Apple Pulls 60 VPNs from China App Store

http://www.bbc.co.uk/news/technology-40772375

by callumlocke • 9 years ago

127 81 9 years ago

bbc.co.uk

China : "Jump!" Apple : "How high?"

Only thing that concerns Apple is to make money. They don't have a moral ground on issues like these because they are a business.

Don't tell us you would say "no".

aluhut2• 9 years ago

Sure I would. Chinese market is already dominated by Android. Only those with a lot of money can buy Apple and people with a lot of money have influence.

I would love to see the party trying to come up with an excuse for their VIPs and their angry daughters for an Apple block.

IBM• 9 years ago

They absolutely stake out moral positions on issues like these all the time. The difference is they only do it in the West where rule of law prevails and they can actually exert influence.

They've done it with various anti-LGBT efforts that have taken place around the US, they've done it with the fight with the FBI and they're doing it right now in Australia [1], among others.

What they don't do is shoot themselves in the head in some misguided attempt at ideological purity.

[1] https://www.macrumors.com/2017/07/20/apple-talks-australian-...

veidr4• 9 years ago

Speak for yourself, dude.

I would say "no". Tons of us would say "no".

There are various things on this spectrum that any business can choose to do, or not do: use child labor, use political prison labor, dump toxic waste in public streams and rivers (after funding lobbyists to make it legal), etc.

pjmlp• 9 years ago

Actually those silly trainings that most of us have to do at companies of similar size about company culture say exactly that, that it is preferable to lose a business than do immoral stuff.

Of course no one takes them seriously, because the actual reality on the field is that nothing other than profits matter.

justadeveloper22• 9 years ago

Oh, I see, they only take on "moral" issues when it comes to the US elections?

Companies like Apple, Google, and Facebook can sway the world right into totalitarianism via their support of censorship and disregard for basic human rights. If these companies do side with the least common denominator, where does that leave the rest of us?

pilif• 9 years ago

what would be the option? Leaving the Chinese market, having iPhones be pulled from the market and the AppStore blocked by the Great Firewall?

Even without VPN clients, iPhones still provide superior client-side security to a lot of other phones out there.

raarts• 9 years ago

Every business has to follow local law. Same holds for Chinese companies doing business in the US.

veidr4• 9 years ago

Every business has to follow local law. Same held for companies doing business with South Africa under apartheid rule in the 1980s.

Pretending there isn't a moral dimension to it just because "it's business" is absurd.

lostboys672• 9 years ago

Didn't stop huawei pirating ios did it

Shivetya• 9 years ago

All companies jump when the country they are in tells them too. At most we can complain during Apple share holder meetings of our displeasure for them to do business in a country whose activities we do not agree with. There are far greater transgressions happening in other countries than blocking VPN but where is the concern for sales within them?

Lastly, we don't have the right to tell China what is right for China. We can say we don't agree but similarly do we listen to China when they tell us what they don't like?

lostboys672• 9 years ago

So shooting protesting students is ok then at some point a higher law (to quote William H. Seward) takes over

humanrebar• 9 years ago

...do we listen to China when they tell us what they don't like?

If they have good points, yeah. Grading ideas based on the source is a good way to stay ignorant.

the-dude• 9 years ago

This comment has no substance and is essentially flamebait.

veidr4• 9 years ago

Really? To me it sounds more like an abbreviated way to say:

"Despite their polished 'Designed in California' efforts to strike a tone that resonates with the affluent organic free-range eco-democratic westcoast set, when the rubber hits the road, Apple kowtows to authoritarian despots if the profits are 'iphone-scale'."

Does that also sound like flamebait to you? If so, then I suggest you introspect about where and why your fires burn.

junkculture3• 9 years ago

I'm sorry you're taking it that way.

Did Apple cooperate with the FBI when they asked to help with the Pulse Club terrorist? No.

pestrov• 9 years ago

Seems like something similar would happen in Russia this Fall too. https://www.reuters.com/article/us-russia-internet-idUSKBN1A...

loceng• 9 years ago

Hasn't Russia been trying to buddy up with China? And Turkey and the Philippines are going through interesting transitions as well.

unstatusthequo• 9 years ago

It's fine, the Chinese piracy apps will continue to support freedom of information. </snark>

The irony of that is alarming.

_pmf_• 9 years ago

"Where we're going, you'll need no VPN!" (spoiler: it's an internment camp)

onewhonknocks• 9 years ago

What is their alternative?

davotoula• 9 years ago

Asking for a friend?

sangnoir• 9 years ago

Ask Google[1].

1. Google complied with the China's censorship laws for a while, but since no good deed goes unpunished - they got hacked by China. Only afterwards did they decide to leave the Chinese market altogether and no longer censor their Chinese results. They do get blocked now, from time to time (or depending on keyword, I forget).

AlexGizis• 9 years ago

Speedify got pulled Saturday morning: "your application will be removed from the China App Store because it includes content that is illegal in China, which is not in compliance with the App Store Review Guidelines: 5. Legal"

duncan_bayne• 9 years ago

https://m.youtube.com/watch?v=R706isyDrqI

Perhaps someone should show Tim Cook.

vincnetas• 9 years ago

ssh -D 12345 infidel@secret-server.com

zserge• 9 years ago

Unfortunately, this method has been blocked years ago. Well, not blocked completely, but the speed slows down to zero (packet loss grows up to 100%) within a couple of minutes making it practically unusable.

dlb_• 9 years ago

Is normal SSH blocked too? How can they determine that the SSH is used as a tunnel?

new2424141• 9 years ago

does stunnel over openvpn bypass the GFW ?

4ad5• 9 years ago

What exactly is a "VPN app" for iOS? How does it work? I was under the impression that iOS natively supports VPNs through IPsec (and perhaps a few other technologies), and that it doesn't have tap/tun devices, nor it allows installing kernel drivers to create tap/tun devices so you could not use e.g. OpenVPN.

So what do these VPN apps actually do? Are they just a front-end for some service, but the phone still uses IPsec? If that is the case I assume you can configure IPsec manually?

Can someone explain? A link to some technical document would be amazing.

Thank you!

aphextron2• 9 years ago

Most are essentially just a UIWebview with preconfigured https proxy

4ad5• 9 years ago

That sounds... awful, the name "VPN" doesn't really apply.

giovannibajo1• 9 years ago

Apple allows to implement new VPN protocols as a sandboxed plugin that communicates with the network manager; this was implemented in iOS 9 as part of the larger ios8 effort of implementing sandboxed plugins like custom keyboards.

A vpn app contains such a plugin, plus the required user interface to login/configure the service. The user downloads the app, configures it providing credentials (or gets auto configured through a MDM) and then the vpn network appears in Settings, among the other VPNs created with a builtin protocol like IPSec.

The vpn plugin is obviously sandboxed with the minimum possible privileges.

This is a WWDC video explaining it: https://developer.apple.com/videos/play/wwdc2015/717/

This is a blog post with a tutorial: http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension...

This is the entry point for the official documentation for all kind of network plugins, of which VPN is one: https://developer.apple.com/documentation/networkextension

4ad5• 9 years ago

Thank you very much for this explanation. It would be great if macOS worked the same. Personally, I try to use IPsec VPNs as much as possible, and then I use the built-in networking on my laptop, but quite often my clients require of me to use their Cisco AnyConnect VPN, which basically requires installing kernel modules.

Edit: actually after reading your link, it appears Network Extension is supported by macOS as well? That would be great news, if vendors would also update their apps to use it.

halfelf• 9 years ago

Very sad. Though I have an alternative apple account outside CN, prepared for this long time ago, it still brings me some inconvenience. These days you can't trust any mega corp, they will eventually store our (Chinese citizen's) data in CN.

Another explanation is the upcoming 19th National Congress of CCP. Recently many policies have been published to restrict freedom of speech, indicating the leader now might desire another 5 year presidency.

abhi3• 9 years ago

indicating the leader now might desire another 5 year presidency.

Might? The consensus outside China seems to be that another term is a forgone conclusion

epynonymous• 9 years ago

i can still download vpn clients from the us apple store from china, it's not a big deal, thus far, though annoying.

bmelton2• 9 years ago

The assertion made on NPR this morning was that it was likely that the 'approved' VPN clients that remain on the App Store are likely to have backdoors to the state.

I have no knowledge on that, so if that's an absurd assertion, please feel free to let me know.

strictnein• 9 years ago

The VPN clients in the US app store have backdoors for Chinese access? This seems unlikely.

paradite• 9 years ago

Can't find any NPR news on that except this old story that mentioned nothing related to backdoor or approved VPN:

http://www.npr.org/tags/540281875/vpn

Any links?

sumanthvepa• 9 years ago

Just out of curiosity, how do businesses in China that have remote offices secure their communication? It must be hard without VPNs.

Yeri• 9 years ago

As far as I have been able to figure out and remember from my time in China...

Businesses are technically allowed to have VPNs. China still relies on foreign companies and a lot of Chinese companies rely on for example adwords to promote their business outside of CN. (this doesn't mean it's uncommon for CN to try to hack into these VPN tunnels, but the goal is not blocking access, and more about corporate espionage).

The Great Firewall also operates on a (customer) ISP level (rules and DPI varies per ISP and city) and not so much on outgoing traffic.

Most western companies rent fiber directly that is not affected by the GFW.

For example I know they could easily spot OpenVPN traffic and send RST packets to the host (also any DNS request with vpn is often send to a honeypot). IPsec had better chances of success (perhaps because that was less common?).

The VPN (and information control) targets mostly local Chinese. They don't care too much about tourists (collateral damage).

devy• 9 years ago

When I travel there I noticed that if I am roaming on the mobile network (with U.S. carrier SIM card but service provided via China Unicom), Facebook was accessible, do you know why?

ethbro2• 9 years ago

If the only way to get a VPN license is to have it attached to a business license, then control over entities with a VPN is a lot easier.

What they're presumably trying to prevent is anonymous VPNs (in that the client is unknown).

Severian• 9 years ago

So does the Great Firewall do deep packet inspection? I take it that it does, and blocks any protocols that it detects that allow tunneling/traversing the firewall.

What if there was a method of changing the standard data formats to be randomized based on one time authorization codes? So your SSH/SSL/L2TP/etc was mangled around to something corresponding to a one time auth function. Basically pre-encrypting or obfuscating to avoid the deep packet inspection.

robert_foss• 9 years ago

Have a look into the arms race between the Tor project and the Great Firewall of China.

yoran• 9 years ago

Related to this, this an interesting paper that clarifies how the Great Firewall discovers Tor nodes by doing active probing: https://nymity.ch/active-probing/imc2015.pdf. No deep packet inspection is necessary when you pretend to be a Tor user and can identify the typical response for a Tor node.

ethbro2• 9 years ago

For anyone in on this, would be absolutely fascinated by any good, recent(ish) links where this is documented or discussed.

And hats off to the Tor people and all the good work they're doing there.

KGIII• 9 years ago

When you have the data about a lot of normal traffic, you can easily spot the abnormal traffic. Then, slow it down or stop it. False positives aren't a huge priority, I don't imagine.

emsy• 9 years ago

It sucks that you can't simply sideload apps like with Android (it is possible but has many restrictions). That's my main gripe with iOS. Without Apple's servers your device is virtually useless. Apple pulling those apps would be a non-issue.

shimfish• 9 years ago

As a developer who makes a living charging for apps, it's wonderful that you can't simply sideload apps like with Android.

amirmc• 9 years ago

I think the above comment is somewhat orthogonal to getting paid. The issue is that the Apple App Store is the only marketplace (realistically).

For example, I try to avoid the Mac App Store and buy/download direct from the vendor, where possible. I can't do that on iOS.

brady747• 9 years ago

Now, if china makes them pull shadowsocks(R) clients from the apple/app/itunes store...then we'll know they are serious. Sorry for all the vpners in china on apple, at least you can go get a cheap android device in china and monkey around and patch together a mobile vpn based solution of some sort.

wuxb• 9 years ago

OKay. Make China North Korea. #MCNK

merricksb• 9 years ago

Extensively discussed 2 days ago:

https://news.ycombinator.com/item?id=14880659

Apple Pulls 60 VPNs from China App Store

Related Stories