gfw-report
commented
1 year ago 分享一个修改版的Shadowsocks，兼谈我们对猫鼠游戏的一点想法
作者： Anonymous, Anonymous 日期： 2022年10月15日，星期六 English version: Sharing a modified Shadowsocks as well as our thoughts on the cat-and-mouse game
我们在这篇文章中发布和开源一个修改版的Shadowsocks。这个版本的Shadowsocks可以绕过当前GFW的检测以及封锁。我们首先介绍这个修改后的Shadowsocks的原理，再分享一个如何部署服务器和客户端的简单教程。我们还会介绍其他两种当前能够帮助Shadowsocks和VMess绕过当前GFW封锁的办法。在文章的最后，我们分享我们对审查这个猫鼠游戏的一些看法。我们将从审查者每次开始大规模封锁的时间点选择出发，探讨审查者相比反审查社区缺乏灵活性这一根本性的弱点，并附上我们对如何利用审查者的弱点来达到四两拨千斤的效果的一些建议。
动机
我们在此时发表这个版本有三个目的：
-
首先，我们想为中国网民提供一个（暂时）可行的翻墙方案。用增加翻墙协议多样性的方式，缓解10月3号以来的GFW对多种翻墙工具的大规模封锁。
-
其次，我们想抛砖引玉地引起研究者和开发者的讨论。我们实证性的研究显示，当前的GFW已经可以精准地识别Shadowsocks，VMess，以及Obfs4这类完全加密协议（full-encrypted protocol）。我们估算GFW当前的流量检测算法会误伤约
0.6%的非翻墙链接，而假阴性则低得几乎可以忽略不计。这迫切的需要我们群力群策地改进当前的协议。 -
最后，我们想把这次发布当作一场实验，同时观察审查者和反审查社区在面对新的（反）审查事件时的反应速度。
为什么这个修改后的Shadowsocks可以规避GFW当前的检测和封锁？
我们与其他研究人员合作发现，当前的GFW会利用多种不同的规则来识别Shadowsocks，VMesss，以及Obfs4这类完全加密协议。其中一条规则就利用了这些加密流量的0比特与1比特的比例接近1:1的特性。因此，如果我们在加密流量中加入更多的0或1，再对比特序列进行重排，就可以达到改变原有比例特征，绕过检测和封锁的目的。
我怎么用这个修改版的Shadowsocks？
这个修改版的Shadowsocks基于Shadowsocks-rust，我们还利用Shadowsocks-android编译了apk文件供安卓用户使用。所有的客户端和服务端软件都可以在这个branch和这个release找到。
安装服务端
安装修改版的服务器的过程与安装任何其他Shadowsocks-rust服务器无异。
- 首先你需要登陆你的远程服务器，然后下载编译好的文件：
wget https://github.com/gfw-report/shadowsocks-rust/releases/download/v0.0.1-beta/shadowsocks-v1.15.0-alpha.9.x86_64-unknown-linux-gnu.tar.xz
tar xvf shadowsocks-v1.15.0-alpha.9.x86_64-unknown-linux-gnu.tar.xz- 接着你需要创建一个配置文件：
sudo nano server_config.json
将下面的配置文件复制粘贴。注意，你需要把里面的ExamplePassword替换成一个更强的密码。你可以用以下命令在终端生成一个强密码：openssl rand -base64 16。你也应该考虑更改服务器端口8388。
{
"server": "0.0.0.0",
"server_port": 8388,
"password": "ExamplePassword",
"method": "aes-256-gcm"
}将上方替换过密码的配置信息复制粘贴到配置文件后， 按Ctrl + x退出。 退出时，文本编辑器将问你"Save modified buffer?"，请输入y然后按回车键。
- 你现在就可以运行二进制的服务器了。但是为了让它在你退出SSH后还能继续运行，你可以考虑建立一个
tmux会话：
tmux然后再运行服务器：
./ssserver -c ./server_config.json最后，按Ctrl + b再按d就可以脱离tmux会话了。
防火墙配置
我们使用ufw来管理Shadowsocks服务器的防火墙。
在基于Debian的服务器上，可以通过如下命令安装ufw：
sudo apt update && sudo apt install -y ufw然后开放有关ssh和Shadowsocks-rust的端口。 请注意，以下命令假设你在server_config.json中的server_port的值为8388。 如果你的server_port用了其他的值，请对以下命令作相应的修改：
sudo ufw allow ssh
sudo ufw allow 8388现在我们启动ufw:
sudo ufw enable启动时如果弹出Command may disrupt existing ssh connections. Proceed with operation (y|n)?，请输入y并按回车键。
最后，请用sudo ufw status检查一下你的配置是否和下面的一样：
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
8388 ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
8388 (v6) ALLOW Anywhere (v6)客户端配置
下面是桌面版客户端的配置文件，记得server的值替换为你远程服务器的IP地址。如果你们是用了我们提供的安卓apk在手机上使用，那么配置就和往常的使用Shadowsocks-android的办法一样。
{
"server": "ExampleServerIP",
"server_port": 8388,
"password": "ExamplePassword",
"method": "aes-256-gcm",
"local_address": "127.0.0.1",
"local_port": 1080
}不足
- 因为我们对Shadowsocks协议做了修改，因此暂不兼容其他Shadowsocks客户端和服务端。用户需要下载我们准备的客户端和服务端。
- 目前客户端只支持Windows，Linux，macOS，安卓手机，和安卓电视版。不支持iOS。我们欢迎有能力的iOS开发者们实现兼容这个修改的协议。也欢迎iOS开发者与我们联系，我们将分享其他绕过审查的办法供你们参考。
- 在加密方式上，修改版还不支持Shadowsocks-2022。这并非我们刻意不支持Shadowsocks-2022，只是时间和精力有限，还没来得及支持。我们推荐选择：
chacha20-ietf-poly1305或者aes-256-gcm。 - 在实现方式上，我们直接在核心代码上进行了修改。这并非我们想要另起炉灶，维护一个Shadowsocks协议的分支版本，只是时间和经历有限，还没有把修改后的算法做成一个可供用户选择的选项。我们将与Shadowsocks开发者积极沟通，希望最终能以提供给用户选项的方式，将新协议合并到Shadowsocks中。
你们还知道什么其他的可以规避当前封锁的方法吗？
我们还知道两种目前可行的方案，他们都利用了另一种不同的GFW流量检测规则：
如果你是V2Ray用户，你可以开启ExperimentReducedIvHeadEntropy选项来避免GFW的检测和封锁。这个方案的好处是你无须在服务器进行任何修改。
如果你是Shadowsocks用户，@database64128还实现了另外一种绕过审查的办法。因为对协议做了修改，所以需要同时更新客户端和服务端。
分享我们对猫鼠游戏的一点看法
我们想借此机会分享一些我们对于审查与反审查这个猫鼠游戏的看法。这些看法既来自于我们对审查者和反审查社区两方的观察与思考，又同时受到klzgrad，David Fifield以及其他许多许多反审查者的深深影响。
审查时间点的选择
长期关注互联网审查的朋友们一定已经发现，中国的审查者总是在政治敏感事件来临前的数天或数周开始大规模地使用他们的新审查武器。实际上，这样的时间点选择绝非偶然，那具体的原因是什么呢？我们猜想至少有三点，也欢迎大家继续讨论补充：
-
首先，对审查者而言，保证至少在政治敏感的时间段内，对社会舆论和信息流通有着足够的控制，是一项重要的政治任务。这项任务通常会被官方话语描述为"为某某期间的网络安全护航"。
-
其次，审查者在政治敏感时期更能容忍审查造成的误伤，因此给新的审查武器投入使用提供了更宽松的试错环境。Tschantz等人对大量审查事件进行分析总结后发现，真实世界的审查者通常宁可少封，也要尽量避免错封带来的影响（见recommendation 5）。而这种倾向仅在政治敏感时期略有变化：审查者会变得更能容忍误伤的代价，以达到其所追求的社会管控。而在这时上线新的武器，即使有前期没有测试出来的错误造成误伤或事故，也更能被容忍。klzgrad在这篇评论中也分享了类似的观点。
-
最后，也是最为重要，却容易被忽视的一点是，GFW其实是在极力地弥补和掩盖其缺乏灵活性的根本性弱点。在这场猫与鼠的游戏中，审查者自知其在反应速度、灵活性上根本不是反审查社区的对手。 如果他们在敏感时期开始前的很长一段时间就开始部署他们新的秘密武器，那么反审查社区就有更多的时间去研究它，并发现绕过审查的新方法。到那时，如果他们不能灵活快速地改进自己的审查武器，那他们在政治敏感时期收紧网络管控的企图就会落空。David Fifield在这篇评论中也分享了类似的观点。
审查者有弱点
审查者缺乏灵活性是由其自身和其所面对的问题的本质所决定的。具体而言，其自身是庞大官僚机构的一部分，这不可避免的导致其内部运行效率低下，行为僵化。而其所面临的问题却又是在全国范围内大规模地监控和审查复杂多变的网络流量。可以想象，一款新型审查武器总是要经历预先研究，经费申请，立项，科研，产品开发，调试，真实流量调研，实验性部署，才能到最后的全国范围内的大规模部署和使用。其过程的漫长程度可想而知。
空口无凭。我们不妨把这次发布当作又一场观察（反）审查者反应速度的实验：看一看审查者要花多久才能封锁我们这次发布的这个有着诸多弱点的版本。
如何利用审查者的弱点？
针对审查者的弱点，我们想到了一些也许能让反审查工作在有限的资源下，事半功倍的原则：
-
要对不完美的翻墙方案更宽容，不要过早放弃一个不完美的翻墙方案。我们前面说GFW灵活性不如反审查社区这个弱点通常被人们忽视，是因为看到许多的翻墙方案仅仅因为“存在弱点”就被过早的否定和扼杀了。这通常是因为反审查人员在设想自己是审查者时，更多的只考虑了第一步“预先研究”，觉得某个翻墙方案很容易被封锁，而忽视了真正的审查者所要面对的还有漫长的经费申请，立项，科研，产品开发，调试，真实流量调研，实验性部署，才能到最后的全国范围内的大规模部署和使用。事实上，如果我们的反审查人员花一个下午做好的反审查方案，在消耗了审查者半年的时间、精力、人力、物力、财力后被封锁了，其四两拨千斤的作用也早已经达到了。
-
要增加翻墙方案的多样性，鼓励不同翻墙方案的百花齐放。在很多人的想象中，GFW因为拥有国家级的资源而成为一个完美的审查者，但实际上，有技术、能力、资源将上述审查武器研发流程一一走完的团队是有限的。我们反审查社区开发的翻墙方案越多种多样，这些有限的资源团队就越无法一网打尽所有的翻墙软件。而只要在某次大封锁中还剩下一种能用翻墙方案，信息就不至于完全阻塞。
-
积极的报告新的审查事件，当新的审查事件发生时，迅速地测量新的审查机器，并将测量结果和绕过审查的方案分享给社区。达成这一项需要网民，研究者以及开发者三方一起沟通、努力、和配合。令人鼓舞的是，我们现在看到越来越多的人加入到这个协作之中，相互的配合也越来越默契顺畅。
-
提前开发备用的翻墙方案。我们看到GFW为了弥补自身灵活性的不足而想到在政治敏感时期前几天才使用新的秘密武器，杀网民一个措手不及。那我们是不是也可以用相同的思路，在平时多开发几种备用的翻墙方案，然后像这次的发布一样，到了敏感时期之前才发出？这样，就算是审查者中的技术人员马上发现了新工具中的缺陷，知道了如何反制，也还是需要经过漫长的研发周期。
感谢
我们感谢David Fifield对文章初稿的反馈。
联系我们
正如前文所说的，我们发帖的目的就是想引起用户，研究人员和开发者们的讨论。因此我们欢迎您或公开地或私下地与我们分享您的使用体验或想法。我们私下的联系方式可见GFW Report的页脚。
SekiBetu
ghost
shawokou123
mckuhei
klzgrad
lolyinseo
ours1505
uruwasyo
database64128
diwenx
cross-hello
HezeCaoxian
liujunjia1996
wkrp
fortuna
Kimberlysz
free-the-internet
lajiburner
SheepChef![https://github.com/notifications/beacon/AKGBAYCO6GCX5V3GGAI7XOTWDNKL5A5CNFSM6AAAAAARFWQNI6WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSMJE3OW.gif]Message](https://github.com/notifications/beacon/AKGBAYCO6GCX5V3GGAI7XOTWDNKL5A5CNFSM6AAAAAARFWQNI6WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSMJE3OW.gif]Message){kind=link}
Authors: Anonymous, Anonymous Date: Saturday, October 15, 2022 中文版：分享一个修改版的Shadowsocks，兼谈我们对猫鼠游戏的一点想法
In this post, we release and open source a modified version of Shadowsocks that can bypass the current GFW's detection and blocking. We first introduce the reason why this modified Shadowsocks can bypass the detection and blocking. We then share a simple tutorial on how to setup the client and server. We will also cover two other ways that help Shadowsocks and VMess bypass the current GFW's blocking. At the end of the article, we share some of our thoughts on the cat-and-mouse game of censorship. In particular, we start with answering why censor always starts the massive blocking a few days or weeks before politically sensitive period of time in China; we then argue that, comparing to the anti-censorship community, a fundamental weakness of censor is its inflexibility. We further discuss how to exploit censor's weaknesses to achieve better anti-censorship effect with limited resources.
Motivations
We release this modified Shadowsocks tool today for three reasons:
First, we want to provide Chinese netizens with a (temporarily) viable solution to bypass censorship, mitigating the GFW's massive blocking of multiple censorship circumvention tools since October 3rd, 2022.
Second, we would like to take this opportunity to start a discussion among anti-censorship researchers and developers. Our empirical research shows that the current GFW can already accurately identify Shadowsocks, VMess, and Obfs4 and many other full-encrypted protocols. We estimate that the GFW's current traffic detection algorithm has
0.6%false positives, while the false negatives are almost negligible. This finding urgently requires us to brainstorm and discuss how to improve the current protocols collectively.Finally, we would like to use this release as an experiment to observe both the censor and the anti-censorship community on how fast each side can react to a new (anti-)censorship event.
Why can this modified Shadowsocks circumvent the GFW's current detection and blocking?
We worked with other researchers to discover that the current GFW utilizes a number of different rules to identify fully encrypted protocols like Shadowsocks, VMesss, and Obfs4. One of these rules takes advantage of the fact that the ratio of 0 bit to 1 bit in these encrypted flows is close to 1:1. Therefore, if we add more 0s or 1s to the encrypted traffic and then rearrange the bit sequence, we can achieve the goal of changing the original ratio feature to bypass detection and blocking.
How do I use this modified Shadowsocks?
This modified version of Shadowsocks is based on Shadowsocks-rust, and we also make use of Shadowsocks-android to compile the apk files for Android users. All client and server side software can be found at this branch and this release.
Installing the server
The installation process is the same as installing any other
Shadowsocks-rustserver.sudo nano server_config.jsonCopy and past the following settings to the file. Note that you need to replace the password
ExamplePasswordwith a much stronger one. A handy way to do this from your terminal is:openssl rand -base64 16. You may also want to change theserver_port.After finishing editing, you type
Ctrl + xto exit. The text editor will ask"Save modified buffer?", and you can typeyand then hitEnter.tmuxsession by:You then do:
Finally, type
Ctrl + band then typedto detach from the tmux session.Firewall configuration
We use
ufwto open ports for the Shadowsocks server.To install
ufwon a Debian-based server:Then open ports for
sshandShadowsocks-rust. Note that if you set theserver_portto a value different than8388inserver_config.json, you need to change the value8388below accordingly:Now enable
ufw:If it prompts
Command may disrupt existing ssh connections. Proceed with operation (y|n)?, typeyand hitEnter.Finally, run
sudo ufw status, and the output should look like this:Client side configuration
Below is a configuration file for Client. Remember to change the
servervalue fromExampleServerIPto your remote server's public IP address. If you used andorid and installed from the apk file we provided, the usage should be the same as usual.Limitation of the current implementation
chacha20-ietf-poly1305oraes-256-gcm.Are you aware of any other ways to circumvent the current blocking?
We know of two other currently viable options, all of which utilize a different traffic detection rule by the GFW.
If you are a V2Ray user, you can turn on the
ExperimentReducedIvHeadEntropyoption to avoid the GFW's detection and blocking. The advantage of this option is that you do not need to make any changes to your servers.@database64128 also implemented another way to bypass the censorship. Because the protocol is changed, it requires updating both client and server to use it.
Our thoughts on this cat-and-mouse game
We'd like to take this opportunity to share some of our thoughts on the cat-and-mouse game of censorship. Our views are based on our observations and reflections on both the censor and the anti-censorship community; we have also been deeply influenced by klzgrad, David Fifield, and many other anti-censorship developers and researchers.
Censor's timing choice of new blocking techniques
As many long-time Internet censorship observers have noticed, Chinese censors always start using their new censorship weapons on a large scale a few days or weeks before a politically sensitive event. In fact, such timing choices are no coincident. So what are the specific reasons? We suspect there are at least three reasons, and we encourage everyone to share their thoughts on them.
First, it is an important political task for censors to ensure that they have sufficient control over public opinion and information flow, at least during politically sensitive time periods. This task is often described in official parlance as "protecting the cybersecurity during such-and-such event".
Second, censors are willing to tolerate more collateral damage caused by false positives in detection during sensitive times. This nature provides new censorship weapons a more permissive trial-and-error environment when they are first put into use. Tschantz et al. analyze and summarize a large number of censorship incidents and find that "real censors tend to use vulnerabilities that produce underblocking but not overblocking" (see recommendation 5). And this tendency shifts slightly during politically sensitive times: censors become more tolerant of the collateral damage caused by false positives in detection in trade of a tighter social control. By deploying a new censorship weapon during such period of time, the censor's mistake will be more tolerated even if the tool caused any overblocking accident due to bugs that were not tested out in the prior phases. klzgrad shares a similar view in this comment.
Finally, and most importantly, a often overlooked reason is the fact that the GFW is actually trying to compensate for and cover up its fundamental weakness of inflexibility. In this cat-and-mouse game, the censors know that they are simply no match for the anti-censorship community in terms of responsiveness and flexibility. If they started deploying their new secret weapon long before the sensitive period begins, the anti-censorship community will have more time to study it and find new ways to bypass censorship. At that point, if they can't be flexible and fast enough to improve their censorship weapons, then their attempts to tighten their controls over the Internet during politically sensitive times will fall flat. David Fifield shared a similar point of view in this comment.
Censors have weaknesses
The censor's lack of flexibility is dictated by the nature of itself and the problems it faces. Specifically, it is itself part of a large bureaucracy, which inevitably leads to inefficient internal operations and rigid behaviors. And yet the problem it faces is as complex as monitoring and censoring network traffic on a national scale. It is not hard to imagine that a new censorship weapon always has to go through the procedures of early-phase research, grants application, more formal scientific research, product development, debugging, surveying on real-world traffic, experimental deployment, and then the final nationwide large-scale deployment and use. The length of the process can take quite a long time.
One may be wondering if it indeed takes such a long time for the censor to deploy a censorship weapon. Let's take this release as another experiment to observe how fast the censor and anti-censorship community can react. In particular, let's see how long it takes the censors to block our released tool that has many weaknesses.
How to exploit censor weaknesses?
Exploiting the censor's weakness, we came up with a few principles in hope they can make the anti-censorship efforts more effective.
Be more tolerant of imperfect circumvention solutions and do not give up on an imperfect circumvention solution too soon. As mentioned in the previous section, the fact that the GFW is less flexible than the anti-censorship community is often overlooked. And because of that, many circumvention solutions have been dismissed and killed prematurely simply because they "have weaknesses". This is often because when anti-censorship developers and researchers envisioning themselves as censors, they tend to focus on the first step for censor -- "pre-research" -- and thinking that a circumvention solution would be easily blocked; however, they actually underestimated the long process of funding applications, formal scientific research, product development, debugging, surveying real-world traffic, experimental deployments, and finally, nationwide deployment, that the real censors have to face. In fact, if an anti-censorship developer spends an afternoon rolling out a new anti-censorship tool, but it takes the censor a large amount of time, energy, human, material and financial resources to block it in six months, we have to say this "imperfect" tool served as a great leverage.
Increase the diversity of censorship circumvention solutions by letting a thousand flowers bloom. In many people's imagination, the GFW is a perfect censor because of its national-level resources; however, in reality, there are limited number of teams with the skills, ability, and resources to walk through all the procedures to make a censorship weapon from an idea to a real weapon deployed national-wide. Therefore, the more anti-censorship solutions the community can create, the less likely these limited resource censor teams will be able to block all tools in one go. And as long as there is one working circumvention solution left in one of these massive blocking event, the information is not disrupted completely.
Actively report new censorship events, promptly measure and understand new censorship techniques, and share the viable circumvention strategies with the community. Achieving this will require communication, effort, and cooperation between Chinese netizens, researchers, and developers. Encouragingly, we are now seeing more and more people joining this collaboration and working together as a collective.
Develop backup circumvention tools in advance. We have seen that the GFW makes up for its lack of flexibility by starting using its new secret weapons in large scale a few days before politically sensitive events. So can we use a similar strategy where we develop more backup plans in normal times, and then send them out just before sensitive times, like this release? This way, even if the technical staffs working for the GFW immediately spot any flaws in the new tool, and knew how to block the tool, it would still take them a long research and development cycle before actually being able to block it in real world.
Acknowledgment
We thank David Fifield for commenting on an earlier draft of this article.
Contact
We encourage you to share your thoughts, comments, user experiences publicly or privately. Our private contact information can be found at the footer of GFW Report.