巨炮是一个分离的，在路上的系统
As noted previously, our traces of GFW operation showed both the injected TCP Reset, as well as the legitimate server reply. In contrast, no legitimate server reply accompanied the injected malicious reply from the GC. We ran further testing, where we retransmitted our request to Baidu over the same connection, and with the same sequence numbers, after we received a malicious response. We observed Baidu responding as normal to the retransmitted request. Thus, we conclude12 that the GC dropped our request before it reached Baidu, a capability not present in the GFW.13
之 前我们提到，对于GFW行为的追踪显示了注入的TCP Reset包和合法服务器回应是同时存在的。与之相反，来自巨炮的被注入的恶意回复就没有合法服务器回复伴随出现。我们继续深入测试，在收到恶意响应之后 再在同一连接上重传对百度的请求，序列号与之前的请求相同。我们观察到百度对于重传请求的响应很正常。因此，我们得出这样的结论[12]：巨炮在我们的请 求到达百度服务器之前把它丢弃了，这是一个和GFW不同的能力[13]。
We also checked whether the GFW and GC might share the same injector device,14 but found no evidence that they do. In particular, from a given TCP source port, we sent one request designed to trigger GC injection, followed by a request designed to trigger GFW injection. We repeated the experiment from a number of source ports. While packets injected by both the GFW and GC exhibited a similar (peculiar) TTL side-channel indicative of shared code between the two systems, we found no apparent correlation between the GFW and GC TTL values themselves.
17/26 首页 上一页 15 16 17 18 19 20 下一页 尾页
|
