Ignoring the Great Firewall of China

Abstract

Abstract. The so-called "Great Firewall of China" operates, in part, by inspecting TCP packets for keywords that are to be blocked. If the keyword is present, TCP reset packets (viz: with the RST flag set) are sent to both endpoints of the connection, which then close. However, because the original packets are passed through the firewall unscathed, if the endpoints completely ignore the firewall's resets, then the connection will proceed unhindered. Once one connection has been blocked, the firewall makes further easy-to-evade attempts to block further connections from the same machine. This latter behaviour can be leveraged into a denial-of-service attack on third-party machines.

An Analysis of Internet Censorship Circumvention Techniques

“…In a stateless censoring system this technique can be used to block IP addresses of targets that are also subject to DNS tampering, so that if the client circumvents censorship in the DNS resolution phase it is caught on the first packet of the TCP handshake [23]. The trigger for this technique contains the destination IP address or of the target [24] and possibly the transport level port numbers, to limit censoring to a specific application such as HTTP, HTTPS, SSH; this requires a surveillance device on the path between the client and the target.…”

“…The most common types of online content blocking strategies include IP address blocking, DNS hijacking and content filtering such as keyword or URL blocking [26] [27]. IP address blocking operates by restricting users from accessing content by blocking the IP address where the content is hosted.…”

"Good" worms and human rights

“…Not surprisingly, the Great Firewall's filtering is not able to detect banned content in encrypted traffic; it is not possible for the Firewall to decrypt the traffic. However, it has been suggested that the Chinese government may eventually detect the presence of encrypted traffic [4]. Even if the traffic cannot be decrypted, a person detected using encryption software inside China may not be looked upon kindly.…”

“…• Fetch URLs containing forbidden terms from Chinese web servers [4]. This testing is based on the supposition that the Firewall's operation is symmetric, and censors the same material coming and going.…”

Liberouter: Towards autonomous neighborhood networking

“…The resulting system properties of our design are also relevant to people in countries with strong censorship mechanisms [3], [18], [6], and a risk of prosecution for those attempting to circumvent such mechanisms. The Liberouter framework presented in this paper should eventually become suitable for such applications as well, but our present focus is on enabling its autonomous operation.…”