We began our investigation by confirming the continued normal operation of the GFW’s censorship features. We did so employing measurements between our test system outside of China and a Baidu server that we observed returning the malicious Javascript. We sent the Baidu server a request that the GFW would process as a query for “http://www.google.com/?falun”, a URL long known10 to trigger the GFW to inject forged TCP Resets to terminate the connection. This packet capture shows the results of our experiment, which confirmed that the normal, well-understood operation of the GFW continues. Note that the capture includes both the injected TCP Reset and, later, the legitimate response (an HTTP 403 reply) from the Baidu server. This occurs because the GFW operates as an on-path system, and, as discussed earlier, on-path systems cannot prevent in-flight packets from reaching their destination.
我们通过持续性的正常操作来确认GFW的审查特征，从而开始我们的调查。我们在处于中国之外的测试系统和百度服务器之间进行了测量，观察到返回了恶意JS脚本。我们向百度服务器发送了一个请求：“http://www.google.com/?falun”， 一个会触发GFW注入伪造的TCP Reset包从而终结连接的审查过程的URL[10]。抓包结果显示了我们的实验结果，从而确认了GFW的正常审查还在继续。注意抓包结果包括了被注入的 TCP Reset包和迟些到达的百度服务器的合法响应（一个HTTP 403 回复）。发生这些的原因是GFW是一个旁路系统，早先的讨论说明了旁路系统无法阻止在路上的包到达目的地。
14/26 首页 上一页 12 13 14 15 16 17 下一页 尾页
|
