Schneier on Security

Twofish • December 28, 2012 10:34 AM

What the Chinese government is doing is an incredibly clever bit of social engineering.

Rather than blocking all VPN’s which indeed would cause Western businesses to consider leaving, they appear to be leaving the VPN systems which large businesses use (IPSec) open. Also, the Chinese government also can figure out what IP addresses are used by large companies, and specifically not block those. However, not blocking corporate networks is not going to help “personal” users, because most large corporations have usage policies that prevent users from using their networks for personal purposes, and while a large corporation is going to complain loudly if their VPN’s are cut off for business reasons, most companies have policies that prevent their networks from being used for “political” purposes (i.e. try sending out a campaign flyer from a work account and see how fast you get a nasty call from HR).

The problem with “cryptography will get you free” is that cryptography is focused on the wrong problem. This isn’t a cryptography problem. It’s a traffic analysis/stenography/social engineering problem. The openvpn protocol is designed for preventing a hostile user from reading a message, but it obviously is not designed for preventing a hostile user from knowing that a message has been sent, and from cutting the connection completely. Even worse, the fact that large companies and individuals use different protocols (IPSec versus openvpn), allows the Chinese government from blocking individual users without blocking large companies.

One other thing that I’ve noticed is that the increasing use of broadband makes it harder to to stegnography. One thing that I’ve noticed is that the GFW is less aggressive at blocking text than it is at blocking video streams. Sending one e-mail and you can hide in the chatter. Sending a youtube video and its much harder to hide. Furthermore, broadband media is easier to block. If you want to send a 5kb e-mail, this is hard to block, but sending a 10GB video and you can degrade the service to the point that it is unusable.

Twofish • December 28, 2012 11:13 AM

Question: I wonder what the reaction of the central government will be if a foreign company stated they will pull their business out of China if they can’t communicate securely with their China operations.

Most likely they’ll unblock the ports for that company, and as long as the company uses the ports for internal corporate communications, no problem…… Now if that company starts using that network for non-corporate communications, they’ll be asked to stop, and if they don’t stop, they’ll be kicked out. But it’s a clever piece of social engineering, since most corporations frown on using corporate networks for personal use anyway.

One reason that I think this is what is going on is that corporations in China are allowed to connect directly with servers outside of China thereby completely bypassing the GFW in the first place. What corporations are not allowed to do is to set up shop as a telecommunications operator. I.e. if a company wants to bypass the GFW for its own internal use, it can do that, but if it starts selling or letting people outside the company use those services then it becomes an unlicensed telecom operator and it gets shut down.

This is the problem with VPN’s. A large enough company can (and many companies do) create a non-virtual private network, and as long as the physical private network is not shared, the Chinese government doesn’t block those.

Twofish • December 28, 2012 12:22 PM

Apologies for posting so much.

Part of the reason I’m doing this is that I’ve been really annoyed at the difficulty that the GFW has been causing me, so I’d like to provide as much information as possible so that people can figure out countermeasures.

A few observations:

1) Not everything is blocked. What gets blocked changes from day to day, but New York Times is blocked. Washington Post is not. Most Google searches are not blocked and Google maps are not blocked. Gmail is not blocked, but youtube and google chat is.

There seems to be an intentional effort to make the block “leaky.” I’m really annoyed and maybe a little angry about it, but I’m not so annoyed and angry that I’m going to join a street protest or leave China.

2) One thing that alarmed me before all of this happened was how easily people are willing to give you security for convenience. One thing that the Chinese government did a few months back was to encourage Chinese service providers to promote single sign on. The way that it works is that if you want to register for a new web service, you just type in your Chinese cell phone number and you are automatically registered. Once you are registered for one site, you can automatically transfer your registration to any other Chinese internet service.

The interesting thing from a social engineering point of view is that no one protests against this regulation, because in fact it does make the Chinese internet more convenient. Instead of spending ten minutes to register for a new website, you just type in a number, and you are done.

However, the security issue should be obvious. Not only can the Chinese government track down anyone to their mobile phone, but they can effectively prevent someone overseas from posting to a Chinese website. The only way you can post to a Chinese board is if you have an account linked to someone with a mobile phone in China.

3) Speaking of mobile phones. Smart phones are cool…. Find restaurants!!! Never get lost!!! Makes you want to carry your phone around where ever you go. But…..

Now, because every Chinese web service is now linked to a mobile phone, if someone posts something the Chinese government finds objectionable, they can now link that post to a mobile number. Once they have a mobile number, they can then figure out where that person has been in the last month, and everyone they have talked to.

4) Boycotts from Western companies will not work. The thing about boycotts from Western companies is that Chinese domestic companies just love them. Less competition. Every Western internet service has a Chinese equivalent. Many of them are less polished and less functional than the Western equivalent, but you can access them without gashing your teeth.

5) A lot of the technology that the Chinese government is using is based on corporate environments. What the Chinese government is doing is creating a giant intranet, so all of the technology that can be used to create corporate intranets can be deployed at a national scale. Also a lot of the “mental know how” that the Chinese government is using comes from the corporate world.

6) The internet was supposed to be impossible to control because it was supposedly decentralized. The problem is that once we got out of the “frontier era”, it turned out that centralization meant convenience. I remember the “good old days” when I had to run my own mail servers and I had my own http server. However, I use an ISP for that now. However, convenience means centralization, and centralization means choke points.

This is true even when the centralization happens in the West. It would be much hard for the Chinese government to block facebook or google if there were a thousand facebooks, twitters or googles. But because there is one facebook, one twitter, and one google, it makes it easier for the Chinese government to target a block against that one target, and to develop local equivalents to them. One reason it has been surprisingly easy for the Chinese government to target VPN providers is that there are only a few dozen of them, and they are running pretty similar technology.

I apologize for posting so much, but I figure that the more information i provide, the more people can figure out how to develop effective countermeasures.

Twofish • December 29, 2012 1:05 PM

It’s not so much apartheid as “indirect control.” The Chinese government allows corporate networks to bypass the GFW, because most corporations already have internal network policies that control traffic that is not business related.

Also, once you realize that what the Chinese government is doing with OpenVPN. It’s not hard for someone with some network knowledge think of some easy countermeasures. The problem with countermeasures is not that they won’t work, but they are hard to publicize. I can write a quick two page summarize of how to bypass the current measures. The trouble is that if any substantial number of people start using them, then it will get a lot of hits on google, and then the Chinese government will see it and then block those. It’s pretty easy to come up with some “home brew” ways of getting around the current blocks (look for foot covering that rhymes with blocks).

The problem is that I don’t see a way of publicizing that information.

What the Chinese government did in recent weeks was not to ban all encryption. What they basically did was to do a google search of “bypass Chinese firewall” and then put in a new system that targeted the top hits, and it’s gotten a lot of press because people were using the top methods for circumventing the GFW.

Anything that requires a requirements document and years of design is not going to work for me.

I suspect google searches are intentionally slow. The government doesn’t want to ban google, because if it bans google people will stop using it. What I think they’ve been doing is “degrading” the search so that video and audio becomes unusable. I also suspect that the reason they do this is that text is more easily filterable whereas video streams are not. Also, I think that the government really doesn’t want to drive political activity underground. If it starts using harsh measures and makes searches impossible, then people will start using TOR and strong encryption. That’s not want the Chinese government wants because if that happens, everything will go underground. So it makes gmail painful to use, but not so painful that people would want to install TOR.

The other thing is that I think people get the threat model wrong. For example, for something for be useful for me, I don’t need anonymity. I’m pretty sure that the Chinese government can track me down it they want to, and I don’t do anything on the network that would give them a reason to do this. Something that is useful for a political dissident would not be useful for someone that just wants to read the NYT, and vice versa.

One other thing is that a lot of “nice ideas” don’t work. For example, you might think that it would be good to have a lot of open proxy servers outside of China to let people bypass the GFW. The trouble with that is that if you have an open proxy server, you’ll find that almost no traffic consists of Chinese political dissidents.

Also, I don’t think that the Chinese government wants to “unplug the internet”. The thing that the Chinese government is concerned about is less to prevent information from getting in, than having people self-censor themselves. Again, there is a copy from the corporate world. I’m not going to send an e-mail about what I feel about the CEO from my corporate account. I don’t have any problem doing this from my gmail account, since I know that my boss doesn’t have access to my gmail account. In censoring the NYT, the goal of the Chinese government is not to prevent me from reading the NYT, its to just put in a psychological block so that I know “someone is watching” and I think about posting someone in public, and that prevents the internet from being used to search of “like minded individuals.”

One other thing is that I think that there is a reason why the blocks have gotten more effective over the last year. The Chinese bureaucracy works on a “conveyor belt” system. The top people retire, and then everyone below gets promoted. What I think happened in the last year are two things. The first is that some technically capable people just got promoted into being in charge of the GFW. The other is that there has been a generational shift in technology people in China. The people that graduated from CS departments in 1990 tended to be rather anti-government. However, since 1990, students in elite Chinese colleges have tended to consist of people that have benefited from the current system (often the kids of top party members). Whereas a network engineer in 1995 wouldn’t think of helping the government censor the internet, the Party has no shortage of very technically adept people working for them today, and that’s starting to show up.

Collier: And what will happen if the Chinese stop trusting IPSEC? Presently, the trend is toward less trust, so even the big shots may start to suffer financially from reduced connectivity.

I don’t think they will. Early on in the 1990’s, the Chinese government tried to ban all encryption and gave up because the backlash from business was too large, but if found that it didn’t need to do this. The Chinese government can “trust” businesses with encryption, because large businesses are for-profit entities and not political dissidents. Even the most free-speech oriented company is not going to let random people on their internal networks.