Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
China Censorship Privacy The Internet

China Tells Carriers To Block Access to Personal VPNs By February (bloomberg.com) 173

China's government has told telecommunications carriers to block individuals' access to virtual private networks by Feb. 1, people familiar with the matter said, thereby shutting a major window to the global internet. From a report: Beijing has ordered state-run telecommunications firms, which include China Mobile, China Unicom and China Telecom, to bar people from using VPNs, services that skirt censorship restrictions by routing web traffic abroad, the people said, asking not to be identified talking about private government directives. The clampdown will shutter one of the main ways in which people both local and foreign still manage to access the global, unfiltered web on a daily basis. China has one of the world's most restrictive internet regimes, tightly policed by a coterie of government regulators intent on suppressing dissent to preserve social stability. In keeping with President Xi Jinping's "cyber sovereignty" campaign, the government now appears to be cracking down on loopholes around the Great Firewall, a system that blocks information sources from Twitter and Facebook to news websites such as the New York Times and others.
This discussion has been archived. No new comments can be posted.

China Tells Carriers To Block Access to Personal VPNs By February

Comments Filter:
  • Business VPNs (Score:5, Interesting)

    by Midnight Thunder ( 17205 ) on Monday July 10, 2017 @12:46PM (#54779303) Homepage Journal

    How will business users be impacted, since they will typically need to use a VPN if working remotely?

    At the same time I wonder how long it will be before the mouse works out how camouflage the VPN access? It really is a cat and mouse arms race.

    • Re:Business VPNs (Score:5, Informative)

      by CastrTroy ( 595695 ) on Monday July 10, 2017 @01:12PM (#54779477) Homepage

      Also, if they block VPNs, then the people will just start tunnelling over SSH. Can they block all VPN an SSH connections? That would basically disable a huge portion of the internet.

      • Also, if they block VPNs, then the people will just start tunnelling over SSH. Can they block all VPN an SSH connections? That would basically disable a huge portion of the internet.

        They don't have to. They just put you in jail or worse you if they catch you using a VPN.

        • by Austerity Empowers ( 669817 ) on Monday July 10, 2017 @01:40PM (#54779759)

          Any Chinese person I know would scoff at that threat, only Americans are so dedicated to law and order. Breaking the law is a way of life in many places (and in some places in the US, ask any NYer).

          Yes, it's still illegal and if they decide to come after you, you are totally in trouble, and this is a horrible oppressive regime we really ought to hate and stop doing business with. But the reason the regime stays in power, and the reason it has managed to become successful in spite of itself, is because it is impotent and corrupt in all the right places. If their government were to ever fix that, and effectively police itself, I imagine the people would revolt in mere days and they wouldn't need the "free" world to tell them anything.

          • Any Chinese person I know would scoff at that threat, only Americans are so dedicated to law and order.

            Americans aren't the ones with the giant firewall. (Our government is more subtly evil in how it spys on us) You seem to have missed the point. The point isn't that the Chinese government will catch everyone, merely that they will deter VPNs through threats of jail and/or other punishment. I'm sure lots of people will ignore the laws but the stakes just got higher.

            Breaking the law is a way of life in many places (and in some places in the US, ask any NYer).

            Every citizen breaks the law dozens of times a day. Nevertheless the punishments for some "crimes" are much harsher depending on the local

          • I'm told they will not come after you as long as you are quiet about it. If you VPN to Facebook and start vociferously criticizing the Chinese government, look out. But they don't care about cat pictures.
        • The only way they could identify offenders would be through targeted or incidental collection -- spyware on an endpoint, or a laptop search at customs. In either of those cases, though, the VPN use itself would likely be the least of the offenses they would be concerned about, and they wouldn't expose their capabilities simply to prosecute VPN usage, but rather the underlying information that was transmitted or received. It's really a law without teeth.

          • by arth1 ( 260657 )

            The only way they could identify offenders would be through targeted or incidental collection -- spyware on an endpoint, or a laptop search at customs.

            No, traffic pattern analysis is good enough to identify most VPN traffic. You don't have to identify what's in the traffic, just that it's overwhelmingly likely to be VPN traffic, and then you can go after the endpoints.

      • by s.petry ( 762400 )

        China does not allow access to that huge portion of the internet. That is the whole point of their great firewall. Not protecting citizens from bad memes and crude jokes, but protecting themselves from dissenting views being visible to their people.

        This is how authoritarian regimes work, and nobody should be surprised. It's a great reminder for the rest of us, for when our whackadoodle politicians start claiming they want control.

        • Re:Business VPNs (Score:5, Interesting)

          by Bob the Super Hamste ( 1152367 ) on Monday July 10, 2017 @03:51PM (#54780629) Homepage

          Not protecting citizens from bad memes and crude jokes, but protecting themselves from dissenting views being visible to their people.

          Which is why I now like to ask the people working in calls centers in China when they call trying to scam me:
          If they are aware of the book sellers in Hong Kong that have turned up in mainland Chines jails
          If they know that Tibet was a sovereign nation until it was invaded and now its native population is being replaced.
          If they are aware of the Uyghur issues
          Asking if they know about the June 4th incident or the student protest of 1989 in Tienanmen Square.
          Personally I am hoping to get the Chines government to shut down these scam call centers by bringing up issues it doesn't want discussed [wikipedia.org] as there is a whole list of things one can bring up. Anything else is a side benefit.

          • by cciRRus ( 889392 )
            We get many such scam calls from China, but all of them are in Mandarin. I'm just wondering they have upgraded themselves to speak to you in English.
      • by danlor ( 309557 )

        Not only can they... They currently do. You would not believe how much it costs me to work around this, and how little I get in return. It would shock you even more to see how valuable it is.

      • by Aaden42 ( 198257 )

        Both SSH and all standard VPN traffic is distinguishable from unencrypted HTTP, SSL/TLS, and other traffic types. You need firewall gear that examines things like packet size & frequency, but the detection is reliable and fairly quick. It's not a complete block the way you can block an IP address or port from starting a connection in the first place. Within a few seconds of opening the connection, the traffic type is detected and the connection reset.

        Add a little analytics to determine source or dest

    • They very obviously want to tap in to all business communications as well, so much the easier to steal industrial secrets.
    • I think we have the same term being used for two completely different things. It's technically possible ISPs will go overboard and ban both "VPNs - commercial services offering proxies" and "VPNs - connections to business's private networks", but it'd be a little like Congress deciding to take action on "Hackers" by passing a law banning IP spoofing, exploiting stack overflows, and the sale of axes and machetes.

    • I work for a business with offices in China, and the users there VPN into the local office then use the WAN to the US. They could do the same for Internet by using the US side proxies instead of the China side. AFAIK there aren't any blocks or monitors over that path, it's all encrypted by the business. I have always felt the "great firewall" was more about protectionism for Chinese companies than any expectation of a viable information wall.
  • by Anonymous Coward

    President Xi should study his people's history. Every dynasty eventually loses the 'mandate of heaven'.

    • President Xi should study his people's history. Every dynasty eventually loses the 'mandate of heaven'.

      Exactly my point. [slashdot.org]

    • But Broken Sword may convince Nameless that President Xi should not die...

    • President Xi should study his people's history. Every dynasty eventually loses the 'mandate of heaven'.

      Happens in all civilisations. So what do you expect Xi to do - say "OMG, I never knew that!", and top himself?

  • by Oswald McWeany ( 2428506 ) on Monday July 10, 2017 @12:49PM (#54779311)

    The biggest surprise here is that this loophole hadn't been closed down years ago.

    • Chinese leadership is getting desperate, losing contact with what is and isn't technically possible.

      They will be playing 'whack a mole' until they 'declare victory' and give up.

      • by Anonymous Coward

        You obviously don't know how harmful communism is.

        • Communism isn't harmful. Singlular control of all resources is harmful. Restriction of ideas and speech is harmful.

          Also nationalizing companies is also harmful. The same way monopolies are harmful. But limiting choices you let scum rise to the top and pollute the structure.

          So governments can tax corporate profits but shouldn't get direct benefits other than taxation. That way other companies can come and go and losing one company won't break the country. See Venezuela and all other dictatorships were nati

        • by dddux ( 3656447 )
          What communism? Where? You mean China?! LOL That's not communism at all. There's no true communism anywhere on this planet and there never has been. Only capitalism and totalitarianism in modern times. Do you also still think Russia is a communist country? To much Fox news and bad movies, dude.
      • It doesn't matter if it is technically possible. The way Chinese government works is they make massive amounts of things illegal but only enforce the law when they want to shut up a dissident. The pro democracy journalist will end up with 10 crimes and 10 years behind bars while a regular joe never gets prosecuted.
    • The biggest surprise here is that this loophole hadn't been closed down years ago.

      Since the concept of connecting to a private network and alt-routing around infrastructure has existed since the days of dial-up concentrators, I'd say this delay is more political than anything.

    • China has been going after and is already blocking lots of VPN services. But of course all the time new such servers will pop up, new domain name, new IP address, and the mainlanders have their connection back.

      How will they ever be able to block all VPN connections? They could of course start by blocking some common ip ports, but there's nothing stopping people from using a different port, e.g. port 80, and we're back to situation we have now, where they have to go hunt down server after server.

      • They can do deep packet inspection and detect protocols, but it can be stopped by tunneling via some other protocol that can't be disabled, such as ssh or https. They can go for vpn services, but it's relatively easy to make new one after previous were shut down.
        • I thought VPN is encrypted pretty much by default already, making it hard to detect.

          OK, maybe I used a wrong example with port 80 (http - unencrypted - can be inspected indeed), make that 443 (https). The outside observer can only see which IP it goes to, with no way to figure out what the content of the transmission is. With the world moving to https everywhere it's going to be hard to block that port. It'd also be an issue for all the local services that rely on encryption to remain safe.

          • by Strider- ( 39683 )

            You don't need to know the content, you just do traffic analysis. A "Normal" https connection has a certain traffic distribution/fingerprint. An SSL connection is setup between the client and server, the http request is made, the content/object delivered, and the connection torn down.

            SSL VPNs, even if operating over proper https and port 443, behave very differently. The connection is held open for long periods of time, and there is much more back and forth between the client and the server, as all further

          • I thought VPN is encrypted pretty much by default already, making it hard to detect.

            You meant: making it easier to detect, right?

            For all the plaintext connections, you can examine them and rule them out. (Countermeasure: hide your steganographic VPN here, so it gets ruled out. Downside: low bandwidth.)

            Then all the remaining connections, you can't look at the contents but you can see if they happen to just keep talking to this one possible-VPN-endpoint all the time. Ah, this guy seems sshed to his linode a

            • Yes I know I used the wrong example with unencrypted port 80. More and more web traffic moves to encrypted traffic fast.

        • ssh can easily be blocked to the "outside." Pretty much any way you try to tunnel can be detected with traffic analysis, and it is a pain in the ass when you simply can't work. I had issues in Hong Kong a few years back when a VVIP was visiting and I was caught off guard.
          • by Anonymous Coward

            ssh can easily be blocked to the "outside." Pretty much any way you try to tunnel can be detected with traffic analysis

            Indeed. Although I don't know any examples of countries that have done this, it would be fairly easy to set up a nation-wide ssh permit system. By default, the ssh protocol could be blocked by the national firewall. But if some business executives needed to ssh to a server outside the country, then the business could apply for a special permit to allow ssh traffic to that one specific server.

            Of course, a national firewall won't stop satellite internet connections, such as Inmarsat. And it's unlikely tha

  • by Anonymous Coward

    Whenever something unpleasant happens to human rights online, a lot of people shout, "Just use a VPN, and all your problems are solved!"

    In a small way, they're not wrong. But this misses the big picture: VPNs are few and easy for centralized authorities to block. The ultimate answer cannot be narrow and fragile circumvention measures. It has to be a robust, decentralized, and authoritarian-resistant internet architecture. It needs to be all-or-nothing: either authoritarians block the entire internet, or

    • Re: (Score:3, Insightful)

      by HornWumpus ( 783565 )

      You don't know how VPNs work? Unless China bans all encrypted connections to the outside world, this will do exactly fuckall.

      I'm pretty confident that China has long since set it up so 'everybody's a criminal', same as the 'western world', so that's not in play.

      • by Anonymous Coward

        You don't know how VPNs work? Unless China bans all encrypted connections to the outside world

        No. They only have to ban connections to the VPN services, which are relatively few and well known IP ranges. It's just like some US companies or web forums will ban those ranges for incoming connections. If they can do it, China can also do it.

        • How many Chinese people in the west with broadband connections? They will provide routing for relatives if they have to. You'll see them tunneling through gaming servers (which will piss the gamers off).

          There are already a _buttload_ of VPN services. IP banning will be a never ending, rarely working game of 'whack-a-mole'. With lots of potential for fucking with China by baiting them into banning important hosts.

          • by guises ( 2423402 )
            Netflix is employing this approach right now quite effectively, most VPN services have given up on supporting Netflix for this reason.

            The fact that some Chinese families have relatives abroad and will jump through a lot of hoops to get around this is irrelevant. It doesn't have to work perfectly to be effective.
      • by Strider- ( 39683 )

        You don't know how VPNs work? Unless China bans all encrypted connections to the outside world, this will do exactly fuckall.

        Assuming you have DPI capabilities, which I presume the Chinese government has, it's pretty trivial to block the normal VPN mechanisms without affecting other encrypted traffic. VPN (and SSL VPN) connections behave very differently from your typical connection to an https website. You basically just do traffic analysis and look for, say, SSL connections that have been open for more than 15 minutes, those where there has been more client sourced traffic than your typical http get, or whatever other thing tha

  • by Anonymous Coward on Monday July 10, 2017 @01:03PM (#54779405)

    Network engineer here. My theory is that any blocking attempt where the users seek to avoid being blocked is doomed to fail unless literally no traffic of any kind (even DNS etc.) is allowed through. This is because all serious network kit uses ASICs to achieve acceptable performance at the cost of flexibility, but all the endpoints are CPUs that are inherently flexible. If the users have an orchestration system that allows the developers to change the protocols as and when, and they play to the weaknesses of ASICS, the network vendors will never be able to keep up. Anytime you let any traffic through whatsoever between two parties you don't fully control, it's game over for your perimeter. Hurray!

    • by Anonymous Coward

      "orchestration system"? What on earth are you talking about, that won't solve anything.

      Real System Engineer here, this has already been happening for years. China can and does block VPN users, it's just they don't have a complete crackdown on it yet. We _do_ have employees in China who are kept behind internal walled gardens due to that.

      In case anyone else has been asleep the last 10 years, VPNs are very easily detectable, as is SSH. The problem is with the initial exchange, it's all in clear. Try it

    • You don't have to block 100% of the traffic. Just 5-10% (with logging) can be a sufficient deterrent. About the only way around it is a peer-to-peer network on both sides of the firewall where the amount of external data transfer is limited, but they don't necessarily need to allow local VPN traffic either.
  • by Idisagree ( 4302481 ) on Monday July 10, 2017 @01:06PM (#54779431)

    ...what are they afraid of them learning on the open internet?

    • ...what are they afraid of them learning on the open internet?

      It's a phobia that is similar to the frothing at the mouth defenders of the US Constitution's second amendment. They feel if they give even an inch that it will become an unstoppable force that ultimately destroys them thus they must not let up in allowing even the most minor of concessions. People can be reasonable but some individuals just aren't.

    • ...what are they afraid of them learning on the open internet?

      All kinds of things. But they are actually more afraid, believe it or not, of the power of social media to encourage wild cat demonstrations against the government. The main job of the CCP (Chinese Communist Party) is not really to make China better. They do want to do that, but the main job is to protect the CCP itself at any cost. Did you know that the Chinese constitution (yes, they have one) actually has something in it pledging the military (so called People's Liberation Army) to protect the CCP?

      • by Anonymous Coward

        As a frequent traveller in China :

        1) Incorrect for the people I deal with
        2) As above
        3) To some extent, but it is still discussed
        4) Taiwan is a funny thing, but I discussed it many times, and the locals seems well informed. ( I am often in Xiamen, very close to Taiwan - in viewing distance...)

        BTW: All major hotels in China has their own VPNs, so I can access EVERYTHING when on the hotel network. Be it in Shenzhen, Qingdao, Xiamen or Ningbo....

        I will wait to see this go away.....Wont happen....

  • "The government now appears to be cracking down on loopholes around the Great Firewall, a system that blocks information sources from Twitter and Facebook to news websites such as the New York Times and others."


    So China is protecting itself against communist, leftist, progressive, NWO fake news? Are they "MACA" (Making China Great Again)?

    As for the inevitable snowflake trolls that will moderate this down - Are you familiar with the concept of self-fornication?
  • China is playing an open-ended game of Whack-a-Mole with it's citizens, with the global Internet as the venue. It's obvious that Chinese citizens want free and unfettered access to the Internet and all the information on it. The communist Chinese government can keep trying to deny them, but just like with copy protection schemes, DRM, and all other censorship-like things, people will find a way around it.

    Memo to Communist Chinese government: You can't stop the signal. You're going to fail; it's inevitab
    • by Anonymous Coward

      The Signal doesn't exist on its own, it's produced by people. Kill enough people, and eventually the Chilling Effect will Stop The Signal, long before you run out of people.

      • Yeah, because Bashar al-Assad has such a bright, wonderful reputation with the rest of the world right now, or did you not understand what I said above? You don't win Hearts and Minds by slaughtering your citizens, and so far as I'm concerned any regime that rules through fear, intimidation, and violence is going to eventually be overthrown, and when it happens there'll likely be all sorts of support, clandestine if not outright, from all quarters.
    • China is playing an open-ended game of Whack-a-Mole with it's citizens, with the global Internet as the venue. It's obvious that Chinese citizens want free and unfettered access to the Internet and all the information on it. The communist Chinese government can keep trying to deny them, but just like with copy protection schemes, DRM, and all other censorship-like things, people will find a way around it. Memo to Communist Chinese government: You can't stop the signal. You're going to fail; it's inevitable. Why not give up now, and stop oppressing your people? When the revolution comes, are you going to change, or are you going to fight the future, and go the way of Bashar al-Assad and start slaughtering your own people en masse? It's up to you how History will view you, China. Choose wisely.

      Sounds like the free internet is China's "War on Drugs".

  • Just recently it was reported that China will start censoring videos on certain video platforms, taking down content that criticizes the government or depicts LGBT people. http://www.independent.co.uk/n... [independent.co.uk]

    People were saying it wasn't a huge deal because citizens "mostly use VPNs anyway" to access foreign videos, but this kinda throws a wrench in that plan.

    • Chain has also just started a program that makes it very hard for foreigners to renew their residence permits too. They are starting to use a point system that is all but impossible for most of the foreigners to be eligible. The Resident permits for all non-Han worked have been one year permits; so there is a near exodus of foreign workers going on right now.

  • This looks a lot like what happens in mid-eastern countries like Saudi Arabia, where you can get fined $50K US for using a VPN. It isn't a security issue so much as they do not want people not paying the local voice carriers the $6 US/minute or whatever for voice communications. The owners of the carrier are typically relatives or close business associates of the ruling government.

    China of course want to monitor online political activity so they want to make sure that nobody can post online content anon

  • The more will slip though your fingers...

    China will eventually faced with the prospect of just disconnecting from the rest of the world or giving up on censorship. Depends on if they want to turn into a huge version of North Korea or not. I'm guessing, not.

  • Don't give Theresa May and Amber Rudd ideas.
  • You should be able to stealth your VPN behind a legit appearing website.

    Same IP, same port

    • by Strider- ( 39683 )

      Same IP, same port, different traffic pattern. The folks who build these system aren't stupid. Now if rather than a VPN you're running an https proxy, that's a little harder to detect, but even then, if all the traffic from one host is going to another host, and not touching anything else, it's not hard to develop a high degree of confidence that you're looking at a VPN or proxy service.

  • As the IT manager at a company that has a sister company in China this sucks. As it is they block DropBox, OneDrive, Google, etc. which makes transferring large files a pain in the ass. They are also trying to force everyone to use WeChat which I don't trust at all, so I'm expecting Skype to have even more issues then it does now when using it in China. They really make life hell for IT who have to deal with them and this will be the icing on the cake. I don't understand how they intend to do business globa

Basic is a high level languish. APL is a high level anguish.

Working...