iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
China’s Great Cannon was a traffic-manipulation system that researchers documented in 2015 being used to turn unsuspecting web visitors into participants in denial-of-service attacks against services that helped people circumvent Chinese censorship. It was distinct from the Great Firewall: the firewall was described as a censorship and filtering system, while the Cannon could inject or suppress selected traffic.
What happened in the 2015 attacks?
Citizen Lab reported that GreatFire.org observed a distributed denial-of-service (DDoS) attack on March 16, 2015, against servers it rented to make blocked websites accessible in China. On March 26, two GitHub pages operated by GreatFire came under the same type of attack. The researchers observed the campaign through April 8. Citizen Lab published its analysis, Report No. 52, on April 10, 2015; a technical paper by the researchers was presented at the USENIX Workshop on Free and Open Communications on the Internet in August 2015.
The targets were services and repositories associated with censorship circumvention. The documented campaign does not establish that every later attack against a China-related website used the Great Cannon.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How did the Great Cannon enlist web visitors?
In the researchers’ account, the system intercepted selected unencrypted traffic to Baidu infrastructure hosting widely used scripts, such as analytics, social, or advertising code. It altered selected JavaScript responses so that browsers receiving the changed code requested content from the targeted GreatFire and GitHub services. Those browsers then generated traffic against the targets. Their users were bystanders: they did not knowingly choose to take part in the attacks.
#1 Best Overall
This account describes traffic manipulation involving Baidu-hosted scripts; it does not show that Baidu authored or knowingly served the attack code. GreatFire’s account identified malicious JavaScript returned by Baidu servers, while Baidu denied that its servers had been compromised.
How was the Great Cannon different from the Great Firewall?
Citizen Lab and the USENIX paper describe two distinct systems. The Great Firewall was characterized as an on-path censor that monitors cross-border traffic and can inject forged TCP reset packets to terminate selected connections. The Great Cannon was described as an in-path system capable of injecting and suppressing traffic for selected target addresses. That position gave it man-in-the-middle capability over those selected flows.
| Aspect | Great Firewall | Great Cannon |
|---|---|---|
| Role in the researchers’ account | Censorship and filtering | Targeted traffic manipulation and attack |
| Network action | Observes traffic and can inject forged TCP reset packets | Can inject or suppress selected traffic |
| Scope | Examines traffic for censorship rules | Selectively intercepts flows involving target addresses |
| Relationship | Established censorship apparatus | Separate system, described as co-located with the Great Firewall and sharing some code characteristics |
| Evidence discussed | Normal blocking operation | DDoS activity observed in 2015; other uses discussed as potential capabilities |
As the Citizen Lab report authors collectively put it, “The Great Cannon is not simply an extension of the Great Firewall, but a distinct attack tool that hijacks traffic to (or presumably from) individual IP addresses, and can arbitrarily replace unencrypted content as a man-in-the-middle.” (Citizen Lab Report No. 52, April 10, 2015.)
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat did researchers say the system could do beyond the observed campaign?
The documented 2015 operation involved changing script traffic to help direct browsers’ requests at GreatFire and GitHub. The researchers separately warned that the architecture could allow targeting by IP address and could potentially deliver exploits to users visiting China-based websites that did not fully use HTTPS. They presented this as a possible capability, not as an observed use in the documented campaign.
Rank #3
- non-fiction african american book set
- non-fiction black book set
- non-fiction african american children's book set
- non-fiction black children's book set
HTTPS can protect content in transit when it is correctly and fully used, limiting an on-path attacker’s opportunity to replace a script. It should not be read as proof that users are immune to every attack: the report’s point was that connections to China-based sites that were not fully protected could expose users to this kind of manipulation.
Who did researchers believe operated it?
The authors assessed the Great Cannon as likely operated by the Chinese government. Their assessment drew on shared code characteristics and network locations with the Great Firewall, the political relevance of the anti-censorship targets, and the campaign’s scale and visibility. The report also notes that the precise authorities, operators, and institutional origins are difficult to identify. Its discussion of possible high-level authorization is an inference, not a public record identifying a specific order or operator.
The authors described the deployment as “a significant escalation in state-level information control: the normalization of widespread use of an attack tool to enforce censorship by weaponizing users.” This is their evaluative conclusion, rather than a directly measurable technical finding. (Citizen Lab Report No. 52, April 10, 2015.)
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What is established about the Great Cannon today?
The primary report and conference paper covered here establish a historical 2015 case: the traffic manipulation, the DDoS targets, and the researchers’ assessment of possible capabilities and attribution. They do not establish whether the Great Cannon is currently deployed, whether it was used in later incidents, or who its individual operators were.
Quick Recap
Primary sources
- Citizen Lab, “China’s Great Cannon,” Report No. 52, April 10, 2015
- USENIX, “An Analysis of China’s ‘Great Cannon,’” presented at FOCI 15, August 2015
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
