.googleusercontent.com/search?q=cache%3Awww.f...
hendzen 15y ago
Link to the posting of the original discovery with technical details included: http://www.nsc.liu.se/~nixon/sshprobes.html http://www.nsc.liu.se/~nixon/sshprobes.html
- huetsch 15y ago
  How could such a technique actually give the firewall information pertinent to whether or not the offending site was illegal? It's like a MITM attack where they intercept the outgoing ssh connection, send seemingly arbitrary data to the ssh server on the non-Chinese internet, and then sometimes disrupt the ssh connection or allow it pass through. What information could the response to garbage possibly convey beyond: "how does this server respond to garbage"? How would that even help with fingerprinting, which is his suggestion? Would there even be much variation in how different sshds would respond to that? So what could you do with that information? 30% of known Tor servers use sshd version X, so let's ratchet up the frequency of RST packets for connections to servers of version X? Seems like a long shot: that would be both a sophisticated attack and have pretty hamfisted results. And how could this information be used to find open relays? Just guilt by sshd version again, since statistically machines with open relays have a tendency to run version X of sshd? I'd like to hear a security person come and talk instead of my wild speculations.
  - bshep 15y ago
    I'm guessing its not actually garbage, but something that an authorized VPN can respond to, so if you are not authorized, its garbage and you cannot give the correct response and are blocked.
    - huetsch 15y ago
      So then you're theorizing that this is a whitelist approach to VPN connections. Again, this would seem really heavy-handed, since it would block the vast majority of VPN traffic. It's certainly not the case for me currently (I'm in China), but it's possible that other cities are taking that approach.
      - kahawe 15y ago
        > since it would block the vast majority of VPN traffic Which would be a problem for the Chinese government HOW? I think those very blunt ways of identifying "unwelcome" connections and then just blocking them looks like exactly the solution a government makes that doesn't twitch an eye at re-locating thousands because they want to build a dam right there. So far encrypted traffic was a neat way of circumventing the control, now this could be trying to just plug those holes. Even if the handshake message does not say "OpenSSH xx...." at least the protocol response to random data would give them a clue and it is (sort of) more difficult to fix on a larger scale because they could always fine-tune the finger-printing. Instead of monitoring and analyzing all outgoing connections all the time, they just figure out where they are going and then block the destination once and for all - sounds logical and neat.
  - asharp 15y ago
    You can fairly easily spot most common protocols by seeing what they 1) Say to you without you prodding them or 2) Respond when you hit them with random data. My guess is that they're using it as a cheap way to tell the difference between most of the common protocols. (ie. ssh vs. openvpn vs. https, etc.)
    - huetsch 15y ago
monkeypizza 15y ago
china's ssh protection is getting really serious vpns have been horribly bad the last few weeks tunneling through ssh has also stopped working consistently. I don't know anybody over here who has a good vpn anymore. It's got to be hurting business that collaborate internationally - the net goes down for a few minutes at a time, throughout the day.
- deleted 15y ago
  [deleted]
  - briandear 15y ago
    It isn't blocked yet.. Give it a few hours.
  - yaix 15y ago
    This looks more like the usual "bright idea" of some third rank guy. Next year the people at the top will notice, because more and more foreign companies are pi##ed, and they will revert the whole thing again. I can't imagined that this will stay the same for long, especially now that the GDP growth is down to 9% and likely to go down further. Next year they will even loosen the restrinctions on real estate purchase again, to get the economy going.
- neolefty 15y ago
  Using a commercial (but certainly not approved) VPN on a home DSL: It works for a few minutes and then starts to degrade. I wonder if it's related to this new tactic. It's a little hard to distinguish from old behavior, unfortunately.
  - yinhm 15y ago
    Yes. I believe they start to degrade VPN/SSH, amazonaws.com, google couple of months ago. Things may vary depends on which city you are and which ISP you are using, eg: pptpd barely can connect on my DSL.
  - zrgiu_ 15y ago
NnamdiJr 15y ago
This is pretty depressing. It seems like the Chinese government, in creating new more powerful Internet censorship methods, is outpacing services to circumvent it. People like those of us reading this site probably won't have much trouble finding ways around it, but it seems people (esp. Chinese) who would normally hop the Great Firewall with ease using VPNs/proxy will have to put in more effort/get more technical to do that successfully, and i'm afraid that they won't want to bother.
- wladimir 15y ago
  The thing I fear most is that if anti-ssh/ssl/tor/vpn measures start to be somewhat effective, western governments will also see it as an excuse to implement them in the guise of "crime prevention", just now that services such as gmail are finally adopting it as default. Which means we'd be forced back to a 90's level of internet security at least for consumers, I'm sure corporations will be able to 'buy' the right to use encryption...
stupandaus 15y ago
I've been in China recently and noticed I was having trouble establishing VPN connections after just a few hours. I would have to find new VPN servers to connect to every 3 or 4 days. I have not noticed any drop off in connectivity when using my company's VPN, but I'm sure this is because this is an authorized VPN. The most notable blow here is that people using solutions like FreeGate are getting heavily affected by this. Most Shanghainese people use this to connect to the outside world.
chrislomax 15y ago
This is so pathetic, why do the Chinese government think they can tell users what they should and shouldn't be looking at. I agree that this type of measure should come into play if there was a guaranteed way of stopping people looking at child pornography or something like that but it almost always appear to be political. I have not been on the Tor network before and I do not plan to but it should be the persons choice of whether they access it or not. China are like the dick head IT manager who turns off javascript at network group policy level, just because he can.
- PakG1 15y ago
  You're expecting a relatively new Communist government, formed only about half a century ago and currently governs 1.3 billion people, to change its core philosophies overnight. It's not so easy. I don't support this stuff, but I recognize that it's not easy. I bet you it's harder than changing a country's dependence on oil as an energy source (assuming that viable alternatives are available). You have to change the world's largest population's philosophies, governing structure and infrastructure, expectations, etc.
  - vorg 15y ago
    India and Japan generally don't censor foreign websites, and their governments survive OK. It's a big loss of face for the present leaders to change their policy. But we keep on hearing the phrase from within China: "Perhaps the new generation of leaders taking over in October 2012 will have different ideas about web censorship". If the policy is going to change, it'll be soon after this time when no government leaders "lose face". The US and EU are also preparing to challenge China at the WTO claiming the Great Firewall violates free trade. If the US and EU can get their timing and level of prodding right, the Firewall might be dismantled. China's already given their web businesses such as Baidu enough startup advantage from the Firewall, and will probably find other ways to give advantage to subsequent startups. But... the infrastructure's already there in China to block foreign websites. Anything that exists but isn't used will be used again sooner or later by some politician, so thanks to Cisco et al the Firewall will always exist even if "dismantled" under WTO enforcement. Just like the US military is there to defend the integrity and borders of the Union, to be used as a last resort, but gets used to invade Iraq for cheap oil.
briandear 15y ago
This is why I am moving my company back to the States and why the Chinese startup scene is so depressingly obscure. The Chinese government can go to hell. I'll take my business and dollars somewhere else.
- danssig 15y ago
  Out of the frying pan...
  - briandear 15y ago
    At least it won't take me an hour to push to heroku and my aws access won't be throttled.
    - danssig 15y ago
      Today. The US is getting closer to the China model by the day. EDIT: Downvoters, do you disagree? With the continuous attempts at controlling the internet and destroying people that get dirt on US corruption? SOPA is just the latest attempt. It wasn't the first, and if we beat it it won't be the last.
yaix 15y ago
Oh well, that may be the reason I've problems connecting to my VPN and SSHing to my server. Not every time, though. Posting via https works, however.
- nonomatch 15y ago
  There may be a reason Chinese gov't does not view SSL as a threat. Collusion with CAs?
nomdeplume 15y ago
From http://www.nsc.liu.se/~nixon/sshprobes.html http://www.nsc.liu.se/~nixon/sshprobes.html "So, to more precisely describe what we have found: a small subset of the ssh logins from Chinese IPs to two of our systems are preceded by one or two connections from unrelated Chinese IP addresses, in which opaque binary data is thrown at sshd." "My hypothesis is that just over a year ago, a new function in the firewall went into limited beta test, where a sample of outgoing ssh connections from China is carefully selected for secondary screening.""For the selected ssh connections, the target system is probed from one or two IP addresses under the control of the Chinese government. These may be otherwise innocent addresses that are spoofed at the level of the great firewall, or they may be actual computers under remote control by the government - I have no way to tell.""In some cases, the legitimate ssh connections are unsuccessful; they appear to be interrupted. This may be a result of the firewall deciding the target system to be unsuitable and injecting RST packets into the TCP stream to kill it. The last few weeks, the frequency of the probing has increased. This might mean the beta test period is nearing its end, and that this function is about to become more widely deployed."

97 points by bdr 15y ago

Appears to be down. Google Cache: http://webcache.googleusercontent.com/search?q=cache%3Awww.forbes.com%2Fsites%2Fandygreenberg%2F2011%2F11%2F17%2Fchinas-great-firewall-tests-mysterious-scans-on-encrypted-connections%2F&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&pws=0 http://webcache.googleusercontent.com/search?q=cache%3Awww.f...

hendzen 15y ago

Link to the posting of the original discovery with technical details included: http://www.nsc.liu.se/~nixon/sshprobes.html http://www.nsc.liu.se/~nixon/sshprobes.html

huetsch 15y ago
How could such a technique actually give the firewall information pertinent to whether or not the offending site was illegal? It's like a MITM attack where they intercept the outgoing ssh connection, send seemingly arbitrary data to the ssh server on the non-Chinese internet, and then sometimes disrupt the ssh connection or allow it pass through. What information could the response to garbage possibly convey beyond: "how does this server respond to garbage"? How would that even help with fingerprinting, which is his suggestion? Would there even be much variation in how different sshds would respond to that? So what could you do with that information? 30% of known Tor servers use sshd version X, so let's ratchet up the frequency of RST packets for connections to servers of version X? Seems like a long shot: that would be both a sophisticated attack and have pretty hamfisted results. And how could this information be used to find open relays? Just guilt by sshd version again, since statistically machines with open relays have a tendency to run version X of sshd? I'd like to hear a security person come and talk instead of my wild speculations.
- bshep 15y ago
  I'm guessing its not actually garbage, but something that an authorized VPN can respond to, so if you are not authorized, its garbage and you cannot give the correct response and are blocked.
  - huetsch 15y ago
    So then you're theorizing that this is a whitelist approach to VPN connections. Again, this would seem really heavy-handed, since it would block the vast majority of VPN traffic. It's certainly not the case for me currently (I'm in China), but it's possible that other cities are taking that approach.
    - kahawe 15y ago
      > since it would block the vast majority of VPN traffic Which would be a problem for the Chinese government HOW? I think those very blunt ways of identifying "unwelcome" connections and then just blocking them looks like exactly the solution a government makes that doesn't twitch an eye at re-locating thousands because they want to build a dam right there. So far encrypted traffic was a neat way of circumventing the control, now this could be trying to just plug those holes. Even if the handshake message does not say "OpenSSH xx...." at least the protocol response to random data would give them a clue and it is (sort of) more difficult to fix on a larger scale because they could always fine-tune the finger-printing. Instead of monitoring and analyzing all outgoing connections all the time, they just figure out where they are going and then block the destination once and for all - sounds logical and neat.
- asharp 15y ago
  You can fairly easily spot most common protocols by seeing what they 1) Say to you without you prodding them or 2) Respond when you hit them with random data. My guess is that they're using it as a cheap way to tell the difference between most of the common protocols. (ie. ssh vs. openvpn vs. https, etc.)
  - huetsch 15y ago

monkeypizza 15y ago

china's ssh protection is getting really serious vpns have been horribly bad the last few weeks tunneling through ssh has also stopped working consistently. I don't know anybody over here who has a good vpn anymore. It's got to be hurting business that collaborate internationally - the net goes down for a few minutes at a time, throughout the day.

deleted 15y ago
[deleted]
- briandear 15y ago
  It isn't blocked yet.. Give it a few hours.
- yaix 15y ago
  This looks more like the usual "bright idea" of some third rank guy. Next year the people at the top will notice, because more and more foreign companies are pi##ed, and they will revert the whole thing again. I can't imagined that this will stay the same for long, especially now that the GDP growth is down to 9% and likely to go down further. Next year they will even loosen the restrinctions on real estate purchase again, to get the economy going.
neolefty 15y ago
Using a commercial (but certainly not approved) VPN on a home DSL: It works for a few minutes and then starts to degrade. I wonder if it's related to this new tactic. It's a little hard to distinguish from old behavior, unfortunately.
- yinhm 15y ago
  Yes. I believe they start to degrade VPN/SSH, amazonaws.com, google couple of months ago. Things may vary depends on which city you are and which ISP you are using, eg: pptpd barely can connect on my DSL.
- zrgiu_ 15y ago

NnamdiJr 15y ago

This is pretty depressing. It seems like the Chinese government, in creating new more powerful Internet censorship methods, is outpacing services to circumvent it. People like those of us reading this site probably won't have much trouble finding ways around it, but it seems people (esp. Chinese) who would normally hop the Great Firewall with ease using VPNs/proxy will have to put in more effort/get more technical to do that successfully, and i'm afraid that they won't want to bother.

wladimir 15y ago
The thing I fear most is that if anti-ssh/ssl/tor/vpn measures start to be somewhat effective, western governments will also see it as an excuse to implement them in the guise of "crime prevention", just now that services such as gmail are finally adopting it as default. Which means we'd be forced back to a 90's level of internet security at least for consumers, I'm sure corporations will be able to 'buy' the right to use encryption...

stupandaus 15y ago

I've been in China recently and noticed I was having trouble establishing VPN connections after just a few hours. I would have to find new VPN servers to connect to every 3 or 4 days. I have not noticed any drop off in connectivity when using my company's VPN, but I'm sure this is because this is an authorized VPN. The most notable blow here is that people using solutions like FreeGate are getting heavily affected by this. Most Shanghainese people use this to connect to the outside world.

chrislomax 15y ago

This is so pathetic, why do the Chinese government think they can tell users what they should and shouldn't be looking at. I agree that this type of measure should come into play if there was a guaranteed way of stopping people looking at child pornography or something like that but it almost always appear to be political. I have not been on the Tor network before and I do not plan to but it should be the persons choice of whether they access it or not. China are like the dick head IT manager who turns off javascript at network group policy level, just because he can.

PakG1 15y ago
You're expecting a relatively new Communist government, formed only about half a century ago and currently governs 1.3 billion people, to change its core philosophies overnight. It's not so easy. I don't support this stuff, but I recognize that it's not easy. I bet you it's harder than changing a country's dependence on oil as an energy source (assuming that viable alternatives are available). You have to change the world's largest population's philosophies, governing structure and infrastructure, expectations, etc.
- vorg 15y ago
  India and Japan generally don't censor foreign websites, and their governments survive OK. It's a big loss of face for the present leaders to change their policy. But we keep on hearing the phrase from within China: "Perhaps the new generation of leaders taking over in October 2012 will have different ideas about web censorship". If the policy is going to change, it'll be soon after this time when no government leaders "lose face". The US and EU are also preparing to challenge China at the WTO claiming the Great Firewall violates free trade. If the US and EU can get their timing and level of prodding right, the Firewall might be dismantled. China's already given their web businesses such as Baidu enough startup advantage from the Firewall, and will probably find other ways to give advantage to subsequent startups. But... the infrastructure's already there in China to block foreign websites. Anything that exists but isn't used will be used again sooner or later by some politician, so thanks to Cisco et al the Firewall will always exist even if "dismantled" under WTO enforcement. Just like the US military is there to defend the integrity and borders of the Union, to be used as a last resort, but gets used to invade Iraq for cheap oil.

briandear 15y ago

This is why I am moving my company back to the States and why the Chinese startup scene is so depressingly obscure. The Chinese government can go to hell. I'll take my business and dollars somewhere else.

danssig 15y ago
Out of the frying pan...
- briandear 15y ago
  At least it won't take me an hour to push to heroku and my aws access won't be throttled.
  - danssig 15y ago
    Today. The US is getting closer to the China model by the day. EDIT: Downvoters, do you disagree? With the continuous attempts at controlling the internet and destroying people that get dirt on US corruption? SOPA is just the latest attempt. It wasn't the first, and if we beat it it won't be the last.

yaix 15y ago

Oh well, that may be the reason I've problems connecting to my VPN and SSHing to my server. Not every time, though. Posting via https works, however.

nonomatch 15y ago
There may be a reason Chinese gov't does not view SSL as a threat. Collusion with CAs?

nomdeplume 15y ago

From http://www.nsc.liu.se/~nixon/sshprobes.html http://www.nsc.liu.se/~nixon/sshprobes.html "So, to more precisely describe what we have found: a small subset of the ssh logins from Chinese IPs to two of our systems are preceded by one or two connections from unrelated Chinese IP addresses, in which opaque binary data is thrown at sshd." "My hypothesis is that just over a year ago, a new function in the firewall went into limited beta test, where a sample of outgoing ssh connections from China is carefully selected for secondary screening.""For the selected ssh connections, the target system is probed from one or two IP addresses under the control of the Chinese government. These may be otherwise innocent addresses that are spoofed at the level of the great firewall, or they may be actual computers under remote control by the government - I have no way to tell.""In some cases, the legitimate ssh connections are unsuccessful; they appear to be interrupted. This may be a result of the firewall deciding the target system to be unsuitable and injecting RST packets into the TCP stream to kill it. The last few weeks, the frequency of the probing has increased. This might mean the beta test period is nearing its end, and that this function is about to become more widely deployed."