The great firewall of China



The great firewall of China may be just an illusion in technical terms. This article describes the details of how things work…. Basically when “banned content” is detected, both ends of the connection are sent a flood of tcp reset packets. Which (if both sides are designed to pay attention to) means that the two computers “hang up” assuming the other side reset the connection. But, while most current PC operating systems obey the reset packets…. it’s not something that is imperative. (You might think of this as a targeted/surgical denial of service attack using TCP reset packets…) The article goes a bit deeper though….


What if the pcs ignored reset packets…. yes they could. There’s no rule that a tcp stack HAS to obey a reset packet. IF the packets were ignored the firewall would turn out to be nothing more than an illusion technically speaking. Because the pcs on either end would continue communicating. Essentially ALL the packets are passing through the “firewall” unhindered, the resets are just being used to target and force the endpoints to drop “unwanted” connections.

From the article…

Ignoring resets is trivial to achieve by applying simple firewall rules… and has no significant effect on ordinary working. If you want to be a little more clever you can examine the hop count (TTL) in the reset packets and determine whether the values are consistent with them arriving from the far end, or if the value indicates they have come from the intervening censorship device. We would argue that there is much to commend examining TTL values when considering defences against denial-of-service attacks using reset packets. Having operating system vendors provide this new functionality as standard would also be of practical use because Chinese citizens would not need to run special firewall-busting code (which the authorities might attempt to outlaw) but just off-the-shelf software (which they would necessarily tolerate).

Of course, there are OTHER blocks that the Chinese government has on sites, but according to the writeup, these static blocks are more expensive (tedious) to setup and maintain. So this method would not work for everything.

Related Posts

Blog Traffic Exchange Related Posts
  • Computer security software nets $2.6 Billion over last two years. SecurityFix is talking about the computer security industry. Further, computer users spend $9 billion a year on computers repairs from spyware and antivirus. This reminds me of a recent story of a man that threw out a perfectly good machine because it was infested with spyware. For starters, I do......
  • UDP problem... I found a peculiar problem while I was setting up an openvpn link the other day. The goal was a simple shared key setup and I started with the sample configuration and modified it a bit to fit the circumstances, I allowed the correct UDP port through the firewall (I......
  • Services.exe running at 100% CPU and using 100s of MB of memory - Windows XP SP3 I came across an interesting one in the last few days. This system was a Windows XP system with current updates - SP3, IE 8.... and among other things there was a complaint of very sluggish behavior. I updated the antimalware software installed and ran scans. Malware Bytes antimalware actually......
Blog Traffic Exchange Related Websites
  • October Issue of BSD Magazine is Out! ARTICLES IN THIS ISSUE: iXsystems Announces Release of FreeNAS™ Version 8.0.1 Josh Paetzel Release features back end changes and bugfixes, as well as new front end user features More... Configuring a FreeBSD Stealth Logging Server Michael Shirk The collection of log files provides security administrators with the ability to have......
  • Taking Your Online Business Up A Notch Running your online company is not the same thing as helping it grow. Everyone is capable of starting a business but helping it go somewhere good is something not everyone can do. There are so many simple things that you can do to help you grow your business but most......
  • Wireless Internet Radios The Internet really is a fantastic place – everything there at our fingertips for us to use as and when. This is the case with Internet radio. It’s great – you can listen to stations from all over the world or perhaps even small local radio stations that are only......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site