TSPU: Russia's Firewall and Defending Against Digital Repression

TSPU: Russia's Firewall and Defending Against Digital Repression

Speakers: Benjamin Mixon-Baca

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=zcdEX1ZgXzY

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Benjamin%20Mixon-Baca%20-%20TSPU%20Russia%27s%20Firewall%20and%20Defending%20Against%20the%20Future%20of%20Digital%20Repression.pdf

Overview

Benjamin Mixon-Baca delivered a deeply technical dissection of Russia's TSPU (Tekhnicheskoe Sredstvo Protivodeystviya Ugrozam, or Technical Means to Counter Threats) — the in-path deep packet inspection (DPI) infrastructure at the heart of Russia's internet censorship apparatus. Unlike China's Great Firewall, which operates on-path via packet injection, Russia's TSPU devices are deployed inline at ISPs and data centers, giving them the ability to throttle, block, and redirect traffic rather than merely inject resets. Mixon-Baca combined legal and policy context with hardware-level analysis and network protocol exploitation, then presented two novel censorship circumvention strategies: a server-side simultaneous-open TCP bypass and an accidental client-side bypass discovered through serendipitous experimentation with TCP ACK sequences. The talk also covered the emerging threat of backdoored VPN applications filling the void created by Russia's VPN crackdown, including apps linked to China's People's Liberation Army.

Background

▶ Watch: Digital repression: how authoritarian governments use TSPU-like systems (0:08)

Russia's censorship infrastructure is built on a foundation of legislation. The most relevant law is Federal Law No. 90-FZ, the "Sovereign Internet Law," which outlines which entities must comply with censorship directives (network operators, ISPs, data centers) and establishes Roskomnadzor (RKN) as the enforcement authority. Among the content Russia blocks are CNN, X (formerly Twitter), Google, Voice of America, and broadly anything deemed politically destabilizing.

The specific hardware enforcing this policy is the Ecofilter DPI, manufactured by the Russian company RDP.ru, which won a competitive government bid that involved 12 vendors. What distinguishes the Ecofilter from competing products is its performance: while other DPI devices operate at roughly 10 Gbps, the Ecofilter's data sheet claims processing capability exceeding 100 Gbps for a single device. This makes it technically credible as an inline, full-path inspection device — a much harder engineering problem than on-path inspection.

Russia's censorship is part of a broader sovereignty stack. In addition to the TSPU hardware, Russia has built: a national DNS service (NDNS) to control domain resolution; a national root certificate authority embedded in Russian-developed apps (such as Yandex Browser) to enable TLS interception; BGP route lockdown via RPKI (Resource Public Key Infrastructure) to prevent traffic from being rerouted around censorship points; and ISP-level enforcement to ensure compliance. The result is a layered, defense-in-depth approach to digital sovereignty.

Key Findings

▶ Watch: How TSPU implements internet censorship and surveillance (2:37)

In-path versus on-path deployment. The most significant architectural difference between Russia's TSPU and China's Great Firewall (GFW) is deployment topology. The GFW is an on-path device — it sees a copy of traffic via port mirroring approximately 14 network hops into the path, can read the content, but can only disrupt connections via reset injection (TCP RST spoofing). The TSPU is an in-path device sitting approximately 5 hops into the network, meaning all traffic passes through it. This enables the TSPU to throttle connections, selectively drop packets, and silently degrade services rather than producing obvious block pages. Throttling-based censorship is harder to detect because it is indistinguishable from network congestion.

The simultaneous-open TCP bypass. While researching Linux kernel connection-tracking vulnerabilities related to VPN security (leading to the team's "Port Shadow" attack), Mixon-Baca's colleague Dwin discovered that if a SYN packet was spoofed from outside Russia to a vantage point inside Russia before the internal client initiated its connection to a blocked server, the TSPU's connection-tracking state could be confused — causing the TSPU to classify the subsequent legitimate traffic as coming from the "server" side rather than the "client" side, and therefore not applying outbound censorship filters.

The accidental client-side ACK bypass. Through experimental TCP packet manipulation, the team discovered that sending five TCP ACK packets before initiating a TLS Client Hello bypasses the TSPU's SNI-based filtering. SNI (Server Name Indication) filtering is the mechanism by which the TSPU identifies blocked HTTPS destinations from the plaintext hostname in the TLS handshake. The team's hypothesis is that the TSPU buffers a certain number of TCP data packets for deep reassembly before checking SNI, and the five-ACK sequence disrupts the TSPU's internal buffer state in a way that causes it to miss or incorrectly process the SNI field.

Backdoored VPN ecosystem. Because VPNs are now illegal in Russia and China (both governments pressured app stores to remove VPN apps), a black market of malicious VPN applications has emerged. The Tech Transparency Project identified connections between several popular VPN apps — including TurboVPN — and China's People's Liberation Army via corporate registration records linking them to Beijing-based entities despite Singapore-claiming websites. Separately, Mixon-Baca discovered that these VPN apps use the ShadowSocks tunneling protocol with a symmetric encryption key hard-coded in the APK. This means anyone able to enumerate the VPN servers' IP addresses can decrypt all user traffic.

Technical Deep Dive

▶ Watch: Introduction: Russia's TSPU deep packet inspection system (3:46)

TCP Simultaneous Open and Connection Tracking. TCP's three-way handshake provides a clear client/server directionality. However, simultaneous open — a legal but rarely used TCP feature in which both endpoints send SYN packets concurrently — creates an ambiguity: the connection-tracking module cannot deterministically determine which side is the originator. Stateful firewalls, IDS systems, and DPI devices must all handle this edge case. The Linux kernel's netfilter connection tracking code, Zeek IDS, and Suricata all contain explicit logic for disambiguating connection direction. The TSPU's firmware follows a similar state machine.

TSPU Connection State Table. The TSPU maintains a global connection-tracking table with per-connection entries containing: the originator connection tuple (internal IP:port → external IP:port), the reply connection tuple (external IP:port → internal IP:port), and the TCP state machine state. The simultaneous-open bypass exploits this table by injecting a TTL-limited SYN from an external server to the internal vantage point. This SYN does not reach the client (it is TTL-expired in transit) but is visible to the TSPU, which records the state as SYN_SENT from the external side. The subsequent legitimate SYN from the internal client creates an inconsistency between the TSPU's tracked state and the actual state at the endpoints, causing the TSPU to treat the legitimate TCP flow as originating from the external server — thereby bypassing outbound filtering checks.

Five-ACK Client-Side Bypass. The TLS four-way handshake involves approximately four to five client-sent ACK packets before the SNI-bearing Client Hello. The researchers found that prepending five additional ACK packets to this sequence confuses the TSPU's reassembly engine. Their working theory is that the TSPU maintains an internal buffer for reassembling TCP segments before SNI inspection, and the extra ACKs cause a buffer state inconsistency that prevents the TSPU from correctly identifying the SNI field, effectively rendering the connection invisible to the filter. This client-side bypass is valuable because it requires no external coordination — unlike the simultaneous-open bypass, which requires a cooperating server outside Russia to send the TTL-limited SYN.

Port Shadow Attacks. Mixon-Baca's prior VPN vulnerability research yielded a connection-tracking attack primitive called Port Shadow, which enables: (1) port scanning of devices behind a VPN without being inside the VPN; (2) deanonymizing or decrypting VPN traffic by exploiting connection state inconsistencies; and (3) rerouting VPN packets — effectively escalating from an adjacent network position to an inline attack position, similar to the TSPU deployment model. This research underscores that TCP connection tracking is a broadly exploitable primitive across firewalls, IDS systems, and VPN infrastructure.

ShadowSocks Hardcoded Keys. The VPN apps linked to Chinese military-affiliated entities used ShadowSocks, a proxy protocol designed to obfuscate traffic. ShadowSocks uses symmetric encryption (AES variants). Mixon-Baca reverse-engineered the APKs for these apps (after deobfuscating the Jiagu packer from Qihoo 360) and found the encryption password hard-coded in the binary. By enumerating the VPN servers' public IP addresses and connecting with the known password, he successfully decrypted captured user traffic — demonstrating that "privacy VPN" providers linked to Chinese military interests had deliberately undermined the encryption protecting their users.

Demo / Proof of Concept

▶ Watch: Global implications and similar systems in other countries (16:42)

Mixon-Baca ran a live network topology demonstration using a virtualized environment modeling a TSPU device (implemented using Linux netfilter with an SNI-filtering kernel module), an internal web client, and an external web server. The demo showed:

1. Baseline blocking: An HTTPS connection to a blocked domain (by SNI) was throttled or blocked by the netfilter-based TSPU simulation.
2. Simultaneous-open bypass: A TTL-limited SYN spoofed from the external server to the internal client, followed by the client's normal SYN, resulted in connection-state confusion that allowed traffic to pass through the simulated TSPU despite SNI filtering.
3. VPN bypass: An OpenVPN connection was established through the TSPU device, demonstrating the concept for further obfuscated protocols (noting that actual vanilla OpenVPN is blocked by the real TSPU, but illustrating the architectural approach).

The decrypted VPN traffic from the reverse-engineered ShadowSocks apps was also shown, with the plaintext HTTP traffic visible once the hardcoded symmetric key was applied.

Defensive Implications

▶ Watch: Techniques for bypassing TSPU restrictions (18:56)

For censorship circumvention developers: The client-side five-ACK bypass is practically deployable without server-side cooperation or user root access, making it suitable for embedding into consumer-facing circumvention tools. The researchers are developing a state-machine-based automated discovery framework using temporal logic (TA+, a logic programming language) to automatically identify new client-side bypass strategies as the TSPU firmware evolves — aiming to replace ad hoc discovery with systematic protocol analysis.

For VPN users in restrictive environments: Backdoored VPN apps present a serious threat that is worse than using no VPN — they may actively exfiltrate user data while providing a false sense of security. Users should vet VPN providers carefully, checking corporate registration records (e.g., OpenCorporates.com), and prefer open-source clients with publicly audited codebases.

For security researchers: The TSPU firmware (EcoFilter DPI) and competing devices (Carbon Filter, whose Linux-based ISO is publicly downloadable) represent a meaningful target for vulnerability research. Finding exploitable vulnerabilities in state censorship infrastructure has obvious dual-use implications but also potential for enabling censorship circumvention at scale.

For network engineers: The connection-tracking vulnerabilities underlying both the simultaneous-open bypass and the Port Shadow attack are present in Linux netfilter, Zeek, Suricata, and similar frameworks. Organizations relying on these tools for stateful inspection should be aware that edge-case TCP behaviors (simultaneous open, unusual ACK sequences) can create exploitable state-table inconsistencies.

Key Takeaways

• Russia's TSPU is an in-path DPI appliance capable of 100+ Gbps throughput that throttles and blocks traffic based on SNI and protocol fingerprinting — a more capable and subtle censorship mechanism than China's on-path GFW.
• Russia's internet sovereignty is a layered multi-component system including NDNS, a national root CA, RPKI-based BGP locking, and device-level certificate embedding.
• Two novel bypasses exploit TCP simultaneous-open ambiguity (server-side, requiring external coordination) and ACK sequence disruption (client-side, requiring no external cooperation).
• The VPN ban in Russia and China has created a market for backdoored VPN apps, some with verifiable ties to the Chinese People's Liberation Army and some that hard-code symmetric encryption keys — rendering user traffic trivially decryptable by the operator.
• The Port Shadow VPN attack demonstrates that TCP connection-tracking vulnerabilities have broad implications beyond censorship, enabling deanonymization and packet rerouting against standard VPN deployments.

About the Speaker(s)

▶ Watch: Tools and techniques for defending against digital repression (37:30)

Benjamin Mixon-Baca is a security researcher specializing in network protocols, VPN security, and censorship circumvention. He has worked extensively on TCP connection-tracking vulnerabilities and their security implications across VPNs, firewalls, and intrusion detection systems. His prior research produced the Port Shadow attack framework, which was presented at a recent academic workshop (FOCI). Mixon-Baca's background includes hands-on work with DPI applications and Linux kernel networking code, giving him both the theoretical understanding of censorship infrastructure and the practical tooling to test circumvention strategies against real-world deployments.