My Experience With the Great Firewall of China
blog.zorinaq.com
blog.zorinaq.com
As someone who crack (or at least block) VPN protocols for a living, I can indeed confirm this is 1 of the tricks used by all deep-inspection firewalls to detect VPNs.
In fact, a very popular VPN software for Chinese citizens uses TLS-within-TLS (sometimes fake TLS) to hide its data. From the author's description, the traffics are similar enough IMO for the GFW to detects.
(No, I don't work on GFW, but we block similar software. Sometimes we do comparison between various products to see how others block them.)
1: https://github.com/hwdsl2/setup-ipsec-vpn
2: https://github.com/jlund/streisand/commit/fea4a9545bfa066db3...
1. Never use Google Maps in China; Google Maps in China are just hilariously wrong and out of date and will get you lost. Even if Google Maps wasn't blocked you wouldn't want use it in China. Apple Maps is the best English language solution, it's accurate and up to date; that or Baidu Maps if you read Chinese.
2. The OP is missing the point of the GFW. It's not really about censorship. It's mainly about providing a market for local tech startups and about keeping the lower classes from organizing and causing trouble. The party doesn't care is middle or upper class people access the outside internet. They know network effects will keep them using local tech and middle or upper class people are too bought into the system to rock the boat -- after all these people travel outside of China and have a decent knowledge of the world outside. Just assume anything you put through a VPN that advertises as going through the GFW is being monitored. Just like in the elsewhere you'd just assume anything you'd send through Google is being monitored. On sensitive days suddenly all these VPNs are blocked too so the GFW definitely does have the power to block them at will.
Finally I find it a bit odd that someone so concerned with privacy uses so many Google Apps. Isn't that rather counter productive?
Also, only web based gmail is blocked. Access from Mail.app or iPhone's Mail is not blocked. Sadly translate has been blocked for about a year now... all the more reason to never turn the VPN on your computer or phone off.
That sounds like censorship to me.
There's a fairly big difference between having a company consolidate your personal information and a country willing to throw you in a hole for thinking certain thoughts.
There's another angle to it that I think is more important to many - not having access to Google apps you're used to is fucking annoying, to say the least. Bing is nowhere near good enough or convenient enough to replace Google for search and translations (and DDG is blocked). If, like me, you use GMail and Facebook as primary means of communications, then GFW basically cuts you out from family and friends.
> Also, only web based gmail is blocked. Access from Mail.app or iPhone's Mail is not blocked. Sadly translate has been blocked for about a year now... all the more reason to never turn the VPN on your computer or phone off.
GMail for Android (and Inbox by Google) are somewhat blocked. So is the Facebook app and Facebook Messenger app. I had periods late at night when my phone would suddenly download a few e-mails or receive FB notifications, but the "connection" lasted something like 30 seconds.
RE censorship, GFW is already effective enough, even if it's a side effect. See:
For some Google Services there are annoying but functional workarounds, for others.. not so much:
My Galaxy S6 fingerprint scanner acted up and locked me out of my phone. I didn't really remember the backup password (I was too clever by making it very unique - somehow forgetting to put it into Lastpass). I thought - no problem, I can use the Google Account password reset mechanism that I used before, right? Wrong! When you are locked out you can't change WiFi networks either, so connected to an Astrill router or corporate network that is on a VPN wouldn't have been an option. So the only option was a factory reset. Turns out that a US Galaxy S6 immediately tries to phone home to some servers blocked by the GFW during the reset process. You can't skip that step! So this is where I had to find some folks with an Astrill VPN router and connect to their private WiFi network that was tunneled to the outside world.
Lesson learned: Know your backup passwords and don't rely on fingerprint scanner functionality.
It only gets tricky when you want to take a taxi. Sure - you could show the address to a driver, but I found that to be very awkward and it didn't always result in success.
So my major problem with using Baidu Maps is the fact that I cannot view addresses or locations in Pinyin. If I knew the characters I could pronounce it :)
I'm an Android user. I just spent 10 weeks in Shanghai from early October to mid December. I can read some amount of Chinese but simply not enough to use Baidu Maps for all my navigation needs.
I found Google Maps (via Express VPN) to be perfectly fine in Shanghai. The public transportation suggestions and times were completely off, but locating a given address (my main use case in Shanghai) and using walking directions was never an issue.
In Shanghai you use Uber/Didi Kuaidi/Taxi or the Metro as opposed to driving yourself. As long as you can use Google Maps to look up the Pinyin spelling of the next major intersection so that you can pronounce that to a Taxi driver you are good to go. :)
Interestingly enough when roaming for free on T-Mobile (at 2G speeds) I was able to access Google Maps and most foreign internet services without the need of a VPN.
> Interestingly enough when roaming for free on T-Mobile (at 2G speeds) I was able to access Google Maps and most foreign internet services without the need of a VPN.
Yup, if you are roaming on another a foreign provider you will rare have any troubles. Not sure why, but that's always been the case.
I would have loved to use Baidu Maps all the time if there were a Pinyin mode. When I first installed the app I was shocked by the permissions it requested, but on stock Android I didn't really have a choice.
I do think international iPhone users generally have it easier in China.
Let's see what happens this year (or next) with Google resuming some operations in China (saw some job openings focused on Ads in Shanghai and Beijing).
"The OP is missing the point of the GFW"
Perhaps I did not explain myself well. What confuses me is why does the GFW goes to great lengths to very effectively block some VPN solutions (such as an SSH SOCKS tunnel), while it lets other VPNs operate (such as ExpressVPN). Or maybe this is a question I answered already at the end of the post: they can monitor ExpressVPN but not SSH, so they block the latter.
"Finally I find it a bit odd that someone so concerned with privacy uses so many Google Apps."
Simple: I am an ex-Google employee (Security & Privacy Engineering). I saw from the inside how serious and obsessed they are about privacy and protecting people's data, and this made me trust Google more than ever.
However you can use this to bypass the GFW. free vpn app: fastcat
Initially gives you 50MB, I think if you register and check-in every so often you can get more free data to use.
I wonder if it might be because I'm using Google's Apps for Business (i.e., our own domain). In my experience the GFW is much more lenient if it thinks what you're doing is work related.
Actually it's the other way around. It's built by Chinese companies as well as Cisco, Nokia-Siemens making a huge profit from Chinese security funding. GFW's funding is >$10B USD. The protectionism is the side product.
Time to get my hack on. :]
One thing I was surprised to learn is the GPS shift problem - particularly that China has managed to figure out how to encrypt map coordinates[0], so that they still look right with a proper map. It looks like something trivial to solve, so I guess the only reason a solution isn't widely deployed is because it would be illegal to use in China.
Another thing, slightly off-topic:
> I learned through this experience that the GFW is unmistakably able to exploit side-channel leaks in TLS, such as packet sizes in order to detect the "TLS within TLS" characteristic of secure web proxies. This really surprised me. I had no idea the GFW had reached this level of sophistication.
Come on. This is not sophistication. This is something a 10-year-old child could figure out if you gave him a set of connection logs and told to split it into two subsets. Looking at side channels is the obvious thing to do if you can't determine something from just reading it.
I'll grant that implementing machine learning for this task may be sophisticated, but just noticing an obvious side-channel (and writing a simple check for it)? And this is not the first time I've seen people calling side-channels or looking at metadata "sophisticated". Is it because 99% of programming consists of writing absolutely trivial spec-following code that doing anything that's not in the standards is "sophisticated" nowadays?
[0] - https://en.wikipedia.org/wiki/Restrictions_on_geographic_dat...
Why Google and other mapping services don't apply this transform has more to do with business decisions and the hoops they have to jump through to be able to work in China at all.
Here are some converter implementations in several languages:
Install that on your own server behind Basic Auth. Then it just looks like normal HTTPS traffic to any sniffer. Because that's exactly what it is.
If task at hand is to match encrypted connection to a smaller number of alternative (say identify accesses to popular place, like gmail/facebook login page, etc), same technique of observing packet size distribution over time should probably work quite reliably, and cgiproxy will do nothing to hide it.
[1] http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps....
The first one is a proxy, but unlike TLS proxy, it does not have a handshake phase. Rather, it encrypts all data with a preshared key, and the server rejects the connection if decryption yields invalid data. The stateless nature makes it much harder to detect.
The second one is a VPN over DTLS or TLS. Its security is even better than OpenVPN, as it supports ECDHE and AES-GCM from very early. No stunnel or obfuscation is needed at this point.
I recently used this in Iran with success as well.
The next day, the packet loss returned. But if I simply
used a different port number for the proxy, everything
would continue to work fine for another day or so. I
think this time the GFW was not blocking me based on
side-channel leaks, but based on network metrics. 100% of
the network traffic to/from my server crossing the
Chinese border was to my public IP in China, so the GFW
probably learned my TCP endpoint was likely used as a
private VPN, as opposed to being a public HTTPS site
accessed by many client IPs.What is interesting is that the author (mainland Chinese) had a 'visit' from the 'police', who 'asked' him to abandon the project. He changed the default branch of his GH project to an empty branch, but the code still remains.
Further, although his code is known, the GFW doesn't block its techniques.
I'd suggest the author make their Idea #4 random-padding code open source, but ironically if it became popular then surely the ML-based filters would eventually cripple it...