News for hackers. Stuff that matters.

A comment on China Tells Carriers to Block Access to Personal VPNs by February.

Re:China Tells Carriers to Block Access to Personal VPNs by ... by lngnmn on Tuesday July 11, 2017 @12:32AM (#14741591)
Time to get funds for 443 port vpn startups. ;)

Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by kbaker on Tuesday July 11, 2017 @12:49AM (#14741649)
Yes, it can. By watching the size and timing of flows with 'regular HTTPS' traffic vs 'VPN HTTPS' traffic, it can be distinguished.
[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by Ajedi32 on Tuesday July 11, 2017 @01:05AM (#14741695)
So write a program that emulates 'regular HTTPS' traffic patterns. On the technical side of things, I'm pretty sure the VPNs have the upper hand in this game of cat and mouse.
[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by dylz on Tuesday July 11, 2017 @01:47AM (#14741845)
GFW does not just inspect traffic, it actively probes server IP:ports looking for its responses, can replay packets you sent legitimately, and can impersonate IP addr behind GFW.

As in, it is not only a passive observer periodically resetting connections, it will also make its own to test the waters

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by ticoombs on Tuesday July 11, 2017 @04:07AM (#14742382)
I would love to see a write up about that. Got a source?
[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by jitl on Tuesday July 11, 2017 @05:45AM (#14742768)
Here's a few that I dug up from 15 mins of googling:

- In-Depth Analysis of the Great Firewall of China. Has other good sources at the bottom: http://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf

- How China is Blocking Tor: https://arxiv.org/abs/1204.0447

- Summary of "How China is Blocking Tor" from MIT Review: https://www.technologyreview.com/s/427413/how-china-blocks-t...

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by dylz on Tuesday July 11, 2017 @12:34PM (#14745567)
Some fun reads

https://www.cs.princeton.edu/~rensafi/projects/active-probin...

https://citizenlab.ca/wp-content/uploads/2009/10/ChinasGreat...

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by vacri on Tuesday July 11, 2017 @03:40AM (#14742269)
"Interesting - this user is downloading gigs of data from a single IP over https, and zero data from anywhere else"
[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by 77pt77 on Tuesday July 11, 2017 @08:01AM (#14743405)
This is all it takes.

No DPI needed.

Until this is circumvented there is no real solution.

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by schlipity on Tuesday July 11, 2017 @01:05AM (#14741694)
If you can calculate the difference, couldn't a VPN force their traffic to mimic that difference as well?
[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by Dylan16807 on Tuesday July 11, 2017 @02:16AM (#14741961)
You can't disguise an elephant as a mouse.
[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by lngnmn on Tuesday July 11, 2017 @05:27AM (#14742701)
It should be https-inside-https (or http2 or even plain TLS) scheme for multiple AWS IPs. A bit laggy but will do the job.

Wildcard blocking of these would break too many legitimate services, including banking, airlines, etc.

BTW, the task of DPI-ing of all https traffic on the operator side is intractable.

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by topranks on Tuesday July 11, 2017 @09:01AM (#14743769)
Yeah, like the ToR "meek" obfuscation method does.

https://trac.torproject.org/projects/tor/wiki/doc/meek

[ Parent | on HN ]
Re:China Tells Carriers to Block Access to Personal VPNs by ... by ilikeATMs on Tuesday July 11, 2017 @01:51AM (#14741868)
Statistical analysis of traffic flow in encrypted communications to determine the type of traffic has been done effectively. There was a paper a few years ago against VoIP protocols specifically.
[ Parent | on HN ]