Slashdot Mirror

← Back to Stories (view on slashdot.org)

Inside the Great Firewall of China's Tor Blocking

Posted by Unknown on from the onions-against-the-revolution dept.

Trailrunner7 writes with an article at Threat Post about China's ability to block Tor. From the article: "The much-discussed Great Firewall of China is meant to prevent Chinese citizens from getting to Web sites and content that the country's government doesn't approve of, and it's been endowed with some near-mythical powers by observers over the years. But it's somewhat rare to get a look at the way that the system actually works in practice. Researchers at Team Cymru got just that recently when they were asked by the folks at the Tor Project to help investigate why a user in China was having his connections to a bridge relay outside of China terminated so quickly. Not only is China able to identify Tor sessions, it can do so in near real-time and then probe the Tor bridge relay and terminate the session within a couple of minutes."

24 of 160 comments (clear)

  1. And you say Chinese can't innovate by DCTech · · Score: 5, Insightful

    Clearly they're one of the best software engineers in the world when they want to, being capable of real-time packet inspection and probing. China has over 1.7 billion people who almost all want to work in IT. They will rule the world.

    1. Re:And you say Chinese can't innovate by Anonymous Coward · · Score: 4, Funny

      Where did they pick up the extra 400 million people from?

    2. Re:And you say Chinese can't innovate by cp.tar · · Score: 4, Interesting

      Despite the error in your numbers, your post reminded me of Focus in Vernor Vinge’s A Deepness in the Sky.
      Spooky.

      --
      Ignore this signature. By order.
    3. Re:And you say Chinese can't innovate by saleenS281 · · Score: 4, Interesting

      You're assuming they're building it themselves. Given the recent accusations and lawsuit against Cisco, it's entirely possible that a US or some other country based company is writing the code they're using.

      http://www.huffingtonpost.com/2011/05/23/cisco-falun-gong-lawsuit_n_865585.html

    4. Re:And you say Chinese can't innovate by QQBoss · · Score: 4, Interesting

      How many people are actually in China, I am in no position to guess. But I am in a position to know that census undercounting does occur and why.

      As I mentioned, the "uncounteds" are both internal and external illegal aliens. Unlike most of the Western world, where the right of free travel is assumed, within China you are only legally allowed to live/work/"own" property in the place where you have a hukou (this is a gross oversimplification, but it is the beginning of a discussion). Many of the presumed 400M illegals are native Chinese who have chosen to live where they have no permission to live, doing so under the radar to avoid sanctions which in the past could have been quite onerous. They aren't at their home city to be counted (though children usually are, staying with grandparents, since without a local hukou they have no right to go to school where their parents are living) and they avoid being counted in the city where they are living because they could be forced to return to their officially registered home.

      About 6 or 7 years ago, the hukou laws were supposedly eliminated, but anyone who says they have been completely abolished is wrong. Decentralized, perhaps, but they still exist and are enforced whenever the right government official gets their panties in a wad. Unless and until the hukou laws are actually abolished, the charade will continue.

    5. Re:And you say Chinese can't innovate by rtb61 · · Score: 3, Insightful

      Reality is by far the majority of Chinese in China work as near slave labour in factories or as peasants on farms working for a pittance. Don't get confused by numbers and percentages, plus independent thinking, striving for their voice, Chinese tend to be the ones who have already left and live elsewhere in the world. That is aproximately 40 million people http://en.wikipedia.org/wiki/Overseas_Chinese which you blithely reduce nothing.

      The numbers of Chinese who have a voice in China and are in a position to control anything only number in the tens of thousands, it is an corporo-Fascist Autocracy after all.

      Internet censorship in China is made significantly easier because by far the majority can not afford and must gain access through a limited number of internet cafe's. As time progresses and the majority of people living in China release how backward they are in their rights and how cowardly they have been in failing to fight for them, will of course start to baulk at passing that future on to their children and grandchildren and strive to break the autocracy that controls them.

      So in a future China where 1.3 billion want internet access, we will see how effective the government is at censoring them and keeping them cowed.

      --
      Chaos - everything, everywhere, everywhen
    6. Re:And you say Chinese can't innovate by Anonymous Coward · · Score: 4, Interesting

      I left my job at a major router company around 2004 specifically because Chungwah Telecom was asking for us to implement features to aid spying. Although, interestingly enough, you had to read between the lines to understand that it was for spying... A lot of the techniques that do it are essentially system testing-sounding features like "clone traffic matching this IP to a second address on a different port."

      At that time, deep packet inspection was not yet a reality, but any engineer could easily see that, as the data/traffic moves through numerous custom ASICs and FPGAs, and the headers get inspected, why not examine more of the data in the packet? The first stage I saw of it in the public at large was detection of layer 5 and up protocols, e.g. traffic-limiting bittorrent.

      Last time I was in Taiwan (which has a grumpy relationship w/ China), one of my younger student friends in a University there demonstrated, as his Master's project, an algorithm to detect images without (fully) decoding them. The secret there was to extract, from JPGs only, the DC blocks representing the average RGB values of each 8x8 block. If you know JPG you'll recognize that. The system then ran conventional "porn detection" algorithms, etc. on the extracted mini-images.

      So, yes, I can verify that 1. American companies are writing code to spy on the rest of the world and ourselves. 2. Chinese are asking for it, just like any other feature. 3. The requests for capabilities are often subtle, such that most engineers don't realize what the algorithms are doing and 4. capabilities to do this are steadily growing more powerful.

      So, now, what are you going to do about, boys?

  2. My college did it easier by The+MAZZTer · · Score: 4, Informative

    Tor has to connect to so-called "dictionary servers" periodically to refresh its list of tor nodes to try to use. If you block those servers, tor breaks.

    At least, that's how it worked when they finally figured out how to block it after 3 years. Maybe tor has improved since then.

    1. Re:My college did it easier by TSHTF · · Score: 4, Informative

      Tor has changed since you read last... "Bridges" were added to Tor and are not listed in any central directory.

      Tor bridges

    2. Re:My college did it easier by xiando · · Score: 4, Informative

      Tor has to connect to so-called "dictionary servers" periodically to refresh its list of tor nodes to try to use. If you block those servers, tor breaks. At least, that's how it worked when they finally figured out how to block it after 3 years. Maybe tor has improved since then.

      This was the situation. Countries did download the entire Tor directory and block all the nodes listed in it. This is why bridge relays were invented, and there is no public list off all bridge relays. It works like this: You get a bridge address, you connect to a bridge and the bridge then connects to the Tor network. This changed the arms-race. GFW is now able to detect the Tor bridges and this is a set-back for the Tor-project. They will find a solution which fools the GFW and the Chinese will lose face.

      --
      9/11: Never forget it was a false-flag operation
    3. Re:My college did it easier by BitterOak · · Score: 4, Informative

      Tor has to connect to so-called "dictionary servers" periodically to refresh its list of tor nodes to try to use. If you block those servers, tor breaks.

      At least, that's how it worked when they finally figured out how to block it after 3 years. Maybe tor has improved since then.

      We have to remember though what Tor was designed to do and what it was not designed to do. Tor was designed to protect the privacy of individuals who don't want their browsing habits revealed. It does this by preventing your IP address from being available to the web server you connect to, and additionally it encrypts traffic so intermediaries, such as your ISP can't snoop on your traffic. It was NOT designed as a means of bypassing firewalls that are actively try to block Tor. That was never its purpose.

      --
      If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
    4. Re:My college did it easier by Fluffeh · · Score: 4, Insightful

      It was NOT designed as a means of bypassing firewalls that are actively try to block Tor. That was never its purpose.

      Totally agree that it was not the original purpose, but I would add to your comment and congratulate the folks behind Tor for taking a stand and trying to allow their software to get past the GFW. Sometimes when you realize that your software is being used for something more important (possibly something much more important than not letting your ISP know what you are doing) then it is a great opportunity to change your purpose somewhat. If the purpose itself isn't being changed, then it is still heart warming to see the effort being made anyhow.

      --
      Moved to http://soylentnews.org/. You are invited to join us too!
  3. Thank you Chinese government by circletimessquare · · Score: 5, Interesting

    for helping us build more robust Tor protocols

    Oh, you thought you were going to actually kill the average Chinese citizen's desire for free access to information? You didn't understand that a stronger Tor protocol or something even better than Tor is the actual result of your escalation of the arms race?

    You're pretty ignorant about basic human nature, aren't you, you authoritarian assholes.

    Oh, and btw you grumpy old shitbags:

    http://www.nytimes.com/2012/01/04/world/asia/chinas-president-pushes-back-against-western-culture.html

    The reason you are lamenting the influence of Western culture on China, and not basking in pride at the influence of Chinese culture on the West, is because YOU CENSOR EVERYTHING IN YOUR CULTURE. So Chinese Culture is hobbled and decimated. Because you think you can control, nevermind why you think you should control, Chinese thought. Instead of a great big strong tree, you have a demented little broken bush. Because of YOUR efforts at preventing Chinese culture from growing, by censoring everything, you morons

    You ignorant controlling douchebags. Your average Chinese citizen understands this, why don't you you stupid old and decrepit paranoid control freaks?

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
    1. Re:Thank you Chinese government by Anonymous Coward · · Score: 5, Funny

      And how you do really feel?

    2. Re:Thank you Chinese government by circletimessquare · · Score: 4, Interesting

      Question: what is the greatest ally in the growth of Western Cultural influence in China?

      Answer: The Chinese Central Government, for working so hard to make sure that Chinese Culture can't grow.

      They think that controlling culture, and growing it, are compatible concepts. Culture grows when it freely crosspollinates with other world cultures. Japanese culture has freely been assimilating culture from around the world and we still recognize a distinctly Japanese culture. The game of controlling culture and "protecting" culture from "illegitimate" influences is the game of the insecure little person who believes Chinese culture is inferior. The person proud of being Chinese is freely dabbling in world culture, infusing their own thoughts, and defining Chinese culture as strong and new. Culture needs to crosspollinate to survive and grow. Sit on it, control it, keep it in a box, and your culture dies.

      Look at what these ignorant insecure douchebags are doing:

      http://www.nytimes.com/2012/01/01/world/asia/censors-pull-reins-as-china-tv-chasing-profit-gets-racy.html?pagewanted=all

      I know: I can hear the typical snobby Western voice now: "I wish my government would censor the Kardashians and Jersey Shore."

      And for thinking that way, you have merely identified yourself as knowing nothing about how culture actually works, and have allied yourself with authoritarianism. congratulations, you're ignorant and you're an asshole. i'd much rather have people watching jersey shore than some government entity telling them what to see and watch. and there is nothing wrong with the pursuit of empty guilty pleasures, that's a PERFECTLY VALID SEGMENT OF CULTURE. think of it as creative ferment from which greater cultural products spring forth. without the base of empty silly nonsense, the "higher" cultural products have nothing to grow out of.

      --
      intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  4. Re:obfuscation? by DCTech · · Score: 3, Interesting

    And Chinese will just block it again. And unlike slower cat-and-mouse game in western countries, Chinese can react quickly without going thru all the hierarchies and courts. At the same time, Tor project needs to keep updating their clients and servers, and it probably doesn't take anything at all for Chinese to block new changes. They have the advantage here.

  5. Re:SSH by xiando · · Score: 4, Informative

    Bugged planet indeed, I wonder if any of our lovely "free world" companies like Amesys or Siemens are selling the DPI gear, or if China is using a fully homebaked solution.

    If you watch the 28c3 Torproject presentation available at http://tinyurl.com/7c893sl then you will learn that western corporations like Intel, Nokia and Cisco are heavily involved in Internet surveillance and censorship around the world.

    --
    9/11: Never forget it was a false-flag operation
  6. Re:Not that much new here... by xiando · · Score: 4, Insightful

    Tor exit node based blocking has been used on various IRC servers to combat abuse for years and years now, The chinese might be doing something more fancy, but that only shows that they didn't go for the fairly easy and quick solution.

    The Torproject responded with bridges when countries started to block entire countries like those IRC servers do. The entire list of Bridges is not public. What GFW now does to detect and block those bridges is something new and it is something entirely different. The "download the entire list of Tor servers and block them" method was used and stopped being efficient thanks to Tor bridges.

    --
    9/11: Never forget it was a false-flag operation
  7. Lose face by Anonymous Coward · · Score: 5, Funny

    For those unfamiliar with the concept "face", it's the social equivalent of getting modded -1

  8. Tor, China and the USA by xiando · · Score: 5, Interesting

    I tell you, free speech and freedom in general in America is doomed. The NDAA2012 combined with SOPA is just another brick in the wall on the path towards a completely tyrannical fascist government. Some Americans argue that the USA is there already. Today we are talking about Tor being blocked by the Great Firewall of China. How long will it take before we are talking about the Great Firewall of the USA blocking websites, software like Tor, I2P, Freenet and so on? Beware that western corporations like Intel, Cisco, Nokia and Siemens are the ones who are delivering the technology used by countries like China. The US and the west already has this technology. I do not see it as a question of if but when these technologies will be used in the US and other "free" western countries. The Tor project should be supported. Why people in other countries need it today may be why you need it tomorrow.

    --
    9/11: Never forget it was a false-flag operation
    1. Re:Tor, China and the USA by Anonymous Coward · · Score: 4, Insightful

      You're right--the US is nothing close to communist. The US is however VERY close to or has already acheived fascism, which is properly defined by the inventor of the word as the merger of corporate and state interestes. We absolutely have that. Right now the only thing we're missing is the traditional single dictator, but I'm not all that certain that it's required in version 2.0.

      It is kind of amusing to see people equate "socialism" with "communism" or use either of those terms in conjunction with fascism though--and it's even more amusing to watch people blame government for "stealing" things when, at best, it's been the enabler of the theft by large multinational bankers and corporations. It's everyone's vaunted "private industry" and "free enterprise" that are the thieves. They rig the game, or they outright steal, and they use part of their takings to enable a media campaign to get everyone to hate the one force that could possibly stop all that--proper (in the interests of the people) government regulation.

      Were it not so tragic, it would be even more amusing to watch people complain about "big government" willingly step into the TSA's porno scanners, support indefinite detention of whoever doesn't look like them, and generally engage in their fawning behavior over the ever-militarized police forces who truly occupy our cities and our streets. It is "law enforcement", which is almost never used against the rich and corporate, that is the greatest threat to freedom, liberty, and especially life these days, and yet that's the one part of government these morons never seem to question. "Law enforcement" has tried and will continue to try to bring this and many other evils to the US, and that sort of thing must be stopped at all costs.

  9. Re:ssh tunnel on nonstandard port by peterindistantland · · Score: 5, Interesting

    This definitely work. I have no problem using SSH even on the standard port in China. Since ssh is encrypted, deep packet inspection is useless, unless they ban SSH altogether, which they don't.

  10. Re:ssh tunnel on nonstandard port by lakeland · · Score: 3, Informative

    It works, though it stands out like a sore-thumb.

  11. Re:obfuscation? by mSparks43 · · Score: 3, Insightful

    I mean, encrypted data stands out from normal traffic like a sore thumb.

    Actually, I think this is something of a myth.
    "normal traffic" these days is mostly compressed.
    Since the goal of both encryption and compression is to achieve a byte stream that is otherwise indistinguishable from random noise, I don't think one set of random noise stands out much more than another set of random noise.

    Only thing that really separates traffic these days is imperfections in these algs and the negotiation protocols.
    ____
    My suggestion for their problems would be to negotiate an otherwise compressed stream that is widely used (e.g. gzip) then tunnel the encrypted data through this stream, ideally encrypting post compression.