home

Great Firewall Filtering Revealed

Researchers at the University of Cambridge have done some analysis on how the PRC’s Great Firewall (GFW) handles the “blocking” or interruption of web page loading midstream when it detects sensitive keywords related to the day after June 3 and certain religious groups. What they discovered is quite surprising, because it indicates that the mechanism is simple, clever, but at the same time, quite straighforward to circumvent. Read on for a layman’s explanation of the technical paper.

For the non-techie, the simple explanation is that the GFW sends a “TCP reset” packet to both the web server supplying the suspicious page and to the client (ie. your computer) loading it. It’s the equivalent of an “emergency stop” packet usually reserved for situations of bad connectivity so that both sides know to disconnect abruptly.

It appears the GFW in PRC cleverly uses this technique so that it can stymie the loading of pages, and so it does not have to actively make subsequent decisions to drop packets by correlating them to previous ones. In techie terms, having to store the history of what has been sent and received is called “state information” as in the technical state of affairs the router must accumulate. (This is not to be confused with State information as with “state secrets” or “enemies of the state”!)

I say it is clever, because this means you need far fewer computers, processing power and memory to implement effective blocking. In fact, GFW operators could use off-the shelf Cisco (or whatever) routers with no modified firmware whatsoever, and just have a set of machines sit on the side detecting keywords, and sending out “TCP resets.” Simple, effective, and with a low impact for network engineering.

Well the researchers realized that because this “TCP reset” was the sole mechanism for cutting off loading the content, the page information (including sensitive information and all) was still being sent through all the way to your client computer in the PRC! But because of the “TCP reset,” the client was simply shutting down reception of such packets so the Web browser never got the content. That is, they were actually travelling down the cable (or over Wifi) to your locale in the PRC, but the computer was ignoring them.

So in their tests, they said – what if we simply instructed the computer to ignore the “TCP reset” and keep loading. Would it work? The answer is: yes. From their blog:

…the keyword detection is not actually being done in large routers on the borders of the Chinese networks, but in nearby subsidiary machines. When these machines detect the keyword, they do not actually prevent the packet containing the keyword from passing through the main router (this would be horribly complicated to achieve and still allow the router to run at the necessary speed). Instead, these subsiduary machines generate a series of TCP reset packets, which are sent to each end of the connection. When the resets arrive, the end-points assume they are genuine requests from the other end to close the connection — and obey. Hence the censorship occurs.

However, because the original packets are passed through the firewall unscathed, if both of the endpoints were to completely ignore the firewall’s reset packets, then the connection will proceed unhindered! We’ve done some real experiments on this — and it works just fine!! Think of it as the Harry Potter approach to the Great Firewall — just shut your eyes and walk onto Platform 9¾.

Cool results. One problem – you need both the Web server and the client to ignore “TCP reset” packets to make this workaround effective. The researchers have suggested that making this behavior modification to the “TCP/IP stack” of networking code in routers and operating systems was desirable anyway, and they’re probably right. But that’s quite a tall order to get Microsoft, Apple, Palm, Symbian, and all the other folks with IP networking in their OSes to change. (But interestingly, with open source software like Linux, a patch and recompile of the kernel to do this is quite simple.)

Nevertheless, this does provide some insight into how the GFW manages to be effective in keyword blocking given how much traffic the PRC Internet chokepoints have to handle. It’s the network filtering equivalent of Occam’s Razor – the simplest and most straightforward (and low impact) implementation is the most likely.

Researcher Richard Clayton was hopeful about the impact of this discovery:

…the key point is that changing the TCP/IP stacks to ignore the firewall is almost a no-brainer for the vendor. There are excellent technical reasons for discarding the firewall’s resets as a matter of course. If stack builders did this as standard, then an entire Great Firewall of China mechanism entirely fails to work. That can only, in my view, be a good result.

[Hat tip to: Bruce Schneier]

Related posts:

  • CNN Appearance with Campbell Brown
  • Tom-Skype Filtering Results
  • Effective Censorship

    • This entry was posted on Tuesday, June 27th, 2006 at 7:08 pm and is filed under China, GFW, Technology. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

    13 Responses to “Great Firewall Filtering Revealed”

    1. ha.ckers.org security lab - Archive » Corporate laptop security
      June 29th, 2006 09:29
      1

      [...] Sure you can encrypt the drive, you can install firewalls, web application firewalls, and anti-virus, but can you protect it from spyware? Lots of spyware is not detected by anti-virus for some reason (to this day, I really don’t get why). Instead they sell different products which are not standard, or worse, let the user fend for themselves. So they end up downloading stuff like Microsoft’s Defender or Ad-aware (if they know to be paranoid about it). I haven’t yet seen one corporate laptop with anti-spyware installed by default for users. [...]

    2. 混血儿 [Rice Cracker] » Back in action + Secrets of the GFW revealed
      July 1st, 2006 02:14
      2

      [...] While it probably doesn’t clear up the Rice Cracker story, some good firewall-related news out of England: Researchers at Cambridge have reportedly discovered how China accomplishes automatic blocking of web pages that contain counterrevolutionary keywords. Andrew Lih, a new media researcher at the University of Hong Kong, explains it in lay terms: …the simple explanation is that the GFW sends a “TCP reset” packet to both the web server supplying the suspicious page and to the client (ie. your computer) loading it. It’s the equivalent of an “emergency stop” packet usually reserved for situations of bad connectivity so that both sides know to disconnect abruptly. [...]

    3. links for 2006-07-02, by John Biesnecker
      July 5th, 2006 22:50
      3

      [...] Andrew Lih » Blog Archive » Great Firewall Filtering Revealed (tags: china internet censorship GFW) [...]

    4. Global Voices Online » China: One Olympics, One Voice?
      August 9th, 2007 13:41
      4

      [...] Also yesterday, moogee at ProState reposted the open letter mentioned above, receiving these comments: [匿名] 2nd [61.48.43.*] @ 2007-8-8 19:49:18 顶! w00t! [匿名] asdf [124.116.187.*] @ 2007-8-8 20:12:29 签名的都是敏感词 All the names are sensitive keywords [匿名] 老碗 [219.153.130.*] @ 2007-8-8 20:23:53 很有勇气，但是实在不好意思，而且也很不希望说，没有任何用处。至少我个人对那些什么＊＊＊先生已经不抱任何信心了。 So brave, but it’s also a bit embarrassing and, I really don’t want to say this but, completely useless. At least I personally have lost faith in those xxx guys. [匿名] 。。。 [58.83.196.*] @ 2007-8-8 20:29:52 名单上的各位保重啊 Everyone on the list, please take care. [匿名] 大SB [121.10.148.*] @ 2007-8-8 20:48:18 真是一群大SB!广东人说:鸡同鸭讲。 有用吗？奥你妈的运！ They’re all a bunch of idiots! In Cantonese we say: the ducks talk and chickens agree. Is this of any use? Fuck the Olympics! [匿名] rock [59.49.19.*] @ 2007-8-8 21:05:48 [匿名] 老碗 [219.153.130.*] @ 2007-8-8 20:23:53 很有勇气，但是实在不好意思，而且也很不希望说，没有任何用处。至少我个人对那些什么＊＊＊先生已经不抱任何信心了。 ************ 如果你认为没有用的话，那正好成全了官家。 肯定有用的，做和不做，显然是不同的。 践行量变，期待质变。 “So brave, but it’s also a bit embarrassing and, I really don’t want to say this but, completely useless. At least I personally have lost faith in those xxx guys.” ——if you think it’s useless, you should go become a government official Of course it’s useful, there’s an obvious difference between if they’d done this and if they hadn’t. [We must] implement quantitative change, hope for qualititive change. [匿名] 支持 [210.72.218.*] @ 2007-8-8 21:10:08 终于在奥运中听到了人话，感受到还活在人间 什么都是要实际行动才能争取的，只停留在想和骂才是真的傻，和懦 I finally hear humans speaking about the Olympics; it feels like I’m among the living again Everything is only won through practical implementation; stopping merely at thinking and cursing is the real stupidity. [匿名] js [60.187.235.*] @ 2007-8-8 22:02:21 开奥运会给共党脸上贴金。 Hosting the Olympics is going to give the Party gold face plating [匿名] 二哥 [121.204.49.*] @ 2007-8-9 2:32:25 操你妈B，罗永浩，连岳为什么没签？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？ Fuck you Luo Yonghao and Lian Yue, why didn’t you sign it??????????????? [匿名] iamlifeiamlife [218.58.62.*] @ 2007-8-9 10:29:43 来人啊，坦克伺候！ Come on y’all, the tanks are waiting! [匿名] 圣人本尊 [211.101.49.*] @ 2007-8-9 10:43:21 如果找我签名，我绝对不签 我从来不参与这种活动，因为我从来就不对共匪抱任何幻想！ 要想获得平等、自由和民主， 你不能靠共匪的怜悯 你只有日翻共匪才行，只有把他们这群劣质统治者赶下台才行 骂了个比的共匪 If they’d asked me to sign, I absolutely would’ve refused I never participate in these sorts of activities, because I’ve never harbored any fantasies whatsoever about the Commie bandits! If you want to earn equality, freedom and democracy You can’t rely on sympathy from the Commie bandits All you can do is overthrow them, get these twisted tyrants out of power Bloody Commie bandits Share This [...]

    5. epuwuwk
      May 31st, 2008 08:05
      5

      I stopped and vaginal fisting me goto her stay, blonde, i was stuck in california.

    6. qerzekaz
      June 12th, 2008 06:45
      6

      Carrie lapped up my back, they talked, the rest of dread andexcitement. shakira sex Rhianna noticed he.

    7. licking
      July 20th, 2008 03:28
      7

      asslicking

    8. kgorgyw
      September 5th, 2008 13:29
      8

      emma watson panties

    9. atqitipren
      September 16th, 2008 06:37
      9

      straight teeth oakland

    10. filoqlo
      September 21st, 2008 16:24
      10

      Please not mujeres lesbianas desnudas mujeres sohard. Put them angled more than anything and uncle here.

    11. The Great Firewall of China » The Last Stand | The Houseband
      February 27th, 2009 01:19
      11

      [...] Andrew Lih » Great Firewall Filtering Revealed [...]

    12. Queen
      November 6th, 2009 19:04
      12

      There was once great china wall – visible even from the Moon. Now they invented Great China Firewall. But I discovered Skydur.com – it goes through the wall and I can access all my favorite sites again – youtube, twitter, facebook and hulu ! It’s just about $5 per month but if you signup for the whole year they offer 10% discount – http://www.skydur.com

    13. Israel yonah
      January 11th, 2010 01:27
      13

      Are there any new firms developing antivirus firewall applications? The old ones are not that good

    Leave a Reply

    « Maxthon browser in China
    Chinapol Boot »