The ideal audience to review this material would be a Task Force of Senior Cybersecurity Researchers and Network Security Analysts specializing in state-sponsored threat intelligence and large-scale infrastructure vulnerabilities.
Abstract:
This technical briefing details the discovery and exploitation of two major data leaks concerning the Great Firewall of China (GFW). The first, designated "Wallbleed," is a significant memory disclosure vulnerability within the GFW’s DNS injection infrastructure. By manipulating the length labels in DNS queries, researchers successfully induced the system to leak up to 124 bytes of uninitialized memory per response, exposing millions of HTTP cookies, plaintext passwords, internal private network traffic (RFC 1918), and x86_64 stack pointers. This vulnerability persisted through multiple patching attempts between 2021 and 2024.
The second leak involves a 600GB data dump from Geedge Networks, a firm linked to the GFW’s foundational architects. Analysis of this source code and documentation confirms the integration of Deep Packet Inspection (DPI) platforms, such as the MISA platform, into the GFW’s regional and national tiers. Furthermore, the leak reveals that Chinese censorship technology is actively exported to other nations, including Pakistan, Myanmar, and Ethiopia. The presentation concludes that censorship infrastructure is susceptible to traditional software exploitation, posing a significant privacy risk to global internet traffic routed through Chinese networks.
Technical Summary and Key Takeaways:
0:50 GFW DNS Injection Mechanics: The GFW utilizes a bi-directional DNS injector that monitors traffic for blocked domains and sends forged responses with bogus IP addresses. Research identifies three distinct injectors; "Injector 3" was found to be uniquely vulnerable to memory disclosure.
3:44 Discovery of Wallbleed: While probing the DNS system, researchers discovered that malformed DNS queries—specifically those with incorrect label lengths—caused the injector to append internal buffer memory to the DNS response rather than legitimate record data.
5:20 Exploitation Vector: By setting a DNS label length to 0xFF (255) while providing a shorter string, the researchers triggered a memory leak. Optimized probes using 4-byte domains (e.g., 4.TT) maximized the leaked payload to 124 bytes per packet.
7:56 Longitudinal Data Exfiltration: Over a two-year period, researchers collected 5.1 billion Wallbleed responses. Analysis via regular expressions revealed the exposure of over 2 million HTTP cookies, 27,000 URL parameters containing passwords, and SMTP commands exposing private email data.
9:03 Internal Infrastructure Leakage: The leaked data contained internal GFW management traffic, including SSDP and UPnP packets with private (RFC 1918) IP addresses. This suggests the GFW's DNS injector shares memory buffers with internal network management processes.
11:42 Side-Channel Patch Monitoring: The leak included x86_64 stack and code pointers. By tracking changes in these pointer patterns, researchers were able to identify exactly when the GFW administrators deployed software patches and updates to the injection clusters.
14:51 Geedge Networks Source Code Leak: A 600GB leak from Geedge Networks provided the first look at the GFW's internal DPI logic. The data contains source code for the "MISA" platform and a custom memory allocator internally named "Dictator Malloc," designed for high-performance server appliances.
21:05 Global Export of Censorship Tech: Documentation within the Geedge leak confirms the sale of Chinese censorship and surveillance software to international customers in Myanmar, Pakistan, Kazakhstan, and Ethiopia, often following "Belt and Road" initiative pathways.
23:06 Multi-Layered Regional Deployment: Unlike a single national monolith, censorship is often implemented at the ISP level via mandates. Geedge software is frequently deployed at regional nodes rather than solely at the national gateway, leading to multiple redundant injection events for a single query.
29:11 IPv6 Injection Anomalies: Researchers noted the GFW's IPv6 injector behaves differently, often sending "broken" Teredo-encoded addresses (2001:: followed by an IPv4 address) to prevent resolution, though errors in the system have historically redirected users to unintended destinations, including pornography.