Geedge ran an ongoing, systematically-numbered program extracting detection fingerprints for individual VPN and non-VPN apps for the Myanmar (M22) deployment, tracked with weekly-cadence per-app tickets; methodology combined packet capture, DNS/domain analysis, and fixed-port protocol identification, validated in a live test environment before shipping, with results tracked as "CT" (successfully blocked) or not.
根据软件内置介绍以及抓包域名解析，该软件防火墙服务由guardianapp.com提供，使用wireguard协议，端口固定为51821...抓包分析得到境外ip节点57个...在信息港228环境中测试无CT
Defense implications
- Protocols on well-known default ports/domains appear cheap and fast to fingerprint via packet capture + DNS analysis; port/domain randomization likely raises extraction cost more than protocol-level obfuscation alone.
- A dedicated pre-production false-positive test step means a signature causing collateral damage may get pulled/refined rather than shipped as-is — deliberately mimicking widely-used legitimate traffic patterns may raise the cost of shipping a clean signature.
Related findings
Sustained, systematic feature-extraction campaign against ~20+ named commercial VPN apps (Secure VPN, VPN Turkey-series regional apps, Cloudbric, Thunder VPN, Quark VPN, TowerVPN, SymlexVPN, Tenta, tigerVPN, TLS Tunnel, Tomato VPN, VPNlat, VPNMonster, VPNPro, WhiteHatVPN, WolfVPN, and an ISAKMP/IKE-based and an OpenVPN-based app) for the Myanmar (M22) deployment, 2024. Methodology: reverse-engineer app API via Fiddler/mitm to enumerate server IP/FQDN lists where possible; fall back to Wireshark protocol-signature ID (e.g. recognizing raw ISAKMP port 500 or OpenVPN ports 1194/80) when APIs are unavailable; automated 'dial testing' (自动化拨测) continuously discovers new server IPs; ongoing re-verification explicitly tracks 'CT' (circumvention/breakthrough) to catch when a blocked app resumes working and needs a fingerprint update.
Geedge's M22 (Myanmar) team ran an active fingerprinting program specifically against "lanternVPN" in Aug 2024. They found the Android client's TLSv1 connections have fixed-position header fields (protocol version, payload length) usable as a static byte-pattern block signature, and that fake-SNI TLS 1.2/1.3 connections could only be blocked via destination-IP lists. They then built an automated pipeline (JA4 flow classification + domain/IP correlation + emulator-driven "new device" node discovery) that harvested 400-800+ new server IPs per week over the following month.
M22 runs a large-scale automated pipeline against numerous commercial VPN apps: APK decompilation + HTTPS-proxy interception to extract servers/FQDNs, automated dial-testing at volume (one app: 17,554 dial-tests, 4,073 servers discovered, 94% 24-hour block rate), and OpenCV-based automated ad-dismissal to keep test automation running unattended.
A dedicated AppSketch/MAAT signature object named 'Psiphon-Volunteer-IP' (signature_id 4054) blocklists specific IPv4/IPv6 CIDR ranges by ip.dst regardless of port (192.122.190.0/24, 2001:48a8:687f:1::/64, 141.219.0.0/16, and more), i.e. Geedge maintains infrastructure-level blocking of known Psiphon volunteer-hosted proxy server ranges rather than relying solely on app/protocol fingerprinting.
A signature object dated 2024-10-28 and named 'VPN servers in Russia' (fqdn variant signature_id 6217, IP variant 6216) blocklists specific FQDNs (api.tap2free.net, vpnlocal.app) and a companion IP-address object, showing Geedge curates geography-scoped VPN-infrastructure collections by country rather than only per-app-brand signatures — i.e. any server identified as VPN infrastructure hosted in a given country can be swept into a blocklist independent of which client app uses it.
The batch contains 200+ individual MAAT/AppSketch signature JSON files, most defining FQDN- and/or destination-IP-based blocking rules for a single named commercial/consumer VPN app each (LetsVPN, TurboVPN, QuarkVPN, PandaVPN, StarkVPNReloaded, VPNTurkey, BitdefenderVPN, SnapVPN, SuperSpeedVPNProxy, SuperUnlimitedVPN, CafeVPN, and dozens more), each carrying a build date — the dated files span June 2024 through November 2024 — showing a large, actively and continuously maintained per-app VPN signature catalog rather than a static blocklist.