, a computer security researcher at the University of Cambridge, has been poking around at the technical structure of China's "great firewall." On the lightbluetouchpaper
collective blog, he says
he's come up with a way to penetrate that "wall" by ignoring the reset TCP packet returned by Chinese routers to maintain connection. As he explains it, if those packets are discarded instead of being dutifully returned as expected, then -- poof, the firewall becomes utterly ineffective. Clayton acknowledges that Internet filtering in China involves other methods, too, but this still seems significant:
The Great Firewall of China is an important tool for the Chinese Government in their efforts to censor the Internet. It works, in part, by inspecting web traffic to determine whether or not particular words are present. If the Chinese Government does not approve of one of the words in a web page (or a web request), perhaps it says “f” “a” “l” “u” “n”, then the connection is closed and the web page will be unavailable — it has been censored.
This user-level effect has been known for some time… but up until now, no-one seems to have looked more closely into what is actually happening (or when they have, they have misunderstood the packet level events).
It turns out [caveat: in the specific cases we’ve closely examined, YMMV] that the keyword detection is not actually being done in large routers on the borders of the Chinese networks, but in nearby subsidiary machines. When these machines detect the keyword, they do not actually prevent the packet containing the keyword from passing through the main router (this would be horribly complicated to achieve and still allow the router to run at the necessary speed). Instead, these subsiduary machines generate a series of TCP reset packets, which are sent to each end of the connection. When the resets arrive, the end-points assume they are genuine requests from the other end to close the connection — and obey. Hence the censorship occurs.
However, because the original packets are passed through the firewall unscathed, if both of the endpoints were to completely ignore the firewall’s reset packets, then the connection will proceed unhindered! We’ve done some real experiments on this — and it works just fine!! Think of it as the Harry Potter approach to the Great Firewall — just shut your eyes and walk onto Platform 9¾.
. Clayton is presenting a paper on this topic (PDF link to paper
) at the 6th Workshop on Privacy Enhancing Technologies
being held in Cambridge this week. (Thanks, Mike Liebhold
for what it is worth, when I was in China last year there was a lot of pages I couldn't get until I ran them through the LoBand (loband.org) proxy and then at least the blogs that were blocked all worked great.
The Cobham catalog, exposed by The Intercept, features countless pages of surveillance gadgets sold to U.S. police to spy on American citizens: tiny black boxes with a big interest in you. In the creepily bland feature lists and nerdy product names is a whisper of a dark future; perhaps darker than anyone can imagine.
This image depicts the most commonly-found stylesheet colors on the web’s top sites—Paul Hebert did an amazing amount of analysis and this is just one of the intriguing visualizations he came up with. Most of these are obvious staples, especially HTML red and blue, though it’s interesting how far the blue “cluster” is from the […]
With the cacophony of an election year ablaze with unparalleled drama being fought on the front lines of Twitter, we find ourselves slowing down and staring at it like a bad accident. The need for escapist relief is perhaps more dire than usual right now. This fall, if it’s drama you crave, but the Hillary […]
If you own a dog, you’ve most likely heard of BarkBox – the monthly subscription box for dogs. What started as a simple idea to try out the subscription model on pet owners has since developed a cult following of dog lovers. If you haven’t given it a try yet, this one month free deal is the […]
With the iPhone headphone jack having gone by the wayside, we’re excited about the addition of the FRANKLIN Bluetooth Headphones in our store. These headphones are foldable so they’re easy to carry around, but most importantly, they pack impressive sound. Our biggest struggle with Bluetooth headphones is the worry of them dying at the worst moment. This pair lasts an impressive 8-10 […]
Evan Kimbrell, founder of the digital agency Sprintkick, recently released a series of online courses that feature some of the best advice we’ve come across. These courses are well worth your time, and will save you from making many typical mistakes down the line if you ever want to start your own business.With this Business […]