Slashdot Mirror


Chinese Censor-Beating Software Resembles Malware, But Isn't

coondoggie writes "Software designed to beat Chinese censorship may behave in ways that seem suspect, but it is all part of the application's strategy to fool the Great Firewall of China, according to one programmer of the software. 'There are many built-in tricks that do all kinds of things to confuse the firewall,' says David Tian, a scientist for NASA who works spare-time on UltraSurf, the free software designed to promote unrestricted Internet access for citizens of China persecuted for being members of Falun Gang, the religious group the Chinese government is trying to suppress."

22 of 160 comments (clear)

  1. Falun Gang by argux · · Score: 5, Informative

    I think it's Falun Gong

    1. Re:Falun Gang by Anonymous Coward · · Score: 5, Funny

      I think it's Falun Gong

      Great, now Slashdot will be censored in China. I hope you are happy.

    2. Re:Falun Gang by rchh · · Score: 5, Interesting

      I am currently in China and the Internet censoring is not as bad as I had thought. I can open most websites, including BBC and New York Times. Most online proxies work. I can read any article from wikipedia- including that of Falun Gong ,Tibet and Human Rights.The most notable failures are Amnesty International and Human Rights Watch websites. Maybe I can read most websites because they are in English?

      --
      Computers can reverse entropy.
    3. Re:Falun Gang by khayman80 · · Score: 2, Informative

      Yes. The great firewall blocks Chinese access more than English access.

  2. Confuse it? How? by girlintraining · · Score: 5, Insightful

    You shouldn't be trying to "confuse it", you should be making sure that the traffic patterns aren't unique and discernable. In other words, using steganography. All this "confusion" stuff I read in the article gives the user a distinct pattern of behavior that can identify the user as actively using said software. If you're trying to get under the radar of the government, don't start by sending up a big digital flare that says "Hey! I'm trying to bypass your crap." It usually ends badly for the would-be revolutionary, who's first job (I might add) is to survive.

    Even in so-called "free" countries like the US, the government can imprison people indefinately on the off chance that the encrypted data may be subversive. How do you suppose China would handle it? Encryption doesn't enable free speech -- a gun to the head is a pretty effective way of recovering the key.

    Save lives: Use stenography.

    --
    #fuckbeta #iamslashdot #dicemustdie
    1. Re:Confuse it? How? by tecnico.hitos · · Score: 4, Funny

      Save lives: Use stenography.

      abv cmt shd b fxd

      --
      The good, the evil and the vacuum tubes.
    2. Re:Confuse it? How? by girlintraining · · Score: 4, Interesting

      It sends out search based noise and obfuscation by making randomized search-queries to popular search engines, e.g., AOL, Yahoo!, Google, and MSN..

      *face palm* Googling "how do I blow up government buildings" is going to attract the attention of shub internet no matter how many bogus queries you put before or after it. Most filtering schemes are based on content -- they don't care to do statistical analysis. You're just not that important. All they need to hang you is proof you visited a certain website or looked for certain terms. For example, if I typ[$)%(T^NO CARRIER

      --
      #fuckbeta #iamslashdot #dicemustdie
    3. Re:Confuse it? How? by girlintraining · · Score: 2, Informative

      The point of bogus queries is to avoid tracking based on behavior, which is of course a matter of concern in this context. It is assumed that your ip address is already hidden.

      First, "tracking based on behavior" -- What exactly constitutes behavior? A string of a thousand randomly generated queries, popular or not, mixed in with several queries on how to build bombs is going to be flagged. It isn't generating any real extra work for them to deduce who you are by traffic analysis, because packet sizes, times sent/received, and other data specific to the request is going to correlate with a specific time and place, which means a specific person (in all likelihood).

      As to the IP address being "hidden" -- I'm not even sure where to start. Packet-based switching networks (ie. TCP/IP) require a source and destination IP. The ISP knows your IP address. It's often required by law to log all connections to/from each; at the very least the header data, but with the crashing costs of storage, keeping the content as well is a trivial matter. There's no "hiding" your IP address.

      All methods of connecting via encrypted tunnels into a "proxy cloud" that I have seen are still vulnerable to basic traffic analysis: As long as you have packet logs for the end-point and source, traffic analysis is a trivial computational task. Translation: I can have confidence that a given computer sent a given query at a given time; Decryption of the data at any point within the cloud or at the source isn't needed -- as long as I have the server logs and a corresponding packet log of the target computer, you're toast.

      Steganographic techniques would make the results of such an analysis difficult or impossible if properly implimented, but depend on the cloud architecture reaching critical mass, sending a constant flow of random data between each node, and then rate-limiting. These constrictions mean that the computational resources used to create said security are much, much higher than the current model. This is why they haven't been adopted -- simply put, nobody wants to wait several seconds to a minute for a single webpage to load, and the owners of said cloud don't want to waste bandwidth to manage what they believe is a low-risk attack vector.

      Sadly, it's exactly this kind of thinking that may very well get someone killed over there.

      --
      #fuckbeta #iamslashdot #dicemustdie
    4. Re:Confuse it? How? by interkin3tic · · Score: 2, Funny

      Googling "how do I blow up government buildings" is going to attract the attention of shub internet no matter how many bogus queries you put before or after it.

      If anyone is wondering the answer to that question but doesn't want to attract the attention of the "shub" internet, I've got the answer right here. There is usually somewhere on the building a small thermal exhaust port approximately 2 meters wide. A direct hit with a proton torpedo should cause a chain reaction that will destroy it. I should caution you that ONLY a direct hit will cause a chain reaction.

  3. Re:Falun Gong by cat_jesus · · Score: 2, Funny

    Oh yeah that's way nuttier than believing drinking the blood and eating the body of a zombie will get you into heaven.

  4. Re:NOT Free Software by BitterOak · · Score: 2, Informative

    This isn't free software. There is no source available anywhere.

    There's a difference between free software and open source software.

    --
    If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
  5. do'h by pbjones · · Score: 2, Insightful

    and no chinese read /. so the secret is safe.

    --
    There was an unknown error in the submission.
  6. Re:Falun Gong by Wolfier · · Score: 3, Informative

    It's probably not a cult group, but more resembles a hate group where I see them in Toronto.

    They don't seem to practise what they were supposed to believe and preach (which is "Truth, Compassion, Tolerance"). Everyday they set up a booth and spread hate message about the Chinese Communist Party.

    Let's put aside our judgement towards CCC itself, which must not be very positive anyway - they way Falun Gong people act just seem to totally contradict "Compassion" and "Tolerance" and it seems more and more like they're preaching "an eye for an eye".

    I would not let my children go anywhere near this "religion".

  7. comspiracy by gmermnstinsmermwords · · Score: 2, Funny

    Or so David Tian would like you to believe, but did any of us think that he may be using his software as a ploy to deploy real Malware and take down the Chinese space program, from the inside!! If you listen you can hear the muah ha ha echo after reading the blip.

  8. Re:Falun Gong by Brian+Gordon · · Score: 3, Insightful

    Well pretty much any new religious movement is going to be absolutely insane. It makes sense for a communist government to suppress Falun Gong.. the problem is that they do it by treating practitioners as criminals instead of as victims.

    The controversy really doesn't have anything to do with the psychological issues though.. it's that they're imprisoning people, torturing people, and harvesting organs.. not cool for any reason

  9. Re:Falun Gong by macshit · · Score: 3, Informative

    Everyday they set up a booth and spread hate message about the Chinese Communist Party. Let's put aside our judgement towards CCC itself,....

    They don't seem to be preaching violent revolution against the chinese communist party, merely saying that it sucks, and people should not support them. So our opinion of the CCC matters quite a bit in how we judge what they say (and lets face it, for the most part, the CCC does suck)...

    they way Falun Gong people act just seem to totally contradict "Compassion" and "Tolerance" and it seems more and more like they're preaching "an eye

    I would not let my children go anywhere near this "religion".

    for an eye".

    the CCC quite happily kills and imprisons all those who resist or complain about its rule, and even those it suspects of resisting, or those who merely defend the rights of others to do so. Falun Gong has certainly been on the receiving end of such persecution. If Falun Gong were guilty of "eye for an eye" thinking, they'd be advocating similar actions against the CCC; but as far as I've seen, they're not, not even close. Though they certainly go to great lengths to demonize the CCC (to the extent they can be kinda annoying), every action I've seen Falun Gong advocate has been non-violent, and non-oppressive (mostly calling for individual chinese to disown the communist party).

    So really I don't know what you're talking about....

    --
    We live, as we dream -- alone....
  10. What is the obsession with Falun Gong? by DNS-and-BIND · · Score: 4, Insightful
    Seriously, wtf is this Western obsession with the Falun Gong? On one hand, you have fundamentalist athiests in charge of Western media who take every opportunity to attack and discredit any religion, much less crazy cults like Scientology or Raëlism. On the other hand, you have those same exact people coming to the defense of Falun Gong! Everyone knows they're nuts, right? To call them the Mormons of China would be too mild, they're more like the Branch Davidians. So, to sum up, we have hardcore athiests getting really offended that an officially atheist government (the best kind!) is cracking down on religion. Strange days, eh?

    My own personal explanation for this bizarre behavior is that Westerners actually don't know anything about Falun Gong, and don't care to learn. They are comfortable with the "narrative" that FG=good, China=bad. And as recent events have shown, narratives are more important and cherished than the actual facts on the ground. People get *angry* when their comfortable narratives are revealed to be inaccurate.

    --
    Shutting down free speech with violence isn't fighting fascism. It IS fascism!
  11. Re:Falun Gong by FooAtWFU · · Score: 2, Interesting

    Tsk, tsk. This is an important cultural and religious phenomenon that you really should be aware of. Know then that John 6:49 goes something like this. Jesus is getting off the "dividing the loaves and fishes" episode and was evacuating across the lake; the crowd followed him anyway and now they're asking him for a miraculous sign so they can believe in him. They suggest the old manna-in-the-desert trick as an example. Many of them may be operating off of the popular "revolutionary messiah" premise, believing that there will soon be a military overthrow of the existing oppressive world order. They don't quite get what they expected:

    "Your forefathers ate the manna in the desert, yet they died. But here is the bread that comes down from heaven, which a man may eat and not die. I am the living bread that came down from heaven. If anyone eats of this bread, he will live forever. This bread is my flesh, which I will give for the life of the world."

    Then the Jews began to argue sharply among themselves, "How can this man give us his flesh to eat?"

    Jesus said to them, "I tell you the truth, unless you eat the flesh of the Son of Man and drink his blood, you have no life in you. Whoever eats my flesh and drinks my blood has eternal life, and I will raise him up at the last day. For my flesh is real food and my blood is real drink. Whoever eats my flesh and drinks my blood remains in me, and I in him. Just as the living Father sent me and I live because of the Father, so the one who feeds on me will live because of me. This is the bread that came down from heaven. Your forefathers ate manna and died, but he who feeds on this bread will live forever."

    On hearing it, many of his disciples said, "This is a hard teaching. Who can accept it?" Aware that his disciples were grumbling about this, Jesus said to them, "Does this offend you? What if you see the Son of Man ascend to where he was before! The Spirit gives life; the flesh counts for nothing. The words I have spoken to you are spirit and they are life. Yet there are some of you who do not believe."

    ... From this time many of his disciples turned back and no longer followed him.

    Some interpretations dismiss this as a purely symbolic exercise, but the language isn't really the language of symbolism, and furthermore the actual working metaphors for "to eat (someone's) flesh" and "to drink (someone's) blood" mean "to persecute (someone)" and "to oppress (them)". The traditional interpretation for a long time - today, the Catholic and Orthodox stories - integrate this with the subsequent "Last Supper" rite in which blessed bread / wine are said to become his (Jesus's) actual body and blood (though the actual appearance and taste, of course, is unchanged, perhaps recognizing that, in fact, cannibalism is something that people find icky in oractice.)

    The whole flesh-as-bread premise probably works a lot better with people who have a diet of mostly-bread, and actually experience handling bread dough, for whatever that's worth.

    --
    The World Wide Web is dying. Soon, we shall have only the Internet.
  12. Atheist media? by MushMouth · · Score: 4, Insightful

    While I agree that Falun Gong is a total wacky cult (and I have old friends where sadly involved with it), but maybe you should think with a little objectivity calling the media atheist. I mean the one thing that a US presidential candidate must do is prove their love to Jesus. Don't you think if the media were atheist this sort of thing would be questioned a bit more. The one thing that a major political candidate simply can not be is Atheist, polls have pretty much proven that we will get an islamic president before we get an atheist. Personally I find the rites of all christianity, and bible stories just as nutty as the Xenu crap. Think for a second if you first heard these stories when you were in your 20s.

  13. discredit != crackdown by ZmeiGorynych · · Score: 3, Insightful

    Because some people, such as myself, are fully in favor of making fun of religions, but object to the 'cracking down' part. As insane as Falun Gong might be, they should be allowed to preach and practice whatever the hell they want as long as they don't resort to actual physical violence, just as the society should be free to do any counter-propaganda - but blanket censorship and putting a lot of practitioners in prison is crossing the line.

  14. Re:Falun Gong by Toonol · · Score: 2, Interesting

    Isn't it a requirement of Catholicism? From the light reading I've done, it really seems that according to strict Catholic teachings, you have to have all your nutty rituals strictly in order when you die, or you burn forever.

    That's one way in which Protestants have seemed to make more sense to me. It's just an up or down "Accept Jesus y/n" type choice. No chanting, no strange priesthood.

    God, sometimes it just boggles my mind that we still have religion. I'll be playing a fantasy game, or reading a novel, with priests and churches and angels and demons, and it hits me that 90% of America fervently believes stuff that seems cheesy in a video game.

  15. Wolves in sheep's clothing by Shoten · · Score: 2, Interesting

    Steve Topletz and Jonathan Logan gave a fascinating talk at the BlackHat Briefings this past July, where among other things they discussed how one Chinese tactic in dealing with privacy groups is to set up their own organizations...a darker kind of astroturfing, if you will...that compete against legitimate privacy-focused groups. They also detailed their analysis of UltraSurf, which revealed some fairly horrifying things. For one, it's not just the code itself that historically has been trojan-esque in nature, but the behavior as well. Once they fired it up, it started probing a multitude of networks, all belonging to either Western governments, the financial sector, or the military. Also, it demonstrated that it was listening in within SSL sessions, as demonstrated by its behavior when browsing within SSL would return an error page (even a custom one, that wouldn't be of the normal size expected for a 404 response, for example). So, I'm not too likely to believe a guy just because he works for NASA; NASA is not an organization that was founded to provide bona fides for security researchers, so it really doesn't add any mantle of credibility for this topic.

    --

    For your security, this post has been encrypted with ROT-13, twice.