A Glitch in China's Great Firewall Is Sending People to a Polish Travel Blog

Living inside the Great Firewall turns using the internet into a game of cat and mouse, especially for a foreigner like myself who spends massive chunks of his life using Google, YouTube, and Facebook—all of which are blocked in Mainland China. However, over the last few days, the internet situation here has gone from annoying to bizarre, in ways that only the Chinese government could dream up.

The beginning of the year saw a crackdown on VPNs, the most common way of leaping over China's infamous Great Firewall. The wave of blocked sites didn't exactly come as a surprise, given the increasingly conservative stance of the country's new leader, Xi Jinping. Still, this caused no shortage of grief to both free speech activists and foreign exchange students were dying for a Netflix binge.

Naturally, a wave of new, unblocked alternative VPNs appeared in the aftermath of the crackdown. But starting around April 26th, my outbound internet traffic was occasionally redirected towards two websites: wpkg.org and ptraveler.com, that latter of which is still down.

In my experience, normally uncensored foreign websites would initially load, but then immediately redirect my browser to either of the above addresses. The content of these two websites made the situation even more inexplicable: why was my browser sending me to the wiki for a software distribution company and a Polish couple's travel blog?

As interested as I was in Tomek and Dasza's thoughts on "Japanese food models and kitchen supplies at Kappabashi," the redirects quickly became a giant pain in the ass. To be honest, I initially thought it was a glitch on my end, maybe malware on my laptop or my dorm's router.

However, a report in the Beijinger showed that this was clearly something more concerning. According to their article, the problem was far from isolated, with many foreigners in China having the same problem when trying to access normally-uncensored foreign websites. Chinese-native users also began to report the issue.

China's internet censorship is absolutely unpredictable, and why a given website is or isn't censored is often anyone's guess. But this new issue, watching a normally-unblocked website change into a completely different one without warning, is pretty novel.

An assessment from Channel News Asia, and the work of a few reddit users, found that the issue occurred whenever a Chinese IP address tried to access a foreign website with a "Facebook Connect" option.Facebook Connectis the code that allows you to log into websites via your Facebook account, which is to say, almost every major website.

According to Brian Krebs, who confirmed the Facebook Connect anomaly, the issue was apparently fixed relatively quickly, but it stuck around for so long most likely because it was cached in users' Domain Name System caches. Basically, a likely mistake on the part of Chinese censors was propagated throughout the Chinese web, and persisted because of how the web works.

The nationwide redirect problem was particularly unsettling because it came just a couple weeks after the reveal of the so-called "Great Cannon," a powerful new hacking tool controlled by the Chinese government.

An April 10th report by Citizen Lab, a University of Toronto-based research group, first described evidence the Great Cannon—a name that references the Great Firewallthat controls and censors the Chinese internet. Simply put, Citizen Lab's research suggests that the Chinese government has found a way to take each of their 200 million internet users and get them to unknowingly send requests at a website until it crushes under the stress.

If you've ever heard the urban legend about everyone in China jumping at the same time so that the Earth is knocked off its axis, this is effectively the digital equivalent of that, and a potent tool to shut down websites it views as contrary to its interests.

The report analyzed two previous attacks on Github aimed at taking down a pair of pages run by the anti-censorship site Greatfire. While the attacks only lasted for about five days, Citizen Lab's report suggests that the methods of doing so were unprecedented.

Suspicious of of the redirect following the Great Cannon reveal, I reached out to Dr. Nicholas Weaver of the International Computer Science Institute to see if they could be related. He stated that he strongly believes "it was an error in the existing DNS censorship in the Great Firewall."

"I don't believe it has anything to do with the Great Cannon," he said. "This is not the first time this has happened. Not only was there the Greatfire redirection, but there have been other cases where some domains get redirected to just random web hosts. So odds are that the two sites were just unfortunately unlucky."

When looked at as a whole, this entire incident was a perfect example of the constant state of confusion many Chinese internet users operate in—especially the foreign, VPN-reliant contingent. Personally, I've seen many of my friends try to log into Facebook, get locked out, and go on a tangent about the evils of communist censorship, only to find that their wifi was never on in the first place.

But this likely mistake shows exactly what happens when a country has massive censorship capabilities: users get paranoid, and you never quite know if you're accessing what you want. The paranoia is caused both by the heavy-handed censorship and the hilarious levels of incompetence in play. Only here could a network error accidently throw the web traffic of much of a nation at some poor Polish couple's travel blog.

You could even take this as a metaphor for living in China: Life is mostly normal, expect the constant feeling that you're being manipulated.