Slashdot Mirror


Defeating China's National Firewall

Bruce Schneier is reporting on his blog that a recent paper is discussing how to defeat China's national firewall. From the article: "However, because the original packets are passed through the firewall unscathed, if both of the endpoints were to completely ignore the firewall's reset packets, then the connection will proceed unhindered! We've done some real experiments on this -- and it works just fine!! Think of it as the Harry Potter approach to the Great Firewall -- just shut your eyes and walk onto Platform 9¾."

17 of 370 comments (clear)

  1. Publish and Perish by Archangel+Michael · · Score: 5, Interesting

    Okay, now that you let the cat out of the bag, how long before the Great Chinese Firewall gets this hole plugged?

    On the otherhand, the more they try to squeeze star systems, the more they will slip out of thier han (or something like that).

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    1. Re:Publish and Perish by Ungrounded+Lightning · · Score: 2, Interesting

      Okay, now that you let the cat out of the bag, how long before the Great Chinese Firewall gets this hole plugged?

      Depends on whether they can reconfigure the existing equpment to do it or if they have tobuy a bunch more stuff.

      If they've implemented it as a packet sniffer that drops in a forged reset, rather than something inline, they're probably going to need a redesign and to buy a BUNCH of smarter boxes - at least for either the boundary between them and the rest of the net, or the edge between their internal net and their subscribers.

      Replacing the boxes will take months - more of them if they want to do it without disrupting traffic - even if they have a better solution already qualified and ready to go once they cut the orders. Since the dotcom bust boxes like that are mainly built to backorder rather than stockpiled at the manufacturer.

      Figure if they order them now they might get them by the end of Q3 or mid Q4 and be deploying them in Q1 '07

      --
      Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
  2. Duh ... just use Gopherspace by Average_Joe_Sixpack · · Score: 4, Interesting

    No one is monitoring that protocol

  3. Detectable and Illegal by mrcaseyj · · Score: 4, Interesting

    Wouldn't this be easily detectable and probably illegal (for someone in china)? It sounds like a good way to get in trouble.

  4. This should take a while to plug by the_crowbar · · Score: 4, Interesting
    Because the filtering is not done on the routers, but rather on external machines this should take some time to plug. Off the top of my head I can't imagine how the Chinese government would change their filtering to defeat this trick. On a Linux box you could just set an iptables rule:
    bash-3.0# iptables -s 0/0 -d 0/0 -p tcp --tcp-flags RST -j DROP
    should take care of the reset packets at the local end. The remote end would need to drop them as well, but that would be easy to setup. Maybe we could setup some proxies for those in mainland China that would drop the resets so they could surf anywhere. Might be hard to restrict to those coming from mainland China.

    Just a thought.

    the_crowbar
    --
    Have you read the Moderator Guidelines
  5. Re:National Firewall by x2A · · Score: 2, Interesting

    What, and turn the filtering firewall into a /dev/null where no packets can get in *or* out... yeah, that'll show 'em!

    --
    The revolution will not be televised... but it will have a page on Wikipedia
  6. Re:Irresponsible by jandrese · · Score: 4, Interesting

    Back in the real world however, you can't overthrow the government whenever you don't agree with it, especially when they have lots of guns and tanks and all you have are disgruntled peasents. Sometimes civil disobediance is the best policy. Besides, you can't generate outrage against something like this until most of the people actually know about it, and even then many of them will believe the government line that they're only blocking "harmful materials" that you shouldn't be looking at anyway. Enough people start getting in trouble over bypassing the firewall and you might actually start educating the public about this.

    --

    I read the internet for the articles.
  7. Great walls not so great in China by balls199 · · Score: 3, Interesting

    This sort of reminds me of the way the Mongols defeated the Great Wall of China.

    Did they tear the wall down? No.

    Did they march around one end of the wall? No.

    They simply bribed a guard to open the gates.

    Maybe China shouldn't be so fixated on walls.

  8. Re:Drug Parallel by Millenniumman · · Score: 5, Interesting

    Most libertarians believe that (currently) illegal drugs should only be legal for adults. Minors don't have the full responsibility of adults to take care of themselves. There are also a lot of more moderate ones who believe that taxing them is okay, especially if it can help lower other taxes. Their main reason for supporting legalization of drugs is that it would lower black market crime, and end up saving lives, although ideology is obviously an important reason.

    --
    Stupidity is like nuclear power, it can be used for good or evil. And you don't want to get any on you.
  9. Re:Unless the web server also ignores reset packet by ChrisA90278 · · Score: 2, Interesting

    Yes you are right. BOTH ends need to drop the resets. But all they need are for a few web proxies on the outside to dop packets. I could set one up in my house in 20 minutes. I imagine a few thousand people could set up proxy servers. This is so simple to do. You do not even need to write software in can be done with a firewall rule

  10. Been there...the firewall isn't a big deal by Anonymous Coward · · Score: 1, Interesting

    The problem is not the firewall. Having traveled in and around China with my laptop I never had difficulty getting around the firewall. However what is much more insidious is the active monitoring of your hotel room's internet connection. And they even let you know your being monitored because a little icon pops up in the lower right hand corner of the screen.

    Personally I used vpn software to get around a bunch of these issues. However I could have been arrested and charged with crimes against the state for even possessing the software. Let alone using it.

    The Great Chinese Firewall is a sham...if the government wants to get you they'll just watch what you type. ALL hotel connections are monitored, maybe not continuously but they are monitored.

    -anon because I still need to travel in China on occasion.

  11. Re:the chinese government is illegitimate by 808140 · · Score: 4, Interesting

    Illegitimate? Whatever, dude. The Chinese are, with the exception of Americans, the most patriotic people I've ever come into contact with -- nationalist fervor is so ingrained here it's absolutely frightening. They're not interested in revolt and on the whole are happy with the status quo. They love their country and go on and on about it. Really. If there were a vote tomorrow there is no doubt in my mind that the CCP would win.

    During the Chinese civil war, the Communist party was overwhelmingly supported by the people.

    Your assertion that non-democratic societies are illegitimate suggests that most societies in history have been illegitimate. I'm not sure that's a particularly useful definition of legitimacy.

  12. Re:They're not Mongolians... by 808140 · · Score: 2, Interesting

    Goddamn it, the Chinese do not confuse r and l, the Japanese (and to a lesser extent the Koreans) do. Mandarin is in fact one of the few widely spoken languages out there that actually has a retroflex r (the r in English, which is exceptionally hard for most people to pronounce, even Europeans.)

    I think Engrish is funny, but it's the Japanese that speak it, not the Chinese. Of course, to most white westerners there's no difference whatsoever between the two cultures.

    Maybe you think being racist and ignorant is funny, but I don't.

  13. Re:Drug Parallel by Mr2001 · · Score: 2, Interesting

    Indeed.. teenagers are some of the ideal consumers of drugs, actually. They don't have much money, but what they do have is all disposable income. They don't have any real responsibilities, so unlike a parent or a lifeguard, nothing bad will happen if they're unable to respond to some situation because they're high. Their bodies are healthy, so the side effects of drug use likely won't have the same impact as they would on an adult.

    --
    Visual IRC: Fast. Powerful. Free.
  14. Re:They're not Mongolians... by Anonymous Coward · · Score: 1, Interesting

    English, generally speaking, does not have any retroflex sounds - the sound you're referring to, the 'r' in English, is an alveolar approximant. The only major difference between English 'r' and English light 'l' is whether the tip of the tongue touches the alveolar ridge or not. If you're going to use unnecessary jargon, use it properly. However, if you had bothered to digest the post properly rather than jumping to conclusions, you might've realised that the character being referred to, Tuong Lu Kim of South Park, is really something of an amalgamation of a number of different south-east Asian stereotypes. Maybe you think satire of stupid stereotypes isn't funny, but I do.

  15. The Firewall's Not the Problem by dbkluck · · Score: 2, Interesting

    I've been living in China for the past year, and have asked lots of people about this. The only people who care about the firewall are foreigners, because the firewall blocks foreign sites. The vast majority of Chinese don't care that they can't read bbc.co.uk. What they DO care about is the staggering number of domestic blogs and news sites that get shut down each month for being labled "obscene" or "seditious," and no amount of internet wizardry is going to let you access a site whose server has been confiscated and webmaster imprisoned. I suppose Google could step up to the plate and start caching all of these doubleplus ungood blogs before they get taken down, and then perhaps bypassing the firewall would be useful, but I'm not going to hold my breath waiting for that to happen.

  16. Re:Drug Parallel by Anonymous Coward · · Score: 1, Interesting

    You're right that ritalin is slightly different, in that it is a methylphenidate. However, Adderall is a mix of amphetemine and dextroamphetemine. Quite literally, speed.

    Just because it is legal with a prescription doesn't mean it is necessarily safer than any illegal drug. I wonder how many parents would so quick to put their kids on ADD meds if they realized this simple fact.