Great Firewall Of China Cracked; But Why Tell Them?
July 5, 2006 (3 Responses)
COMPUTER EXPERTS from the University of Cambridge claim not only to have breached the Great Firewall of China, but they also say they have found a way to use the firewall to launch denial-of-service attacks against specific Internet Protocol addresses in the country too!
The firewall, which uses routers supplied by Cisco, works in part by inspecting Web traffic for certain keywords that the Chinese government wishes to censor, including political ideologies and groups it finds unacceptable. The researchers found that it was possible to circumvent the Chinese intrusion detection systems by ignoring the forged transmission control protocol resets injected by the Chinese routers, which would normally force the endpoints to abandon the connection.
“The machines in China allow data packets in and out, but send a burst of resets to shut connections if they spot particular keywords,” explained Richard Clayton of the University of Cambridge computer laboratory. “If you drop all the reset packets at both ends of the connection, which is relatively trivial to do, the Web page is transferred just fine.”
What kills me is that these geniuses then informed the Chinese government of the method used to breach the firewall in order to facilitate them to shore it up and - therefore - continue to censor the locals against using banned keywords or sites. It was bad enough when Google decided to condone and facilitate this censorship, but now we have these lads from Cambridge University enabling it to continue.
As it is the authorities in China are contemplating an edict which will fine foreign journalists if they file reports that the government doesn’t like. I know academics are sometimes ‘removed’ from the realities of what is going on, but seriously - are these lads so far removed that they cannot see they are helping to promote and enable censorship?
Actually, they only reported the denial of service (DoS) issue to CERT, who passed it on to CERT-CN. This is the proper and expected behaviour for security researchers.
They did NOT report the observation that discarding resets made the firewall ineffective. The only way that the Chinese government can find out about that is by reading sites like yours.
In fairness ZDNET Asia (as referenced in the post above) and many other sites have already broken this story, so I doubt that my little blog reference is going to make any major difference to the scenario.
Nice to see