cyber.hendryadrian.com
Threat Research · securityonline.info

Researchers Rebuild Tiangou Gateway and Find Technical Links to China’s Great Firewall

· Original article ↗

Summary

Researchers rebuilt Tiangou Secure Gateway from leaked code and examined how it detects and blocks circumvention tools. DNS-handling and TCP-reset similarities provide strong technical evidence of a link to Great Firewall components.

Key points

  • Researchers reconstructed and ran a recent Tiangou Secure Gateway build in an isolated lab using leaked Geedge Networks source code.
  • The platform parses DNS, TLS and QUIC traffic and can drop packets, reset connections, throttle traffic or redirect requests.
  • Its filtering rules can use IP addresses, domain names, JA3/JA4 fingerprints, certificate fields, packet lengths and byte sequences to identify tools including VPNs, Tor, Signal and Psiphon.
  • Internal materials reportedly link deployments and technical support to Myanmar, Pakistan and Ethiopia.
  • Researchers found that Tiangou handled DNS compression pointers and constructed TCP resets in ways matching known Great Firewall components; they consider this strong evidence of a connection.
  • The leaked archive reportedly contained more than 100,000 internal files, including source code, configuration files and over 500 Git repositories; researchers have not publicly released the code or build.

Article Details

Attack Vectors
  • TSG parses DNS, TLS, and QUIC traffic to identify applications and apply operator-configured filtering rules.
  • Filtering rules can match IP addresses, domain names, JA3 and JA4 fingerprints, certificate fields, packet length, and byte sequences.
  • TSG can block or disrupt selected traffic by dropping packets, sending TCP resets, throttling transmission, or redirecting HTTP and DNS requests.
  • TSG supports user-level tracking at the internet service provider layer.
Defensive Notes
  • The leaked code and reconstructed build were not publicly released; access is limited on request to responsible researchers and organizations with no connection to censorship-system deployments.

Vendors

Geedge NetworksResearchers reconstructed and ran Tiangou Secure Gateway (TSG) in a lab using leaked Geedge Networks source code, revealing how the commercial censorship platform detects and blocks VPNs, Tor, Signal, and other

Products

ExpressVPN#TiangouSecureGatewayNordVPN#TiangouSecureGatewayPsiphon#TiangouSecureGatewaySignalNetworks source code, revealing how the commercial censorship platform detects and blocks VPNs, Tor, Signal, and other circumvention tools.Tiangou Secure GatewayResearchers reconstructed and ran Tiangou Secure Gateway (TSG) in a lab using leaked Geedge Networks source code, revealing how the commercial censorship platform detects and blocks VPNs, Tor, Signal, and otherTorGeedge Networks source code, revealing how the commercial censorship platform detects and blocks VPNs, Tor, Signal, and other circumvention tools.

Countries

ChinaTheir analysis also found strong technical evidence linking TSG to Great Firewall of China components, with deployments tied to Myanmar, Pakistan, and Ethiopia.EthiopiaTheir analysis also found strong technical evidence linking TSG to Great Firewall of China components, with deployments tied to Myanmar, Pakistan, and Ethiopia.MyanmarTheir analysis also found strong technical evidence linking TSG to Great Firewall of China components, with deployments tied to Myanmar, Pakistan, and Ethiopia.PakistanTheir analysis also found strong technical evidence linking TSG to Great Firewall of China components, with deployments tied to Myanmar, Pakistan, and Ethiopia.

Related Articles