Climbing China's Great Firewall
Total Page:16
File Type:pdf, Size:1020Kb
Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal Volume 5 Issue 2 Article 2 June 2018 Climbing China's Great Firewall Adam Casey University of Minnesota, Morris Follow this and additional works at: https://digitalcommons.morris.umn.edu/horizons Part of the Computer Sciences Commons Recommended Citation Casey, Adam (2018) "Climbing China's Great Firewall," Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal: Vol. 5 : Iss. 2 , Article 2. Available at: https://digitalcommons.morris.umn.edu/horizons/vol5/iss2/2 This Article is brought to you for free and open access by the Journals at University of Minnesota Morris Digital Well. It has been accepted for inclusion in Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal by an authorized editor of University of Minnesota Morris Digital Well. For more information, please contact [email protected]. Climbing China's Great Firewall Cover Page Footnote This work is licensed under the Creative Commons Attribution- NonCommercial-ShareAlike 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/ 4.0/. UMM CSci Senior Seminar Conference, April 2018 Morris, MN. This article is available in Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal: https://digitalcommons.morris.umn.edu/horizons/vol5/iss2/2 Casey: Climbing China's Great Firewall Climbing China’s Great Firewall Adam L. Casey Division of Science and Mathematics University of Minnesota, Morris Morris, Minnesota, USA 56267 [email protected] ABSTRACT 2. BACKGROUND Many different countries censor the internet within their In order to understand how circumvention techniques work state. Citizens frequently wish to avoid the state censor- a basic understanding of some internet protocols and con- ship. There are many different methods that have been de- cepts is required. In this section, background will first be veloped to achieve this. Governments and citizens are in a given on the basic frameworks of the internet. Also, back- constant arms race, with both developing opposing technolo- ground is given on the Transport Control Protocol (TCP). gies. China in particular has the largest population of peo- This background information is necessary to understand how ple on the planet, and the Chinese government attempts to INTANG circumvents the GFW. Information is also given censor the internet. This paper will investigate three meth- on Content Delivery Networks (CDNs). A foundation in ods of navigating around state censorship: Cachebrowser, this subject is necessary to understand how Cachebrowser INTANG and Tor. Cachebrowser and INTANG were devel- circumvents the GFW. An overview of Tor will also be given oped specifically to navigate around state censorship while in this section. Background on Tor is necessary to under- Tor was originally developed for anonymous browsing. This stand one of the most common ways of circumventing inter- paper will analyze their effectiveness and viability to avoid net censorship and to understand how the Chinese govern- censorship. ment attempts to stop Tor traffic. Keywords 2.1 Internet Basics In order to understand how the Chinese government cen- China, Great Firewall, Tor, CDNs, INTANG sors the internet and to understand the TCP protocol, first some internet frameworks must be explained. To begin with client and server roles need to be explained. When you make 1. INTRODUCTION a request to visit a website such as www.facebook.com your The largest group of people in the world with censored computer talks to the server for facebook. This is referred access to the internet is the population of China, with up- to as the server because the user makes a request and the wards of 1.3 billion people. The Chinese government still server serves the content to the user. The user in this case actively censors the internet through a system of network is referred to as the client. monitoring and network manipulation, referred to broadly Before the client actually makes a request to facebook.com as the Great Firewall of China (GFW) [11]. it needs to know how to get to it. Each server on the internet This paper will describe the methods and evaluate the has a unique address associated with it. This is called an IP success of three separate ways of evading the censorship address [10]. In order for the client to find the IP address for of the GFW. These methods are Cachebrowser, INTANG a server they are trying to access they must make a Domain and Tor. These methods each work in very different ways. Name System (DNS) request. This is done by making a Cachebrowser works by allowing the user to easily access request to a DNS server which has a list of IP addresses for uncensored versions of websites that are usually blocked by different websites in a cache. The client tells the DNS server accessing the cached versions of these sites that the Chinese the website they are trying to access. The server then sends government cannot feasibly block for reasons that will be the client the IP address of the website they are trying to discussed in section 3.1. INTANG works by manipulating access. Finally, the client can make a request to the server the internet traffic being sent by the user's machine directly they are trying to access and send data to it and the server to avoid censorship by manipulating packets which will be can send data back to the client. discussed in depth in section 3.2. Tor works by bouncing One way the Chinese government attempts to censor the the user's connection through multiple different nodes. This internet is by manipulating the records on DNS servers to makes it difficult to track. How the Chinese government return incorrect IPs for websites or to drop packets for re- probes for Tor servers will be discussed in section 3.3 quests to websites the government does not want clients to be able to access. This practice is referred to broadly as DNS poisoning [3]. This work is licensed under the Creative Commons Attribution- Another way the Chinese government attempts to censor NonCommercial-ShareAlike 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/4.0/. the internet is through a technique called IP address filtering UMM CSci Senior Seminar Conference, April 2018 Morris, MN. [5]. This is where the IP of the website you are trying to Published by University of Minnesota Morris Digital Well, 2018 1 Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal, Vol. 5, Iss. 2 [2018], Art. 2 Figure 1: Diagram of a TCP packet taken from [9]. access is blocked at the hardware level, usually on your home to this paper the relevant ones are SYN/ACK/FIN/RST. router. This is different from DNS poisoning because even The ACK flag indicates that the packet is an acknowledge- if we know the IP address of the website we are attempting ment packet. The RST flag indicates that the connection to access we cannot get to it. should be reset. The SYN flag indicates that sequence num- The final censorship technique that will be mentioned in bers should be synced. In practice this should only be used this paper is keyword censorship [11]. This is where the at the beginning of the connection process. The FIN (finish) Chinese government monitors the client's internet traffic and flag indicates that this is the last packet from the sender. will terminate connections with keywords the government Another important aspect of the TCP protocol to know has deemed sensitive. This is a way to block connections for this paper is Time to live (TTL). Each packet is given if the IP of the website is not blocked and its DNS records a TTL. The TTL indicates how long the packet will stay in have not been poisoned. the network before it destroys itself. This is useful so that Another concept that is necessary to understand circum- packets do not clog up network infrastructure forever if they vention techniques is the idea of a proxy, sometimes referred do not reach their intended destination. to as a proxy server [7]. A proxy is essentially a server that There are three main steps to transmitting data using the makes web requests for you. Instead of talking directly to TCP protocol. This first step is to establish the connection the server the client wants to access, it talks to a different using a handshake process. A connection is a link between server, which talks to the server the client wants to talk client and host where data can be sent freely between client to. Then the proxy server then takes the information the and server. Next the actual data is sent. Finally the con- intended server sent it and sends it back to the client. nection is terminated. Connection establishment is a multistage process. The first stage is when the user establishes a connection to the 2.2 The TCP Protocol server. Next the user sends a SYN (sync) packet to the Transport Control Protocol (TCP) [10] is one of the main server. Once the server receives this SYN packet it sends an internet standards. The main data structure of TCP is the ACK (Acknowledgement) packet back to the user along with packet. Data is sent in discrete pieces in order. One of these a SYN packet. The next step to establish data exchange pieces is referred to as packet. This order is maintained is for the user to send an ACK packet back to the server. by incrementing the sequence number with each new packet After this process has been completed regular data transfer that is sent.