Slashdot Mirror
Cambridge Breached the Great Firewall of China
Darren Rayes writes to mention a ZDNet article on Cambridge academics' claims that they have breached the great firewall of China. They also claim that by misusing the firewall they can launch DDoS attacks against IP addresses behind the wall. From the article: "The IDS uses a stateless server, which examines each data packet both going in and out of the firewall individually, unrelated to any previous request. By forging the source address of a packet containing a 'sensitive' keyword, people could trigger the firewall to block access between source and destination addresses for up to an hour at a time."
With enough people working on it, we can temporarily block the entire country from the rest of the Internet. How's that for a fourth of July?
What about those inside China using those exploits for legitimate ends?
Is Cambridge indirectly helping the Chinese government to fix firewall issues?
Are Cambridge researchers after fame at the expense of the freedom of the Chinese people?
Better they do it from the outside then the Chinese government find the guys doing it from the inside.
Weird, I didn't know there were many mongolians at cambridge...
How exactly does a stateless IDS block connections for up to an hour? Are there other components to the firewall I'm not aware of, or does stateless mean something else these days?
An "active" spamfilter that automatically shoots down chinese spammers. The IP gets blocked off for an hour and can't spam anyone at all outside china.
Of course at the same time I can think of a million abusive applications for this...
I wonder what the chinese government would do if groups of individuals from around the world used techniques like this to DDoS the firewall. I highly doubt that they could get their population to accept them completely shutting off access to the outside world, and a stateful firewall would be considerably more expensive, assuming they wanted to keep their same (terrible) level of performance.
What does slashdot think about this?
...what would happen if I sent some packets from google.com to google.cn, containing words like 'democracy' and 'Falun Gong'.
As far as I understood it, the point is that the wall blocks out IPs outside of China that try to send "sensitive" data into China.
Not a big deal either. Just send the IP Address of any mailserver you want to protect with a packet containing something "sensitive".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I can't imagine why anyone would choose a stateless firewall over one the preforms stateful inspection on all traffic. There are so many options available (pix, checkpoint, or just a well built iptables system), it would seem you'd have to work at finding something stateless.
Should china's firewall be slashdotted so that it can't work anymore and therefore allow the people of china a free internet? (free as in not censored).
-ed
So you see what had happened was....
DDoS is using multiple computers to "flood" a target off the Internet. This would be a plain DoS attack using a software weakness to deny service.
I highly doubt that they could get their population to accept them completely shutting off access to the outside world
Er, exactly which China are we talking about here. If the population don't accept things then they get run over by tanks.
init 11 - for when you need that edge.
Most firewalls will reassemble fragmented packets in order to perform content analysis. How to do it is in the TCP/IP RFC's.
Well done on writting a 'how-to' on pointers to make the firewall better. Im sure people out there new these things, and used them to their advantage. Now all holes will be plugged and even more censorship will rein in China. You have now had your 15mins of fame.
Insecurity by obscurity.
www.PeenieWallie.com
Chinese firewall is nothing - try getting through the Saudi firewall. As I understand it, the Chinese are at least a bit less modest about what is banned, so you should be able to at least get some legit porn sites through Chinese internet. However Saudi internet would block not just porn sites, but womens rights websites, womens magazines websites, even medical sites - anything that would display a photograph or illustration of a naked woman or man was stricly banned. Even it was just part of a human body, i.e. shoulders up.
It's not something that is trivial to fix. Others can do a better job of explaining why, but for now, suffice it to say that it'd require a significant effort on the part of the Chinese Gov't.
Maybe it can be fixed in The Great Firewall of China v2.0
[Fuck Beta]
o0t!
I think there are some good points to the existence of the firewall. While the firewall itself is a bad thing, no doubt, the fact that the Chinese have access to the internet at all is a huge step forward for them. We're talking about a country that was totalitarian for centuries, with virtually no interest in or comprehension of indivdiual human freedoms.
It also speaks to the power of the internet's design. Here is a nation notorious for its control of information, and the techniques they use are easy to discover, and possible to circumvent. If China can't restrict the internet, then there's hope that other governments and maybe even multinational corporations won't be able to pull it off either.
With luck, the firewall will become an irony of the past, as the importance of human dignity becomes apparant to the Chinese government.
...half a dozen of the other.
Certainly TFA suggests that the DoS attack could be used against chinese government computers, but this could also be used against chinese citizens. An exploit is, after all, an exploit. So I would suggest that in the case of the DoS attack, reporting it to the appropriate people - in this case the Chinese authorities - was the right thing to do.
Unfortunately, in this case, the very flaw that allows a DoS against machines within China also permits those inside the firewall to ignore the resets sent back, so by reporting the DoS, they've also reported how the censorship can be circumvented. (or, by discovering the censorship circumvention they've unfortunately stumbled upon a DoS attack).
In this case, I really don't think that there is a One True Answer.
The ways of gods are mysteriously indistinguishable from chance.
When a bunch of ninjas rough up the geeks in Cambridge, don't be surprised.
Their research is concerned with DRM ass hat tactics and such...pity!
The way things are going, AOL will probably have an equivalent firewall in a few years time. Then they can rent it out. Hooray for the free world.
Well done on writting a 'how-to' on pointers to make the firewall better. Im sure people out there new these things, and used them to their advantage. Now all holes will be plugged and even more censorship will rein in China. You have now had your 15mins of fame.
This is the same old tired argument we hear here on Slashdot over and over again. Expose the flaws and you either 1) alert the hackers on how to expose them or 2) Allow the admins to patch them. It's funny how depending on your political ideology, people will swing either way. How about a consistent opinion in favor of revealing flaws? Those who favor security by obscurity deserve neither.
Go ahead, mod me down.
Couldn't the Chinese government view this as an act of terrorism? In the interest of national security the Chinese government will start an ambiguous "War on Terror" after the the US "War on Terror" and "War on Drugs" which are _also_ unwinnable and declared solely to keep the ruling party in power via fear.
Is it just me, or does it seem rather unkind to go about declaring, "Look at me! I just conducted a cyber-attack against China!" Hey, I'm no fan of China's government or censorship, and I am aware that China have tried to attack other countries' computers, but two wrongs don't make a right. Unless we're doing something defensive to ward off an attack from China, I see little point in taunting them and giving them reason to tighten security even further. It just doesn't seem right.
This is not helping China. They know how their firewall works, they built it. They also know where Cambridge University is (unlike half the readers of Slashdot).
Slashdot is helping China by bringing the article to their attention.
This has been circulating in the security blogs for a week now. There are basically two schools of thought. One is that we might fix the IP stack to ignore/filter out RST packets. The second is that we might make it easier to turn on SSL.
Rather than monkey about with changing the protocols to ignore RST we would probably do better turning on SSL encryption on Wikipedia &ct with some cheap domain authentication certs.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
There's a reason people never agree on security through obscurity. Hell you've generalized that people believing in it don't like public disclosure. I personally feel it can deter script kiddies as their scripts occasionally look for banners, etc. There are cases it can help. Not everyone is smart enough to use a program to determine OS type, or other fingerprinting strategies.
I think these researchers just proved once again that nothing is uncrackable. The idea of security is similar to the titanic. Its unsinkable until everyone owns your box. Don't make fun of the security through obscurity camp.. even if it can be futile at least we try something. (i also patch like crazy, run firewalls, review logs, etc)
I don't mind public disclosure as long as the company gets time to patch the product (up to 30 days). Since we're talking about china, well zero day is fine.
MidnightBSD: The BSD for Everyone
It appears the link to the source is missing - I first read about it last week on Schneiers blog, linking ot the original blog post found here:
o ring-the-great-firewall-of-china/
http://www.lightbluetouchpaper.org/2006/06/27/ign
And for all the details, the paper to be presented is here:
http://www.cl.cam.ac.uk/~rnc1/ignoring.pdf
I think the interesting thing is that by configuring our end to ignore the invalid resets from the Great Firewall of China we can aid the distribution of otherwise censored material.
DDoS attacks against the GFC seems not to be that easy, as the article mentions the GFC is not one giant router at the backbone, but rather smaller machines closer to the end stations - the firewall is distributed accross an unknown number of gateways.
The Terrorist Song
by Usurper_ii
(Sung to the tune of Python's The Lumber Jack Song)
I'm a terrorist and I'm OK
I read at night and I work all day.
The Government:
He's a terrorist and he's OK
He reads at night and he works all day.
I read a lot and I seek the truth
I go to the lavatory.
After OKC, I saw some things that didn't make sense to me.
The Government:
He doesn't believe our story about OKC,
We monitor when he goes to the lavatory.
On Wednesday night, he went to an unapproved web site.
Chorus:
He's a terrorist and he's OK
He reads at night and he works all day.
When, after 9-11 didn't all add up,
I met with others on the net, to talk it up.
The government:
He didn't believe our story about 9-11.
We followed him to unapproved web sites after hours.
In our report, well say he had bomb-making materials under his sink.
Chorus:
He's a terrorist and he's OK
He reads at night and he works all day.
I don't think a plane hit the Pentagon.
I think the World Trade Center buildings fell all wrong.
I wish I could convince my dear ol' mom!!
The government:
He's a terrorist and we're going to make him pay?!
We read his e-mail and didn't like what he had to say?!...
Just me:
I wish I'd been born, back when America was really free!!
The Government:
He's a terrorist and we're going to make him pay
He reads the Constitution and knows his rights.
He's just like McVeigh, Bin Laden, and al-Qaeda!!
Chorus:
He's a terrorist and he's OK
He reads at night and he works all day.
Ron Paul
What TV cameras? We're lucky that photos managed to get out of there, the Chinese secret police were assaulting, detaining, and destroying the film of journalists. The film that did get out was smuggled out.
And the line of tanks stopped because the single person driving the lead tank didn't know what to do. It wasn't a policy decision handed down by the PLA to not hurt anyone because of cameras. They had just finished killing dozens, possibly hundreds of innocent people. They were shooting automatic rifles into crowds of people in the middle of the street.
The banner can tell you program version information and sometimes the host OS, machine architecture and running modules. Apache's webserver banner is a good example. It can, if set up to, tell you the version of apache, the version of PHP, the host OS kernel revision, and what processor is hosting that OS. That's a lot of information that really isn't necessary. Usually it's displayed when a ErrorDocument handler returns a 404 itself.
Slashdot is proof that Sturgeon's Law applies to mankind.
It's information.
They're academics.
Their whole raison d'etre is to learns and share their learning. The information itself is ethically neutral. It can be used for good or for bad.
Ok, so putting some words like "Falun" in the SMTP server welcome message is going to stop all the spam via bulletproof Chinese hosting, right?
I am going to try that!
I'm going to take a very strong position here in my first-ever Slashdot post -- China absolutely should be hacked, on a systematic and worldwide-basis. Their desire to censor a whole country should be opposed on both moral and enlightened-self-interest grounds. But it will be tough at best to beat.
Ironically, the situation is a kind of reverse spam-antispammer set up, in which the folks trying to get through the defenses are the good guys. Amnesty International's Irrepressible.info, while terribly primitive, is at least a start, and I think everybody with a web site should play along and see what happens. A more advanced idea may be found at http://www.monashreport.com/2006/04/17/how-to-beat -chinese-censorship-operation-peking-duck/.
And if the censoring can be used for some kind of DOS, so much the better. Make it as expensive and difficult for the oppressors as ever possible.
To err is human. To forgive is good system design.