GreatFire Newsletter - April, 2012

April was an eventful month in China. Here's a summary of the most important Internet censorship news that we detected.

No major changes after Internet outage on April 12

There was an extraordinary Internet outage in China on April 12. Many reported that all foreign websites were unaccessible for about two hours. Our data confirms that several websites that are otherwise not blocked were not accessible, but interestingly other foreign websites were still available. For more info on what happened, check out our answer on Quora. Some people suggested that the authorities were trying out a new version of the Great Firewall, which would be more restrictive than before. Our data does not support this claim. As you can see in the first graph below, there has not been any major change in the number of major websites that are blocked in China. Furthermore, the second graph shows that foreign websites were actually faster to access in April than during previous months.

Loading chart..

Showing Alexa Top 500 websites blocked 50% or more of the time, per month. Source.

Loading chart..

Showing average download speed of Alexa Top 500 websites not hosted in China, per month. Source.

Google Drive and the ongoing Google vs CCP battle

Google Drive was launched on April 24. Within three days, it was blocked in China. This is similar to Google Plus which was launched on June 28 last year, and confirmed to be blocked since July 4. It is likely that the Great Firewall has a special team dedicated to monitoring and blocking new Google services. They are probably keen not to repeat the mistake of Google Mail which was left unblocked and, meanwhile, switched over to encrypted communications only (meaning that email content can't be intercepted). The authorites would probably like to block it. The only reason we can see that they don't is that they're afraid of the reactions because so many (especially educated, big-city people) are already using it.

Curiously, was blocked on March 29 (and has been blocked before) but is not blocked. The latter redirects users in China to (note the HTTP, as in not encrypted). Much more importantly, the encrypted Hong Kong version of Google at remains unblocked. While not on by default, it does allow Chinese users to search for any of the hundreds of keywords that are otherwise blocked. was blocked on March 29 and has stayed that way, though the unencrypted version remains accessible ( The same thing happened to the encrypted version of Google Maps ( - the unencrypted version also remains (

Several previously unblocked keywords were blocked on Google Search. These include google: 九长老 - a reference to the nine members of the Politburo Standing Committee, google: 政变 - meaning coup d'état, google: 共匪 - meaning communist bandit, and google: 滤霸, 驴爸 which was unblocked again on April 27.

YouTube fully blocked again

The encrypted version of YouTube - - was accessible in China for several days in March. Since March 29, though, it has been fully blocked again, suggesting that the Great Firewall is now better at blocking encrypted websites. HTTPS makes online censorship more difficult in that intercepting network devices don't know what the web traffic is. So while a web request to can be blocked simply by detecting that the user is trying to access a blacklisted URL, a request to can only be hindered by either blocking the IP address of the server or by DNS poisoning the domain lookup. The former is difficult because IP addresses tend to change over time, and the latter is imperfect because it's decentralized and easier to get around than other forms of censorship. For example, the encrypted YouTube URL was tested eight times during April. Five different IP addresses were returned on the different test occasions. Only on three of the occasions was a completely different IP address returned (suggesting DNS Poisoning). On all eight test ocassions though, the website was blocked. This suggests that the Great Firewall is now either blocking ranges of IP addresses, or continuously monitoring changes in IP addresses and blocking them accordingly.

Blocked and unblocked on Sina Weibo

weibo: 王立军, the former Chongqing police chief who triggered the biggest political scandal in China in many years, was blocked on or before April 10 (but was not blocked on April 3). As part of the same scandal, weibo: heywood was blocked on or before April 14. weibo: 薄熙来 himself was blocked on or before April 10.

Other keywords were unblocked. weibo: 蔡赴朝, the name of a CCP politican, was unblocked on or before April 21. weibo: 女同 - lesbian - was unblocked on or before April 7.

You can lookup and test any keyword for censorship on Sina Weibo here. Also much recommended are BlockedOnWeibo, a blog which publishes frequent news on keywords blocked on Weibo, and WeiboScope, a database of deleted Weibo posts.

Other major Weibo news of April is that Sina is still avoiding fully implementing real-name registration requirements and that Sina as well as Tencent Weibo turned off commenting for three days starting on March 31.

Other notable changes

The English en.wikipedia: Huang_Qi entry (a currently imprisoned human-rights activist) was blocked all of April, and then unblocked again in early May. was inaccessible on a couple of occasions in April and is consistently very slow in China. was unblocked in March and stayed unblocked throughout April. was blocked on March 26 and has stayed blocked since. was blocked on April 4 and has stayed blocked since. - A Chinese-language wiki - was blocked on April 9 and has stayed blocked since. - a gaming website - was unblocked at the end of March and has stayed accessible since. - a campaign website - was partially blocked already in March and fully blocked throughout April. - a blog covering news in China - was blocked at the end of March and has stayed blocked since.

GreatFire announces [email protected]

There are many ways to get around the Great Firewall of China: VPNs, proxies, Tor etc. Some of them cost money and some are free. They are all bound to be unreliable though because they depend on a server used to tunnel the web traffic in order to circumvent the censorship. If the IP address of the server being used is blocked, the service ceases to work. It can be fixed of course, by changing to another server, but meanwhile you may find yourself without any means of accessing blocked websites. Until now.

[email protected] is a circumvention tool that is very difficult to block. This is because it relies on email and not HTTP traffic. All you need to do is to send an email to [email protected] and enter the URL of the website that you want to view as the email subject. Within a few seconds (sometimes longer) you will receive a PDF version of the website.

For example, create a new email with the subject and send it off to [email protected]. You will receive an updated PDF copy of that website - blocked in China - shortly thereafter.

It's not a perfect solution by any means. You can't log in to websites, such as Facebook, and you can't view videos. However, for those times when you simply want to view a blocked website and you have no other means, it's very convenient. All you need to remember is [email protected].

Can you help us translate content into Chinese?

We are creating a Chinese version of and we depend on volunteers to translate our content. Can you help out? Or do you know someone that can? Please contact us on [email protected] .


More Blog Posts

Subscribe to our mailing list
Show content from Blog | Google+ | Twitter | All. Subscribe to our blog using RSS.

Thu, Sep 24, 2015

Apple blocked CNNIC CA months after MITM attacks

In March of this year, Google found unauthorized digital certificates for several Google domains. The root certificate authority for these domains was the China Internet Network Information Center (CNNIC). CNNIC was controlled by the Chinese government through the Ministry of Industry and Information Technology and is now under the management of the Cyberspace Administration of China (CAC). CNNIC was recognized by all major browsers as a trusted Certificate Authority. If CNNIC signs a fake certificate used in a man-in-the-middle attack, no browser will warn of any unusual activity unless the certificate is pinned.

Wed, Sep 23, 2015

Malicious Xcode could spread via download manager Xunlei

What’s at stake?

We reported last week that popular Chinese iOS apps were compromised in an unprecedented malware attack. We discovered that the source of the infection was compromised copies of Xcode hosted on Baidu Pan. Apple has published an article urging developers to download Xcode directly from the Mac App Store, or from the Apple Developer website and validate signatures. We’ve now discovered that even if a developer uses a download link seemingly from Apple, he might still be possible to obtain a compromised copy of Xcode.

Please note that we do not have evidence that such attacks has happened. But it is an easy attack that anyone can implement.

How does it work?

This compromise happened because of Xunlei. Xunlei is the most popular download manager in China. Much of its popularity is due to the fact they can accelerate download speeds by pulling resources from other Xunlei users as well as cached copies on the Xunlei server. All of this, however, is invisible to users. Users can simply enter a regular http download address into Xunlei  download manager and the download will start. Chinese developers were using direct download addresses such as to download Xcode.

Mon, Sep 21, 2015



Sat, Sep 19, 2015

Popular Chinese iOS apps compromised in unprecedented malware attack

What happened?

According to recent reports, some versions of Xcode used by developers in China have been compromised and are being used to inject tracking codes in iOS apps without developer knowledge. (1,2). Unaware of the injection, those developers then released their compromised iOS apps to the App Store which were then later approved by Apple. At the time of writing this post, the compromised apps are still available in the App store. Any user who has installed and launched these compromised apps will be a victim of these tracking codes.

This is a significant compromise of Apple’s app store. Apple notoriously manually reviews all app submissions and, in comparison to Android stores, has been relatively malware-free. This is the most widespread and significant spread of malware in the history of the Apple app store, anywhere in the world.

The compromised version of Xcode was hosted on Baidu Pan. It is unlikely that Baidu was aware of the compromised version of Xcode. The company removed the files yesterday when news of the compromise surfaced. Because of slow download speeds from foreign websites in China, many Chinese developers prefer to download apps from domestic websites. Many Chinese also use download software like Xunlei, rather than downloading directly from the official Mac App Store.

According to users reports, many prominent Chinese apps are affected. We have included links to the compromised apps in the list below but DO NOT DOWNLOAD these apps. We are simply linking to them so that users can recognize the apps. Affected apps include:  

Wechat The most popolar messaging app in China 

Wed, Sep 16, 2015



Roya, David, Nick, nweaver, Vern, 和我刚刚完成了关于GFW主动探测系统的研究。这个系统在几年前就被用来探测翻墙工具,比如Tor。我们在之前的博文中介绍过GFW主动探测系统是如何工作的。但有几个问题我们没有回答。比如这个系统的物理结构是怎样的。那些用来主动探测的IP是归GFW所有的么? 有猜测GFW短时间内劫持了部分IP来用来主动探测,但没有证据。这次研究回答了这些问题。


  • 通常来说,如果Tor的某个网桥代理被GFW检测并封锁,它会一直被封锁。但是这意味着网桥代理完全无法访问吗? 我们让中国的VPS一直连接我们控制的网桥代理。我们发现,每25小时,中国的VPS可以短暂的连接到我们的代理网桥。下图显示了这个现象。每个数据点表示中国的VPS试图与网桥代理建立连接。中国联通和中国教育网都有这个周期性现象。有时候,网络安全设备在更新规则时会默认允许所有流量,但我们不知道GFW周期性现象是不是因为这个原因导致的。

  • 我们找到了规律,GFW主动探测的TCP头暗示那几千个IP都来自与同一个地方。下图显示了数据包的初始序号和时间。每个数据点都是一个主动探测连接。如果每个主动探测都是从不同地方发出的,我们应该看到随机的数据点,因为数据包的初始序号是随机选择的。但是下图显示主动探测连接虽然来自不同IP,但是非常有规律。我们认为主动探测的初始序号是按照时间产生的。


Subscribe to our blog using RSS.


Hmmm is anyokne else having problems with the imges oon his blig loading?
I'm trying to find out if its a problem on my end or if it's the blog.
Anyy resplonses would be greatly appreciated.

Here iss mmy page

Everyone loves what you guys tend to be up too.

This type of clever work and reporting! Keep
up the very good works guys I've incorporated you guys to blogroll.

Desidero naturalmente il vostro sito web, ma è necessario controllare l'ortografia in molti dei
tuoi post . Molti di loro sono all'ordine del giorno questioni di ortografia
e di trovare molto fastidioso per raccontare la realtà, poi di nuovo Vado sicuramente
tornare di nuovo .

Here is my web blog ... book of ra

Рretty section of content. I just stumbled upon your blog and іn acceѕsion capital
to assеrt that I acquire actuallү enjoyed account ʏour blog
posts. Any way I'll be subscriƄing to your augment and even I
aϲhievement yoս aaccess consistеntly quickly.

Also visit my webpaǥe: Yessenia Hornung

For a lot of, driving might be a form related
to relaxation, for some individuals it may be an anxiousness driven task.
Whatever your personal feelings about it, driving is part of our own
lifestyle and culture. Unless you reside near almost everything,
or are now living in an region that grows fastest on general public transportation,
then then you've drive an automobile eventually. Driving doesn't have to be considered a
chore which freaks somebody out each time you are driving, yet
you must do need to understand the dangers that could occur.
This article will appear with a some of the issues that is possible to keep
safe whilst driving. These tips can help you feel more at ease traveling as well as protect someone from dangerous dangers.

my weblog ... Driving Schools - Dwight,

Somebody necessarily help to make significantly articles I
would state. That is the first time I frequented your website page and so far?
I amazed with the analysis you made to make this particular put up
incredible. Excellent process!

My blog ... police car auctions

In case you see any problem with your Play - Station 3, don’t panic
and ship it off to technicians that will charge hundreds of dollars to repair it.
The company's focus on detail and providing a unique service to
consumers has allowed them to stand above the competition over and over again.
Turn on your PS2 and choose the menu screen where you would normally enter the password.

Feel free to visit my webpage :: pussy (Parthenia)

I'm not sure where you're getting your info, but great topic.
I needs to spend some time learning much more or understanding more.
Thanks for magnificent info I was looking for this information for my mission.

Check out my blog

Thank you for some other informative web site. The place else may just I get that kind of
info written in such an ideal manner? I have a undertaking that I'm just now working on, and I have been
on the glance out for such information.

Review my blog post ... august birthstone

Thank you for some other informative web site. The place else may just I get that kind of
info written in such an ideal manner? I have a undertaking that I'm just now working on, and I have been
on the glance out for such information.

Review my blog post ... august birthstone

I'm not sure where you are getting your info, but great topic.
I needs to spend some time learning much more or understanding
more. Thanks for great info I was looking for this information for my

Also visit my web site; zielona kawa cena

2500 euro lenen met spoedminilening aanvragen 18 jaar

1000 euro lenen duospoed 3000 euro lenen

5000 euro lenen ingonline geld lenen buitenland

Take a look at my homepage :: snel geld lenen Rotterdam in het buitenland zonder bkr notering (

Your style is so unique compared to other people
I have read stuff from. Thanks for posting when you've got the opportunity, Guess I'll just book mark this web site.

My web page ::

My family members all the time say that I am killing my
time here at web, except I know I am getting experience daily by
reading thes good articles or reviews.

my blog post ... zielona kawa

elektronische sigaret kopen e sigarete
sigaret nier problemen
elektronische sigaret kopenwaar een elektrische
sigaret kopene sigarete sigaret smaak marlboro coupons
wegwerp sigaret

elektronische sigarete sigaret ongevaarlijke sigaret kopen roermond
E sigaret starterspakket
wegwerpsigaretbeste e sigarete sigaret roken
e sigaret kopen

Waar een elektrische sigaret kopenelektrische sigaret kopene sigaret smaakt viescolaire
elektrische sigaret kopen

Hello! This post could not be written any better! Reading through this post reminds me of my good old room mate!
He always kept chatting about this. I will forward this
post to him. Pretty sure he will have a good read. Many thanks for sharing!

Here is my web-site ... annonce libertine

Hi there, after reading this remarkable article i am too delighted
to share my knowledge here with mates.

my blog post - annonce libertine

Thanks for every other informative site.

The place else may just I am getting that type of info
written in such a perfect manner? I've a venture that I'm just now working on, and I've
been at the look out for such information.

Feel free to visit my weblog

Normally I do not learn article on blogs, but I would like to say that
this write-up very compelled me to try and do so! Your writing taste has been amazed me.
Thanks, very nice post.

my web site legitimate surveys

The main station which is that the lawyer chosen so they
will protect your driving privileges, and then send you their
way around and you shouldn't have done. The consequences can be used.

Do have to have a better chance in some cases be discharged as
a criminal record. Consider whether the driver and the prosecutors
and of course, and the worse thing to look California DUI
will remain on mommy makeover your behalf. Peter: The total sum of your conceptions.

Here is my web blog :: discover more here

You actually make it seem so easy with your presentation but I find this topic to be
actually something which I think I would never understand.

It seems too complex and extremely broad for me.
I'm looking forward for your next post, I'll try to get the
hang of it!


І visitеd several websites buut thе auio feature
fοr ajdio songѕ presеnt at thіѕ web page is iin fact superb.

Take a lolк at my web site: Home based

Simply want to say your article is as amazing. The clearness in your post is just great
and i can assume you're an expert on this subject.
Fine with your permission allow me to grab your RSS feed to keep up to date with forthcoming post.
Thanks a million and please continue the gratifying work.

Have a look at my blog post webdesigner

fantastic publish, very informative. I'm wondering why the opposite experts of this sector don't notice this.
You should continue your writing. I am confident,
you've a huge readers' base already!

Visit my web page ... teinipornoa

Thank you for every other informative website. Where else may
I get that kind of information written in such
an ideal approach? I have a venture that I am
just now working on, and I have been at the look out for such information.

Here is my blog ... ti sento jewellery

Ƭhe gym is supervised arοսnd the clock, should you get into any difficulty, sustain ɑn injury orr feel unwell ѡhile exercising.
Weight dieting іs a verү sеrious ρroblem toԁay as most people believ in evеrything tҺe
ǥet tօ read inn the Internet. We kno fromm our investigations that ovеr 90% of homе
based business owners fail.

Feel free tо surf to mу web blog - health

When you apply yourself, you will make your life magic.

Why did Adam's aggression set twitter twittering and hearts
thumping across the nation. Conversely, an Alpha Male, who only
consumes the daily, governmental reccommendations, is going to have a difficult struggle ahead
of them.

Feel free to visit my blog post ... marketing, Acttherep.Com,

hello there and thank you for your information – I've certainly
picked up something new from right here. I did however
expertise several technical issues using this web site, since I experienced
to reload the site lots of times previous to I could get it to load correctly.
I had been wondering if your web hosting is OK? Not that I'm complaining, but sluggish loading instances times
will sometimes affect your placement in google and can damage your high-quality score if ads and marketing with Adwords.
Anyway I'm adding this RSS to my e-mail and could look out for a lot more of
your respective exciting content. Ensure that you update this again very soon.

my site: timbangan digital

Thanks forr anny ߋther informative website. Тɦe place еlse ϲould I
get that type ߋf informaton written іn sսch a perrect method?
I've а challenge thɑt Ι'm simply now wօrking on, аnd I hɑve Ьeen at the glance out fօr sucҺ informatiօn.

Check ouut myy homepage: houses in costa rica

Remembrance Day comes peculiarly on 11 November Annually since
the Fitst Word War (1914–18) appeared this rattling day in 1918
Check rememberance day 2014

Nіcee reeplies in return of this matter witҺ firm arguments and explaining tthe whоle thing on the tоpic
of that.

mү weƄѕite :: promotional code

I think the admin of this webb page is actually working hard in favor of his wweb site, as here every stuff is quality based stuff.

Here is my web blog ... 12bet

Thanks be to our Lord Jesus Christ whoo reconcile us bqck to God and gives us a break from all of the teens still staed they wouldn't be.
But, as many come from single-parent households where the parent spends most of the deluxe showers in the posh teepee
field where I was able to do it for the long term.

They're not too advanced or technical, just ways I'm coping until I'm able to
give or want to receive?

Feel free to visit my webpage ::

สวัสดี มี ผมค้นพบ บล็อก ของคุณ
เว็บไซต์ ผ่าน
Google ในช่วงเวลา เดียวกับ ค้นหา ที่เกี่ยวข้อง หัวข้อ , เว็บไซต์ มา
ขึ้นก็ ดูเหมือน น่าจะเป็น ดี
ฉันได้ ฉัน บุ๊คมาร์ค ไว้ใน ที่คั่นหน้าเว็บ ของ Google ของฉัน
สวัสดี มี เพียง ถูก แจ้งเตือนไปยัง คุณ บล็อก
ผ่าน , และตั้งอยู่ ที่
เป็น จริง ข้อมูล
ผม ระมัดระวัง บรัสเซลส์ ฉันจะ ชื่นชม
ถ้าคุณ ดำเนินการต่อไป นี้
ใน อนาคต หลาย folks อื่น ๆ จะ
จาก คุณ การเขียน ไชโย!

Also visit my site: &3594;&3640;มชน

You really make it seem so easy with your presentation but I find
this matter to be actually something which I think I would never understand.
It seems too complex and very broad for me. I'm looking forward for your next post, I'll try to get the hang of it!

Also visit my website ... Happy New Year Wishes

Hey There. I found your blog using msn. This is a very well
written article. I will be sure to bookmark it and return to read more of your useful info.
Thanks for the post. I will definitely comeback.

My webpage - saffron extract dr oz

ผม สี และ รูปแบบ คุณ สร้าง สร้าง เว็บไซต์ นี้ ตัวคุณเอง กรุณา ตอบกลับมา เป็นฉัน
ต้องการ ของตัวเอง มาก เว็บไซต์ และ ชอบที่จะ รู้ว่า หา
ที่คุณ ได้รับนี้ จากหรือ สิ่งที่ ขอบคุณ ขอบคุณ

Look into my blog ... &3610;&3657;านระเว

Wonderful goods from you, man. I've understand your stuff previous to and
you are just too wonderful. I really like what you
have acquired here, certainly like what you're saying and the way in which you say it.

You make it enjoyable and you still take care of to keep it sensible.
I can't wait to read much more from you. This is really a great web site.

Also visit my web blog - Funny SMS Jokes

Heya i am for the first time here. I came across this board and I
find It really useful & it helped me out much.
I hope to give something back and aid others like you helped me.

Why users still make use of to read news papers when in this technological globe everything is available on web?

my page - paket tour and travel

Algún error legal en tal película -cuando el letrado
se niega a a transar un caso a pesar de la voluntad de sus clientes- es impensable en este libro.
1/2004, de cinco de marzo, al Asimismo están acusados de
delitos de pertenencia a banda armada y de blanqueo de capitales.

my website abogado familia

I was confident and told her not to worry because I have seen it all.

Help the environment by installing solar panels at home,
that way you'll pay less for electricity and you won't harm the planet.
Steam machines also have other devices, including both bristle band and circular depth nozzles.

my website :: pest control companies near me;,

I've been exploring for a little for any high-quality
articles or weblog posts on this sort of space .
Exploring in Yahoo I eventually stumbled upon this web site.
Studying this info So i'm happy to show that I've a very just right uncanny feeling I discovered just what I
needed. I so much undoubtedly will make certain to do not overlook this site and give it
a look on a constant basis.

My web page; UK Models

Talk to your financial planner, a competent mortgage advisor, or talk to
a financially savvy friend. Does - The FSA Regulate All Types
Of Mortgage Contract. There are many thousands of lenders and rates available, we
deal with about 300 of them, this was the best deal I saw we can offer you as of today.

Also visit my site ... get more info here

Have you ever considered about including a little bit more than just your articles?

I mean, what you say is fundamental and everything.

But just imagine if you added some great graphics or video clips to give your posts more, "pop"!
Your content is excellent but with pics and videos, this blog could undeniably
be one of the greatest in its field. Terrific blog!

my page ...

Several purifiers consider to 150 lbs which can be hardly
light to take out of the pool following it has accomplished washing.

Thankfulness to mу fatɦer whho stated to me about this
web site, this web site is genuinely awеsome.

Checkk օսt my ѕite


Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
By submitting this form, you accept the Mollom privacy policy.