Maodun

This report presents a secure networking approach for content distribution in the People’s Republic of China (PRC). The PRC has the most advanced censorship and surveillance infrastructure in the world. With custom hardware, novel algorithms, and sociological pressures, together considered “censorware,” the PRC has blocked ministries disseminating the Gospel and worshiping online. The PRC exports their technology to other regimes, a growing threat to Gospel distribution. With more censorware experience than the West, the PRC blocks most common mitigations that work elsewhere. Developing an end-to-end solution that defeats Chinese censorware requires a substantial investment of time, talent, and treasure.

A new networking technology, Maodun (矛盾), developed by Hacktera, solves the issues that break existing censorware evasion technology. Maodun demonstrates simple cryptography, high throughput, high availability, physical-world trust over digital-world trust, and a modular design that makes improvements and adaptations less costly.

How does the Internet work?

The Internet is a mesh of computer networks of varying sizes that speak an agreed set of protocols. It is a network of networks. A packet traveling from Hacktera’s offices in Los Angeles to Baidu’s Beijing datacenter takes a path through the Internet by moving through enormous independent networks, called autonomous systems (AS). It moves “up” the Internet to provider networks, “across” to roughly equally-sized peer networks, and then back “down” through smaller customer ones. While not moving in any physical sense, “height” here represents an economic hierarchy between providers dictated by game theory.¹ An economic law dictates that a customer network must pay a provider network to transit its traffic, while a peer network does not pay to transit traffic to another peer or customer. As a consequence of these economic relationships, the networks at the top are faster, more lucrative, and more mission-critical. The largest provider networks connect more and farther flung parts of the world. A packet traveling from Hacktera’s offices in Los Angeles to Google in San Francisco will usually transit through fewer, smaller AS’es than one headed to Beijing.

Devices connected to the Internet send messages using IP, the Internet Protocol, which requires a sending address, a receiving address, and other metadata to prevent corruption. Operating systems disambiguate between applications at the same address by assigning an additional tag to traffic: a port number. This port number is nested inside the IP packet.

A sending IP address, receiving IP address, sending port, receiving port, and the transport protocol type (UDP or TCP, both covered later) uniquely identify a service on the Internet.

How does the Internet work in the PRC?

The Ministry of Public Security (MPS) has forced state-owned Internet Service Providers (ISP’s)² to deploy advanced censorship and surveillance at the “highest” level of their networks: the links for traffic leaving China (“egressing”).

Censorware cannot usually conduct serious, deep packet inspection at line rate (the rate at which traffic ideally flows through a network). The MPS reserves the most aggressive monitoring for traffic whose performance they do not mind punishing: Traffic headed to foreign companies. They perturb domestic traffic with as little censorship as possible. Like the West, throughput (the amount of data sent over time) matters to customers. PRC ISP’s do not want to incur performance penalties unless forced. At the lowest level (called the last mile), the MPS applies pressure in nontechnical ways. They might send an officer to a home to inspect a server without a license. Platform-as-a-service companies like Alibaba refuse services to unregistered companies.³ Since MPS deploys these technologies when egressing, Hacktera explored ways servers could operate from the last mile.

Review of existing solutions

In practice, companies rarely host a server from the last mile. ISP’s often rate limit uploads because smaller AS’es pay provider AS’es to transit information to others. It eats into their profits. The advantage of having a server at the top also means fewer hops through fewer networks and fewer punishments on upload speed.

Peer-to-peer networking broadly encompasses technologies that allow server hosting at the last mile. Peer-to-peer is a rich area of research with many great, domain-specific solutions. Some existing peer-to-peer approaches approximate a censorware circumvention solution and have serious flaws or tradeoffs.

CJDNS. CJDNS seeks to create a new set of protocols for an Internet v3.0. It has a clever algorithm for adapting to failures in the network based on extensive academic research. Unfortunately, it is slow, provides no guarantees on packet delivery, and requires IPv6 (an updated addressing scheme for IP) which has spotty support globally.

Yggdrasil Network. Yggdrasil creates a relay-overlay network, a simulated network on top of the Internet, so a mesh of users can serve content to one another directly. It has a simple network topology, a tree, to make routing easier at the cost of performance. Its simple topology means problems related to client discovery are much simpler. Its downside is slow performance due to many hops. Its underlying usage of TCP and TLS makes it easy to block.

IPFS. IPFS, short for Interplanetary File System, seeks to preserve data uploaded to the Internet forever. It creates an immutable record of all content added and creates references to uploaded data tied to the content of the data itself (content-based addressing). Immutability means data cannot be destroyed and the integrity of the data is built into its addressing scheme, a strong mitigation against corruption from a bad actor. TCP and TLS-based, it is already blocked in the PRC. Moreover, data immutability may not be desirable (e.g. users may wish to delete a list of members of a house church when someone gets arrested).

Zerotier. Zerotier is a software-defined networking solution and software library which connects applications in a simulated mesh similar to CJDNS and Yggdrasil, but with better performance from centralization. It has robust NAT hole-punching (see Networking) features. It requires orchestration servers, which are already blocked in the PRC. It has a billing model which charges “per-device.”

Wireguard. Wireguard creates fast, encrypted point-to-point connections. It has diverse support in a variety of operating systems, making it extremely fast and stable. Its cryptography is modern.⁴ It has no obfuscation, so its traffic is easily identified and already blocked within the PRC. It has no solution for key distribution. It is also difficult to embed in an application, since management is handled by the kernel.

Freenet. Freenet is a pseudoanonymous alternative blogging and file-sharing network. It has a simple protocol design and a variety of clients which can access it. While viewing content is simple, hosting content requires manual firewall modifications. It has been blocked in the PRC for years and has struggled with hosting child pornography.

OpenVPN. OpenVPN is an application which creates a point-to-point connection between devices, similar to Wireguard. It uses TLS and is well supported by a variety of operating systems with rich tooling. It is battle-tested and commonly used in corporate settings. Its TLS core makes it unusable in the PRC. Like Wireguard, it has no solution for public key distribution. Its configuration system is complex, often resulting in catastrophic misconfigurations.

Blockchain. Blockchain encompasses a family of solutions too complete to be covered here in detail. Broadly speaking, a blockchain is a public, shared database, resilient to adversarial modification. Filecoin, just one example of blockchain, is built on top of IPFS and creates economic incentives for immutable file storage. Filecoin suffers from the same issues as IPFS and is expensive because of speculation on its digital currency.

Bittorrent/µTP. Bittorrent is an easy-to-use system for distributed and concurrent file sharing. Seeders, users who have download content, register their copies with trackers, the servers responsible for coordination. Trackers send the location of content to those searching for it so a user can download a massive file, like a video, in chunks, in parallel, from distinct seeders. Bittorrent has a history of piracy. The underlying protocol used in Bittorrent is µTP. Wisely designed, it optimizes its traffic not to exhaust the bandwidth on a link, running silently in the background. Bittorrent has inconsistent support in China due to its relationship to piracy. µTP has no support for NAT hole punching, no documentation, and has not been updated since 2018. Bittorrent has also begun a digital currency monetization strategy. It may become cost prohibitive.

Below is a feature matrix showing the status of various solutions, their transport layer type, approach to cryptography, whether it is blocked, if it implements NAT hole punching, if it attempts to solve public key distribution, if it attempts self-healing, and if it contains a foreign function interface for embedding inside existing software.

These solutions make valiant efforts in many of the areas required for censorware-resilience in the PRC. Nonetheless, no one solution provides enough of the complete set of features.

What does a technology need to survive in the PRC?

Advantageous economics

Costly to block. Deep packet inspection requires ISP’s to degrade user experience. If ISP’s in China were to place this technology everywhere, users would complain about service, operational costs, and becoming noncompetitive. ISP’s pay handsomely for dedicated teams to optimize and filter traffic at scale.

Maodun forces the MPS to look in more haystacks (filter more traffic) for needles that look more like hay (hard to discern good traffic from bad). Looking for one person evading censorship degrades everyone else’s experience, especially when detection requires computing power. Keeping traffic in the lowest networks means evading simpler blocks, requiring ISPs to punish all users, and to spend more money. Maodun routes to servers near users using traffic difficult to detect.

Cheap to unblock. The power of present-day censorware in the PRC would have been unfathomable in 2010. A robust censorware-evading platform must not require a complete rebuild to adapt to improvements. Maodun decouples the obfuscation layer from the encryption layer, and the encryption layer from the transport layer. Maodun’s decoupled obfuscation layer means new evasion approaches can develop in parallel with improvements to encryption and throughput.

Zero marginal cost to use and run. Evaders are resource poor. An ideal method for evasion ought to have zero marginal cost. It should not cost any more than what users already pay for compute and Internet access. Costs for those supporting the network should not scale linearly. Proprietary solutions for networking, storage, or distribution likely present an insurmountable barrier to adoption in the PRC. Solutions like Tailscale and Zerotier, while high quality, require monthly subscriptions at Western prices. Blockchain-based solutions like Filecoin have a price-per-byte that exceeds traditional hard-drives. With Maodun devices owned by the users do the computation and users transmit over links for which they are already paying.

No expertise required

No custom hardware. While the world builds lots of hardware in the PRC, they cannot simply have that hardware domestically distributed. Some ministries manufacture thumb drives in the PRC. When distributing in the PRC, thumb drives must be exported, reimported, and then distributed. Manufacturers do not wish to take legal responsibility for distribution and require laundering.

Maodun is a software-only solution. Maodun does not require custom hardware and runs on standard Android/iOS devices and Windows/MacOS/Linux. It includes optimizations to run on low-end Android phones and spare computers. Users already know how to charge a phone and keep a laptop connected to WiFi.

Zero configuration required. Existing solutions require out-of-app phone settings changes (e.g. Wireguard, OpenVPN), configuring firewall rules for endpoints and WiFi access points (e.g. Yggdrasil, CJDNS, libutp), or purchases (e.g. Tailscale, Blockchain/Filecoin, Zerotier). Maodun requires no configuration besides installation. Maodun runs on unrooted, unmodified Android devices (iOS is supported but incomplete), MacOS, Linux, and Windows devices. The Maodun protocol works using standard Internet protocols and expects to be run from inside a standard home WiFi network without requiring any firewall exceptions.⁵

Trusted on the ground

Leverages real world expertise. Placing a lock on the screen can provide an illusion of security, but when threat of imprisonment exists, users approach technology with skepticism. Users who have not been caught over time have robust techniques for evading. Rather than using digital trust exclusively, solutions for the PRC should take advantage of physical world experience. Giving users choice increases trust and allows for creative mitigations unknown to academics and developers.

None of the existing solutions integrate physical world trust.⁶ Users do not understand what a “public key” does in a blockchain, but they do understand the risks in handing someone a physical “key” to their house. Maodun mimics existing physical world trust by forcing users to share a QR code to connect to a network.

Apolitical and nonviolent. Some existing projects (e.g. Freenet, Bittorrent, Tor) have histories involving the distribution of child pornography or public crypto-anarchist manifestos. A political context around a technology creates unnecessary risks for users.⁷ Politicizing technology has a chilling effect on adoption. Maodun has neither history nor public presence.

Risk and engagement parity. Risk is the probability of an adverse outcome, multiplied by its impact. In decentralized networks, if users do not have control over data hosted locally (e.g. Bittorrent, Filecoin), risk from the whole network is amortized evenly across all users. In the best case, users who have “below average” risk tolerance refuse to join or leave. In the worst case, “risk arbitrage” promotes a tragedy of the commons, where a bad actor hosting child pornography decreases his or her risk at the expense of others.

Any solution for the PRC must have parity between risk and desired engagement with the technology. Technologies should require voluntary opt-ins to higher levels of support and risk.⁸ Maodun attempts to model this using two common laws from network effects: the 90-9-1 Rule (90% of users simply view content; 9% actively engage; 1% create content) and a Pareto distribution (the 80/20 rule, or 50/1 rule). Maodun clients pull down content and do not share. Maodun servers distribute content, but only to trusted clients. Maodun relays, the most exposed, only negotiate connections between clients and servers and do not distribute content. 1 relay can negotiate for 9 servers, and 1 server can host 10 users. The 1% of relays likely accept 50% of the risk.

Web-like experience

Low latency, high bandwidth for users. Centralization optimizes for performance and economies of scale (e.g. Tailscale, Zerotier). Decentralization optimizes for availability and data durability (e.g. Yggdrasil, CJDNS, Tor). Developers program to the latest technology, forcing dated technologies into retirement. Users may accept a 20% hit for performance, but likely not an 80%. Decentralized solutions have greater data durability but higher latencies.

Maodun blends decentralized servers (for resiliency) with centralized relay servers (for fast connection initialization). Rather than requiring data to take several hops through an overlay network, Maodun negotiates a traditional path through the regular Internet, encrypted end-to-end to a nearby server. The proximity of the server to the user increases performance. In exchange, Maodun requires at least one relay to be active for the network to function.

Simple integration, least surprise for developers. Connectivity means nothing without compelling applications. The lower the barrier to entry for developers, the greater likelihood of success in the go-to-market. Maodun follows the same build processes as other dependencies⁹ and verisimilitude to traditional Internet traffic (IPFS, Tor).

Maodun has been written as a cross-platform library exposing a simple interface that runs on iOS, Android, MacOS, Windows, and Linux. It is easily integrated into Java, Kotlin, Swift, or Objective-C using standard dependency management experiences for those platforms. The more developers have to learn, the slower the release cycles: Maodun attempts to reflect the Fetch API used in standard web and mobile application development by exposing an API indistinguishable from standard TCP/TLS connections.

“Reasonable” cryptography

Standard encryption algorithms. Secure channels require three properties: confidentiality (indistinguishability from randomness), integrity (message immutability), and authentication (proven identities). Almost all¹⁰ existing solutions claim confidentiality and integrity. However, some solutions use bespoke encryption algorithms (e.g. CJDNS, Zerotier) that have not undergone rigorous review. Maodun eschews novel cryptography in favor of standard algorithms like TLS and the Noise protocol framework, facilitating auditing and leaning on decades of cryptanalysis.

(Likely) sufficiency of pseudoanonymity. Anonymity is the property that the probability any one member of a group of size N committed an action is 1/n. Pseudoanonymity ties a pseudonym to an action, but the pseudonym cannot be “mapped back” to a real identity, a much more subjective property. Nonrepudiation, to some extent an inverse of anonymity, is the property that an entity taking an action cannot deny he or she took it.¹¹

Tor provides anonymity by “laundering” traffic between nodes in the network. Blockchain provides nonrepudiation and pseudoanonymity with a ledger of actions taken on the system in an immutable, shared, transparent record, linked forever to pseudonyms (public keys). Anonymity kills performance by passing traffic around so much. Nonrepudiation eliminates plausible deniability for participants on the ground. Maodun provides pseudoanonymity via static keys when talking to a relay and anonymity via ephemeral keys when fetching from a server. The relay stores identifying key material to memory for easy destruction, an imperfect solution¹² which tries to maximize plausible deniability.

Resilience

Self healing. Networks that maintain connectivity as nodes connect and disconnect are “self healing.” Some existing solutions self-heal (e.g. Yggdrasil, CJDNS, Tor, IPFS). Most do not and fail when network topology changes (e.g. OpenVPN, Wireguard). An approach for the PRC will require some self-healing. The MPS may confiscate servers. Maodun provides some self-healing via relays. As long as one server for a particular network remains, a relay will attempt to negotiate a connection for a client.

Sybil attack resistance. A Sybil Attack is an attack on a peer-to-peer network where forged or rapidly generated identities can be used to influence or shutdown a network. While technologies like Yggdrasil and blockchains have digital mitigations, Maodun takes a physical approach. Maodun users must get a QR code from others they see face-to-face.

How does Maodun work technically?

Networking

Maodun uses NAT hole-punching to expose services behind home WiFi routers. Most residential ISP’s give a modem one single wide-area-network WAN IP Address, which the Internet sees as the sending address for all devices connected to that modem via a wireless access point.

If devices have the WAN address, routers need a mechanism to send the packet back to the correct device if two devices use the same port number. Using a process called network address translation (NAT), routers make a new NAT’ed port number for a particular service on an internal device as it leaves the network for the global Internet. The router remembers a mapping back to the original port.

It also assigns a local address, LAN IP address to each device on the WiFi so every device on a LAN has a unique IP. The WAN address and NAT’d port identify the service to the Internet. The LAN address and the real port identify the service on the internal network. The WiFi access point handles the mapping on behalf of the client and server.

While a neat trick, this ruins the ability for external clients to connect to a server. WiFi routers do not modify this mapping unless a device from within the internal network initiates. A server would expect a request to be initiated from outside the internal network, headed inbound. The server does not know in advance who may attempt to connect.

To make matters worse, most packets on the Internet use TCP to provide in order, guaranteed delivery of messages. Operating systems which implement TCP maintain the state required for these guarantees. Initializing a TCP connection involves the sending of many packets back and forth in an exact sequence,¹³ all of which must be seen by a WiFi router before it creates a mapping for a particular connection. Worse still, the Chinese government has extremely efficient mechanisms for breaking TCP connections by injecting small errors into this sequence. A more primitive protocol, the universal datagram protocol (UDP), which provides no guarantees whatsoever on order or delivery, can trigger this mapping with a single packet. Unfortunately, UDP applications must manage data unreliability caused by network instability.

Maodun uses UDP to simplify NAT hole punching. It uses QUIC, a protocol originally designed by Google for YouTube, to provide a fast networking stack for guaranteed delivery. By using QUIC, the Maodun networking stack resides mostly in user-space, with kernel-space only required to send simple datagrams. This gives Maodun the simplicity of UDP for hole punching, the guaranteed delivery of TCP, and nearly the speed of a kernel-level implementation.

Cryptography

QUIC requires datagram transport layer security (DTLS), the UDP analogue of TLS for TCP. The MPS has powerful tools for detecting and blocking undesirable TLS and DTLS traffic. Maodun tries not to look like TLS. While many custom protocols contain fixed structure or magic numbers, Maodun makes initialization packets randomly sized and unpredictable.¹⁴ By slightly decreasing the maximum datagram size in QUIC, Maodun has a sliding scale budget of bytes-per-datagram to use for obfuscation. At this time, the maximum datagram size is set to a reasonable maximum, 1,200 bytes (meant to provide cushion for the maximum transmission unit for Ethernet at 1,500 bytes).

Should detection become an issue, the QR code opens up new avenues for adaptation, since it functions as a secure side-channel. For example, clients, upon receiving the QR code to grant access, could receive an ed25519 public key for a relay. This allows client relay connections to be guaranteed to be with a trusted relay.¹⁵

The obfuscation layer sends unpredictable initialization packets that are indistinguishable from randomness before activating encryption. It will be impossible for an attacker to discern between a random stream of bits and the start of a Maodun stream. To make detection more computationally expensive, obfuscation techniques could also make the traffic seem less encrypted, forcing ISP’s to exert more computing power to detect it. For example, decreasing throughput by 20% might be sufficient to make traffic look “compressed” instead.

Cross-platform library: libmaodun

Maodun is implemented as a software library which can be imported into any language with support for a foreign function interface (FFI) into the C application binary interface (ABI).¹⁶ The Rust programming language provides the cross-platform operating system primitives for concurrency and networking needed to support Maodun. Bindings into Java/Kotlin already exist at this time for use in Android.

The QUIC network stack itself is taken directly from Cloudflare’s library, Quiche, which currently supports 8.4% of all of Cloudflare’s traffic, which is itself 2.9% of traffic to the top 10,000 websites worldwide.¹⁷

Connection negotiation

Relay. The relay utilizes the MaodunServerSocket provided by libmaodun to listen to messages from clients and servers. It has a second hidden, ephemeral port called the beacon socket, which is a classic UDP socket. The beacon exists to make servers aware of their WAN IP addresses and NAT’ed port. Client IP addresses can be inferred from the sending IP address and port in relay connection packets. Clients reuse their relay socket to connect to the server, so it is usually the case¹⁸ the server will expect a packet from the same WAN IP and NAT’ed port seen by the relay.

Servers require two distinct Maodun sockets, a MaodunClientSocket to connect to relays and a MaodunServerSocket to receive direct requests from clients.

The WAN IP and NAT’ed port cannot be inferred for the server’s server socket (it never initiates requests). While some WiFi routers may simply increment NAT’ed ports sequentially, this behavior is not standardized. Many routers randomize these ports to prevent fingerprinting.

The relay learns the mapping on behalf of the server by sending a single UDP datagram containing a cryptographic response to the beacon via the MaodunServerSocket, a hack made possible by the stateless nature of UDP sockets. This packet does not use the Maodun protocol and happens apart from the QUIC stack. If the cryptographic response is correct, the relay alerts the network that the server is live at its WAN IP and NAT’ed port (for the server socket). The server’s MaodunClientSocket remains open to respond to push requests from the relay for inbound connection requests.

Server. After relay negotiation, the server is now ready to listen for connection requests for clients via the relay. A connection request contains the client WAN IP, NAT’ed port, and cryptographic material for securing the direct connection. The server punches a hole through its firewall by sending a dummy message to the client WAN IP address and NAT’ed port. It is sent so that the server WiFi access point is tricked into expecting a message from the client. With this hole opened in the firewall, the client can reach the server and initialize a secure Maodun session.¹⁹

Once a connection is established, Maodun uses a binary protocol format (bincode, used internally in Firefox) for RPC. A binary format eliminates many security issues that come with parsing complex formats like JSON or HTTP.

The server is a desktop application written for Windows, MacOS, and Linux. Unlike Electron applications, which ship an entire version of Chromium to run the user interface, Maodun uses libwebview2, libwebkit, and libwebkit2gtk on Windows, MacOS, and Linux respectively to support a user interface built on web tech in a small download. The user interface contains a minimally styled installer with information on current connections for debugging. Today, it is a proof-of-concept. A future interface could contain automatic updates, the ability to join like-minded networks, or security alerts.

With regards to asynchronicity, the server uses non-blocking event loops (i.e. Rust’s Tokio framework) extensively to support concurrent requests and minimize CPU and battery usage.

Client. The client is a minimal YouTube clone written in React Native for Android and iOS. A Javascript interface to libmaodun has been exposed to provide developers a JSON interface that looks and feels similar to the Fetch API. libmaodun has no hard dependencies on either Android or React Native.

The client opens a connection to a relay using cryptographic material and information provided from the QR code. Clients request a connection to a network for which it has a valid cryptographic credential (e.g. a network called “Hacktera.”) The relay finds a live server joined to the “Hacktera” network and informs the server of an inbound connection request. The client receives the cryptographic material and connection information necessary to directly connect to the WAN IP and NAT’ed port of the server from the relay. Finally, the client conducts a handshake to exchange ephemeral keys that rotate with each new connection. Once established, bincode messages are sent for RPC to the server.

Known examples of deep packet inspection

Below are some specific examples of censorware algorithms used today within the PRC:

1. TCP resets: Breaking TCP connections by injecting fake packets that simulate a catastrophic error.
2. Encryption detection and rate-limiting: Slowing encrypted traffic down so applications performance degrades. Users adopt unencrypted alternatives.
3. Weakening encryption: Preventing confidential connections (e.g. TLS 1.3) by forcing users to downgrade to algorithms that leak information or can be hacked.
4. DNS poisoning: Blocking secure IP address lookups or causing users to connect to MPS servers instead.
5. Credential harvesting: Listening on a huge range of addresses for server connections and intercepting credentials for those without key pinning.²⁰

About the report

This report was prepared by Hacktera, a cybersecurity consulting firm. Hacktera provides consulting to aid organizations under attack from nation-state cyberwarfare. For more information about Hacktera and its services, visit hacktera.com.