Improving The Great Firewall of China

Thomas Ptacek | July 6th, 2006 | Filed Under: Defenses

I am ambivalent about Richard Clayton’s work on defeating “the Great Firewall of China”. I don’t see the novelty of the findings, I don’t agree with the conclusions he’s drawing, and I’m uncertain of the social value of the project.

1.

Some context. The People’s Republic of China (PRC) keyword-filters web content, like many other repressive countries around the world. Clayton, Steven Murdoch, and Robert Watson (of “Slipping in the Window” infamy) —- hereafter, “the Clayton group” —- have released a paper at the 6th Workshop on Privacy Enhancing Technologies in Cambridge. It attempts to deduce the architecture of the PRC content filters and purports to show them ineffective.

A synopsis: one mechanism (but not the only one) used by the PRC terminates connections with injected TCP RST packets. Your 15 second TCP refresher: RST packets abort connections, ostensibly because something has gone wrong. A host that receives an RST matching (by addresses and ports) a live connection —- with valid sequence numbers —- will close the connection. A man-in-the-middle can use RST packets to kill an unfavorable connection. The PRC uses RST packets to kill web requests about Falun Gong (among other things).

Since 1996, commercial Intrusion Detection Systems have used RST packets to kill “bad” connections without having to take responsibility for forwarding “good” connections. This is called “sniping”. The problem (and the crux of the Clayton group paper) is that sniping is discredited. Endpoints can make it hard, or even impossible, for an RST sniper to kill a connection. The paper shows one (particularly graceless) way to dodge a sniper (you can just filter RSTs). There are more effective ways. We refer you to a paper written in 1997 that covers the topic adequately.

2.

As you can probably tell, I’m not wild about the hype this paper is getting. The Clayton group wasn’t the first to notice that the PRC filters use RSTs. They documents a finding that is already a basic result in network monitoring research. But that’s not the only problem. I object to their claim that the PRC will have a hard time “closing” this hole.

The Clayton group dances around this in their own paper. Section 5.1, “Blocking With Confusion”, discusses techniques other than RST sniping that China can use to disrupt connections. But Clayton fails to spell out that the PRC sees the full contents of web sessions transiting the firewall. From that vantage point, the PRC can easily create arbitrarily disruptive, impossible-to-discriminate chaff packets. Furthermore, as fully-informed middle-men dealing with unencrypted traffic, the PRC control payload contents as well. I have more to say about this later. For now, we refer you to a paper written in 1995 that covers the technical details adequately.

The PRC can overcome the “attack” in the Clayton paper with a software upgrade. But even if I conceded that they can’t, I’d still dispute the claim that an architecture upgrade is difficult. For over four years I worked at Arbor Networks, which has deployed security technology on the backbones of virtually every tier-1 service provider in the world. I do not believe that the PRC objectives are particularly hard:

• They could implement SHUN-style “hard” IP filtering

• They can use routing updates to select “dissident” endpoints and route them to inline filters

• They can deploy appliances with TCAM-style header filtering at or near key aggregation points

• Inline content filtering will inevitably catch up to the most ambitious of the PRC’s censorship goals

Because the Chinese government, unconstrained by market forces, can indiscriminately filter, delay, or disrupt the traffic of any Chinese Internet user, including those not implicated in “contraband content”, the PRC face an easier problem than do service provider operators dealing with DDoS. My sense of it is that the Clayton group drastically underestimates the sophistication of modern backbone security. I’m bound by a myriad of NDAs. But I would not be surprised if other large “closed” networks were already a decade ahead of the PRC’s technology.

3.

My real problem with this paper runs deeper than any specific technical argument.

The Clayton group clearly believes in full disclosure. One of the paper’s co-authors reached for the brass ring of full disclosure in 2004, “disclosing” a vulnerability in Cisco routers that would enable attackers to kill BGP connections and disrupt Internet routing. The China paper is an exercise in full disclosure as well.

But to what end? The point of full disclosure is to improve security. Documenting security flaws is a tool for eliminating them. By writing papers about the “insecurity” of the PRC filters, the Clayton paper makes the PRC filters stronger. Clayton clearly believes that this is not the case, and that it is Hard to make a system like China’s reliable. On this topic, I worry that the Clayton group is ill-informed.

I’m not all that “up” on what the objectives of the Chinese government are with these filters. But, based on what we’ve learned about how they’ve worked, and what the industry (and, therefore, the PRC) knows about content filtering, let me take a wild guess: the Chinese don’t particularly care that it’s possible to evade their filters. They care about perception. The perception that their filters are sensible or competant is damaged by the Clayton group paper. But the Chinese are millions of dollars, not billions, away from repairing that perception.

Officials at the PRC are not the ones who will bear the burden of those repairs.

4.

So there’s that. But I think the problem is worse. Because the Clayton group paper is naive about the capabilities of an attacker with the vantage point of the PRC.

Like I said earlier, the PRC control not only the headers of the TCP packets they’re observing, but also their payloads. That’s because they can hijack connections. They can also detect dissidents who block RST packets. How can they do that? Why would I write that down here?

Clayton’s “attackers” evade the firewall by ignoring RST packets. But after doing so, they continue to read unencrypted packets over a clearly untrustworthy channel. This has implications in HTTP (where suspected dissidents can be coerced into following links to adversarial sites), as well as in other protocols. What are the implications to other protocols? Why would I write that down here?

There are a variety of things a smart Internet user can do, once their connection has been sniped by the Chinese filters, to continue communicating safely. Most of them are things that a smart Internet user should have been doing in the first place to communicate on a hostile network, and most of them “evade” the Chinese filters more effectively than the Clayton paper does. What are those things? Why would I write that down here?

I’ll tell you why I won’t right now. Because most of them (a) create lifelines of free communication with the outside world, and can be disrupted without much effort by a hostile service provider, and (b) are probably already being used by dissidents in China. When someone in China is arrested, taken away from their family, and held incommunicado for months, years, or decades without due process, I don’t want to feel any responsibility for helping that happen.

Am I wrong in this analysis? Probably. Please tell me how. Clayton’s paper spells out minor problems in an odious security solution imposed by an entity with all the resources required to make the Internet drastically less free for Chinese Internet users. I’m a full disclosure believer. And so I believe the Clayton group paper may help the PRC more than the cause of freedom.

[7/7 ed: I’m mistakenly citing Paul Watson’s RST paper, which Robert N.M. Watson, co-author of the Cambridge paper, has nothing to do with. I apologize.]