AI
How the TSPU Differs from the Great Firewall of China
Russia’s TSPU is an in-path device, unlike China’s on-path GFW. The TSPU sits closer to the user (about 5 hops versus 14), allowing it to drop or throttle packets directly. The EcoFilter DPI, the specific TSPU equipment, processes over 100 Gbps per device, far exceeding competitors that handle 10 Gbps. This deployment is driven by Russia’s fragmented ISP ecosystem and cheaper transistors. The in-path design also enables region‑specific censorship at finer granularity.
Connection Tracking Creates a Server‑Side Bypass
The TSPU uses connection tracking to monitor TCP flows, just like Netfilter, Zeek, and Suricata. TCP’s simultaneous open feature makes it impossible to deterministically identify client versus server. An external machine can send a SYN packet toward a Russian vantage point with a TTL that prevents it from reaching the client. The TSPU enters a “SYN sent” state for the wrong direction. Then the real client connects, and the firewall sees the state as inconsistent. The connection proceeds without throttling.
Client‑Side Bypass: The 5‑ACK Trick
Sending five ACK packets in a specific sequence after the TCP three‑way handshake lets a client bypass SNI‑based filtering. The TSPU buffers data for reassembly to extract the Server Name Indication. The five ACKs apparently overflow or corrupt that buffer. The client then sends the ClientHello with a blocked SNI, and the server responds normally. No throttling. The discovery was accidental during testing. The working theory is that the buffer state gets disrupted by the extra ACKs.
Malicious VPNs and Hardcoded Passwords
Russia has pressured Google and Apple to remove VPN apps from their stores. Users turn to shady providers. Mixon‑Baca reverse‑engineered one such VPN called Quon, which used the Jiagu packer from Qihoo 360. He found that several Chinese‑linked VPNs hardcode the symmetric encryption password into the APK. Any adversary that enumerates the VPN server IPs can decrypt all traffic. He identified 8 total VPN providers with transparency issues, 5 still under analysis for Chinese state links.
Toward Automated Bypass Discovery
Manual discovery of client‑side bypasses is a whack‑a‑mole effort. Mixon‑Baca is building an embedded state machine using a temporal logic language (TA+) to automatically find new bypass strategies. The goal is to produce techniques that do not require rooted devices or technical expertise. Developers could integrate the auto‑discovered bypasses into circumvention tools, making them usable by anyone inside Russia.
Notable Quotes
the Eco Filter by contrast its data sheet says that a single device can process on the order of over 100 gigs per second for one device Benjamin “bmixonbaca” Mixon-Baca · ▶ 4:37
if you send five acts in a particular a particular order, you can also bypass uh the censorship Benjamin “bmixonbaca” Mixon-Baca · ▶ 20:17
they actually hardcode the password into the APK Benjamin “bmixonbaca” Mixon-Baca · ▶ 29:03
we want this to be something that anyone can use, uh that developers can uh benefit from Benjamin “bmixonbaca” Mixon-Baca · ▶ 32:39
Key Takeaways
- Russia’s TSPU is an in-path firewall that can drop or throttle packets with 100+ Gbps throughput.
- TCP simultaneous open and connection tracking ambiguities enable server‑side and client‑side bypasses.
- Malicious VPNs with hardcoded symmetric keys let anyone on the network decrypt user traffic.
About the Speaker(s)
Benjamin “bmixonbaca” Mixon-Baca is a security researcher focused on Internet Freedom, censorship circumvention, and pwning middleboxes, firewalls, and other devices that are supposed to keep him “safe”. He has developed attacks against VPN software, including CVE-2021-3773, which exploits connection tracking frameworks like Netfilter to redirect packets and escalate from adjacent to in‑path. He applied those insights to develop bypass strategies against the TSPU, because the underlying design of connection tracking is nearly identical for VPNs and firewalls.