Jade

YouTube video by Tom Scott Oversight: Thank you for volunteering, citizen.

Tom Scott making good stuff as always (11 years ago)
youtu.be/RIuf1V1FhpY

Getting into big security conferences may be difficult, but I'm grateful to have never seen anything as bad as "who is adam"

GWU was very welcoming of @pet-symposium.bsky.social attendees. The nearby whole foods, not so much.

We found some other strange things too, like bizarre teredo-prefixed IPv6 addresses.

You can read the details in our extended abstract here
www.petsymposium.org/foci/2025/fo...

One of these IPs hosted a simple SSH server, implying some VPS got caught in the list somehow. But the other... is an *adult content website*.

In the process of trying to block human rights websites, the architects of the GFW send kids looking for Youtube videos to adult videos.

This approach bears suspicious resemblance to proposals by Fang Binxing (github.com/net4people/b...), the so-called "Father of the GFW".

Additionally, we found hosts in the GFW's injector pool that redirect users not just to these suspicious responding IPs, but to IPs *hosting content*

Of the 1922 IPv4 addresses we collected from the GFW's injectors, these 6 would respond on ports roughly distributed across the port spectrum

This strange phenomenon poses some risks. The GFW, or anyone else, could be using traffic received by these hosts to surveil censored users.

The inspiration for this work was a weird observation. Instead of just blackholing connections, some of the IPs injected by the GFW's DNS injector would respond with a S+A. (when you gaze into the abyss....)

Users under China's censorship regime receive injected responses for bogus black-hole IP addresses when they try to do DNS lookups for censored domains. But what if those IPs weren't just bogus, but potentially malicious?

This week we presented our work: "I'll Shake Your Hand" to FOCI about this.

ICEBlock is incredibly false privacy claims for marketing. They falsely claim it provides complete anonymity when it doesn't. They're ignoring both data kept by Apple and data available to the server but not stored. They're also spreading misinformation about Android:

www.iceblock.app/android

I'm excited to start work for SPHERE (sphere-project.net) on reproducible internet censorship research this summer!

OTF President Laura Cunningham: The immediate consequence is that if this holds, over 45 million people will lose access to trusted and secure VPNs, leaving them exposed to authoritarian surveillance and persecution.

Introducing Defense against AI-guided Traffic Analysis (DAITA) | Mullvad VPN Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.

Someone passed this along: Mullvad is debuting a new traffic-analysis prevention service that adds generated cover traffic and uses constant packet sizes. mullvad.net/en/blog/intr...

Reminds me of this meme I have locked and loaded for something I'm about to assign students

Dear Apple: add “Disappearing Messages” to iMessage right now This is a cryptography blog and I always feel the need to apologize for any post that isn’t “straight cryptography.” I’m actually getting a little tired of apologizing for i…

So here’s a simple request to Apple. Apple iMessage needs to enable “disappearing messages.” And they need to do it soon. blog.cryptographyengineering.com/2025/03/01/d...

My contribution to this work was ultimately fairly minor, though I'm really happy to see this published. I've been captivated by how China could allow such a critical vulnerability ever since first learning about this project.

Wallbleed: A Memory Disclosure Vulnerability in the Great Firewall of China

gfw.report/publications...

Protip for anyone teaching a binary exploitation course: Gradescope's Docker container has ASLR enabled, but a cloud-init vm running in qemu-system-x86_64 does not :D

Hello, world!