AT&T Tech Support 360
July 3, 2006 9:06 AM PDT
Academics break the Great Firewall of China
- Related Stories
-
Keeping an eye on MySpace
June 29, 2006 -
Youth centers grapple with MySpace
June 23, 2006 -
School filters vs. home proxies
May 3, 2006 -
Google in China: The big disconnect
April 21, 2006 -
China's Hu meets Gates as U.S. trip begins
April 18, 2006
The firewall, which uses routers supplied by Cisco Systems, works in part by inspecting Web traffic for certain keywords that the Chinese government wishes to censor, including political ideologies and groups it finds unacceptable.
The Cambridge research group tested the firewall by firing data packets containing the word "Falun" at it, a reference to the Falun Gong religious group, which is banned in China.
The researchers found that it was possible to circumvent the Chinese intrusion detection systems by ignoring the forged transmission control protocol resets injected by the Chinese routers, which would normally force the endpoints to abandon the connection.
"The machines in China allow data packets in and out, but send a burst of resets to shut connections if they spot particular keywords," explained Richard Clayton of the University of Cambridge computer laboratory. "If you drop all the reset packets at both ends of the connection, which is relatively trivial to do, the Web page is transferred just fine."
Clayton added that this means the Chinese firewall can be used to launch denial-of-service attacks against specific IP addresses within China, including those of the Chinese government itself.
The IDS uses a stateless server, which examines each data packet both going in and out of the firewall individually, unrelated to any previous request. By forging the source address of a packet containing a "sensitive" keyword, people could trigger the firewall to block access between source and destination addresses for up to an hour at a time.
If an attacker had identified the machines used by regional government offices, they could block access to Windows Update, or prevent Chinese embassies abroad from accessing specific Chinese Web content.
"Due to the design of the firewall, a single packet addressed from a high party official could block their Web access," said Clayton.
Even though this technique would block communication between only two particular points on the Internet, the researchers calculated that a lone attacker using a single dial-up connection could still generate a "reasonably effective" denial-of-service attack. If an attacker generated 100 triggering packets per second, and each packet caused 20 minutes of disruption, 120,000 pairs of endpoints could be prevented from communicating at any one time.
Clayton, speaking at the Sixth Workshop on Privacy Enhancing Technologies in Cambridge last week, said that the researchers had reported their findings to the Chinese Computer Emergency Response Team.
Tom Espiner of ZDNet UK reported from London.
See more CNET content tagged:
packet,
firewall,
denial of service,
computer expert,
China
Ooops. Redundancy here. Thieves and Commies are two faces of the same coin. With thieves being the more honorable face.
Ooops. Redundancy here. Thieves and Commies are two faces of the same coin. With thieves being the more honorable face.
By the way, if anyone sent you a script, there is a very good chance they just sent you a virus instead for being a wannabe script kiddie.
By the way, if anyone sent you a script, there is a very good chance they just sent you a virus instead for being a wannabe script kiddie.
Now stay in your bedroom and continue to be master of the universe / know it all.
Now stay in your bedroom and continue to be master of the universe / know it all.
Did you try to use it? If you have not proved that your DoS theory works, don't claim to the world like that.
To name one of the methods that I know and use to break through the firewall of China: use SSL Proxy tunnel.
This is no freaking news... heh!
Did you try to use it? If you have not proved that your DoS theory works, don't claim to the world like that.
To name one of the methods that I know and use to break through the firewall of China: use SSL Proxy tunnel.
This is no freaking news... heh!
Did you try to use it? If you have not proved that your DoS theory works, don't claim it to the world like that.
To name one of the methods that I know and use to break through the firewall of China: use SSL Proxy tunnel.
This is no freaking news... heh!
Did you try to use it? If you have not proved that your DoS theory works, don't claim it to the world like that.
To name one of the methods that I know and use to break through the firewall of China: use SSL Proxy tunnel.
This is no freaking news... heh!
Did you try to use it? If you have not proved that your DoS theory works, don't claim to the world like that.
To name one of the methods that I know and use to break through the firewall of China: use SSL Proxy tunnel.
This is no freaking news... heh!
Did you try to use it? If you have not proved that your DoS theory works, don't claim to the world like that.
To name one of the methods that I know and use to break through the firewall of China: use SSL Proxy tunnel.
This is no freaking news... heh!
- ah so much fun
-
by sirfragalot
July 4, 2006 7:14 AM PDT
- man how awsome would that be to take down chinas internet infastructure im sure a 1337 h4x0r and his buddys with drone computers could really do alot of damage but thats what you get for not being smart china
-
Reply to this comment
-
-
See all 32 Comments >>