Ultrasurf is a unique VPN service with a distinct origin and purpose. Established in 2002, it was designed to facilitate secure communication for Falun Gong practitioners in China, enabling them to maintain contact with their families abroad and disseminate their message to global news outlets.
Features
- Rating: 2/5
- Price: Free
- Refund Period: None
- Country of Operation: USA
- Devices per License: 1
- Server Locations: Single location in the USA
- Streaming Sites Unblocked: Netflix, Disney+, NBC
- Supports Torrenting: Yes
- Log Policy: No logs
- 24/7 Customer Support: No
- Website: https://ultrasurf.us/
In 1999, the Chinese Communist Party initiated a severe crackdown on the Falun Gong movement and its 70 million adherents. The crackdown, which included reported instances of forced disappearances, torture, and organ harvesting, was exacerbated by stringent media control and internet censorship, which obstructed the Falun Gong’s efforts to publicize their plight.
In response, Falun Gong practitioners and their allies in the Chinese expatriate community in the USA collaborated to develop a secure means to circumvent the Great Firewall of China. This effort led to the creation of Ultrasurf, a free VPN service managed by Ultrareach Internet Corporation, a US-based entity.
Ultrareach supports the service through contracts with US government agencies, such as the Voice of America, and receives additional funding from the Falun Gong organization in the United States.
For users within China, Ultrasurf provides a way to connect to proxy servers in the USA, thereby bypassing the Chinese government’s internet monitoring and censorship mechanisms. While the VPN’s primary function is to aid in evading censorship, it has also been utilized by activists in various global uprisings, including those in North Africa.
Despite its focus on privacy, the effectiveness of Ultrasurf as an anti-censorship tool is debated. The service’s internal processes are not publicly detailed, leading to concerns about potential censorship within the system itself.
Privacy and Security
Ultrasurf’s main objective is to offer privacy to Chinese dissidents seeking to communicate with the outside world. China’s internet environment, heavily controlled by the Great Firewall, restricts access to numerous communication and social media platforms, such as Facebook and WhatsApp, and monitors all internet traffic for seditious content.
The Great Firewall employs a range of sophisticated filtering and deep packet inspection techniques to scrutinize internet traffic. Encrypted data is more challenging to intercept, yet Chinese authorities have invested significantly in decryption technologies. Consequently, VPN services must not only employ strong encryption but also effectively disguise their traffic to avoid detection and removal by the Firewall.
In summary, Ultrasurf remains a vital tool for those needing to navigate China’s restrictive internet landscape, though its operation and efficacy as an anti-censorship solution remain subjects of scrutiny.
Types of Internet Traffic
Internet traffic can be classified based on the port number included in the header of data packets. Each packet traveling across the internet contains two levels of addressing in its header: the IP address, which identifies the device connected to the internet, and the port number, which specifies the application for the data within the packet.
Ultrasurf employs the HTTPS protocol—an extension of the Hypertext Transfer Protocol (HTTP) that incorporates encryption for secure web traffic. The World Wide Web relies on two systems:
- HTTP: Manages the request and delivery of web pages.
- HTML: The code used to create each web page.
HTTP transmits data in plain text, which poses a security risk for eCommerce, as it fails to adequately protect sensitive information such as credit card details. HTTPS addresses this vulnerability by incorporating encryption.
While Chinese authorities seek to control all internet traffic, they also encourage eCommerce to boost the economy and facilitate international trade. To circumvent these controls, Ultrasurf leverages the fact that HTTP traffic is not interfered with by the Chinese government.
TLS Tunnel
The “Secure” component of HTTPS is provided by SSL, which originally stood for Secure Socket Layer. However, SSL was replaced by Transport Layer Security (TLS) due to security vulnerabilities. Despite this change, the term SSL is still commonly used.
Ultrasurf operates through HTTPS with SSL/TLS for authentication. OpenVPN, a popular commercial VPN solution, uses SSL for initial connection setup and then transitions to a different encryption system for protecting traffic. VPN connections, referred to as “tunnels,” encrypt the entire IP packet, including its header.
Routers on the internet need to read packet headers to determine their destination. VPNs encapsulate the fully encrypted packet within another packet with a plain text header, directing it to the VPN server. This process, known as encapsulation, allows the VPN to mask the true destination of the original packet.
When a user in China activates Ultrasurf, the VPN client encrypts each outgoing packet, places it into an outer packet, and directs it to the Ultrasurf server. The original packet’s destination remains concealed inside the encrypted packet, ensuring privacy. This method is known as a “TLS tunnel” or “SSL tunnel,” although Ultrasurf’s implementation is proprietary and may differ from systems like Stunnel.
Other VPN services offer similar obfuscation techniques for use in China, including:
- VyprVPN – Chameleon
- Avast SecureLine VPN – Mimic
- TunnelBear – GhostBear
- Surfshark – Camouflage mode
- TorGuard – Stunnel
- Windscribe – Stealth mode
Ultrasurf Proxy Servers
A VPN acts as a type of proxy, serving as an intermediary that represents another computer in its transactions with web servers. This proxy function hides the true identity of the requestor, allowing users to circumvent IP address blacklists by altering their IP address through a VPN or proxy.
Ultrareach, which operates the Ultrasurf proxy VPN service, manages servers located in Cheyenne, Wyoming, and Fremont, California. Although the exact number of servers is undisclosed, China does not block connections to these servers, particularly for HTTPS traffic, which it encourages.
A challenge for Ultrasurf is that Chinese authorities monitor the traffic of suspected dissidents, potentially leading to the blacklisting of Ultrasurf IP addresses. To mitigate this risk, Ultrasurf frequently changes its server IP addresses.
Ultrasurf Client Connections
When a user activates Ultrasurf, the application establishes a connection with the Ultrasurf server, agreeing on an encryption key. Packets transmitted in both directions are encrypted and encapsulated in carrier packets.
The proxy server assigns an IP address to the connecting client. Upon receiving packets from the client, the server decrypts and unpacks them, revealing the original packet with its intended destination IP address. The proxy then sends the packet with the server’s IP address replacing the client’s original IP address.
The destination computer replies to the proxy server’s IP address. The Ultrasurf server encrypts this response, encapsulates it within an outer packet, and directs it back to the client. The Ultrasurf application on the client computer then decrypts the response and delivers it to the original application that made the request.
Network Address Translation (NAT)
When the Ultrasurf application establishes a connection with one of its servers, it is assigned a temporary IP address. To ensure proper routing of incoming messages to this temporary address, the server maintains a NAT table. This table maps the client’s real IP address to the temporary address in use.
Each entry in the NAT table represents a mapping between a real IP address and a temporary IP address. Once the session concludes, the entry is removed from the table, and the temporary IP address is returned to the pool for reuse. In cases where an IP address is blocked, it is discarded and replaced with a new, unrecognized IP address to avoid detection by authorities.
Ultrasurf VPN Encryption
Ultrasurf employs SSL encryption, utilizing RSA as its cryptographic backbone. RSA, a public key encryption system, generates a pair of keys: one for encryption and one for decryption.
In RSA encryption, each character of the plaintext is transformed using a formula, with a key value inserted into the formula. Changing the key alters the output, ensuring that an openly available formula remains secure against unauthorized decryption without the correct key.
Public key systems like RSA use two interrelated formulas: one for encryption and one for decryption. These formulas are designed such that the encryption key cannot decrypt messages encrypted by a different key pair, and vice versa. Thus, the encryption key can be publicly shared, while the decryption key remains private.
For secure communication, a client uses the server’s public key to encrypt messages. Only the server, with the corresponding private key, can decrypt these messages. Similarly, the server uses the client’s public key to encrypt its responses, ensuring that only the client can decrypt them.
The strength of RSA encryption lies in the length of the key, which renders brute-force attacks impractical. Brute force involves trying every possible key value until the decrypted text makes sense. Given the vast number of potential combinations, the encryption key length is crucial for security. RSA keys are typically several thousand bits long to prevent successful cracking attempts.
Although RSA is robust, the Chinese government has advanced capabilities in password cracking and has developed systems to crack 1048-bit RSA keys. Therefore, using 2048-bit keys, as Ultrasurf does, is currently considered secure. However, it is likely that efforts to crack longer keys are ongoing.
Server Authentication and Man-in-the-Middle Attacks
Public key systems, such as those used by Ultrasurf with SSL, are also crucial for server authentication. The principle of public key encryption ensures that only the holder of the private key can decrypt data encrypted with the corresponding public key. This mechanism is vital in preventing man-in-the-middle (MITM) attacks, where an interceptor masquerades as a legitimate server to intercept or alter communications.
ISPs and government authorities can monitor internet traffic without hacking, as they process and control data flow. In China, the government exercises significant control over ISPs and inspects all international traffic through government-operated labs.
In a potential MITM attack scenario, a government lab could intercept a connection request and provide its own public key instead of the legitimate server’s key. The client, believing it is communicating with the legitimate server, would encrypt traffic with the lab’s public key, allowing the lab to decrypt and read the data.
SSL mitigates this risk by implementing a certificate-based system. Instead of requesting a public key directly, the client requests a certificate from the server. The certificate includes the public key and is issued by a trusted certificate authority. Major browsers recognize only certificates from trusted authorities, blocking those from unauthorized issuers.
The client validates the server’s identity by sending an encrypted challenge. Only the server with the correct private key can decrypt and respond to this challenge, confirming its legitimacy. Failure to respond correctly results in the connection being terminated.
SSL certificates help prevent unauthorized entities from intercepting and decrypting internet traffic. While some spying methods are automated, focusing on known targets, secondary controls can also identify individuals of interest.
Ultrasurf Private DNS Overview
The Domain Name System (DNS) is a critical component of internet infrastructure, facilitating the translation between web addresses and IP addresses. Before a browser can request a web page, it must first perform a DNS query. This step is essential because web addresses are not inherently understood by internet routers, which operate exclusively with IP addresses.
The DNS is an extensive network, distributed across numerous databases globally. To streamline this process, Internet Service Providers (ISPs) maintain DNS resolvers that handle DNS lookups for their customers.
Upon receiving a DNS query, the resolver searches through the global DNS databases to locate the appropriate IP address. To enhance efficiency, the resolver caches recent responses, storing frequently accessed IP addresses. This cache ensures that repeated requests for the same sites are processed more rapidly.
The DNS system provides ISPs and certain authorities, such as those in China, with a mechanism for controlling access to websites. By maintaining a blacklist of banned sites within the DNS resolver and returning a false IP address, access to these sites is effectively blocked for all users of that ISP. This method of censorship does not require formal legislation; a site merely needs to be added to a blacklist distributed by authorities to ISPs.
Users have the option to configure their devices to use alternative DNS resolvers. However, this practice is not widely adopted. Notably, while Ultrasurf does not explicitly mention its DNS services on its website, testing indicates that when Ultrasurf is active, DNS queries are not processed by the user’s ISP. Instead, Ultrasurf employs its own private DNS, thereby safeguarding user queries and enabling access to many blocked websites.
The Ultrasurf Client
Ultrasurf offers its service through specialized software available in two formats: an application for Windows, iOS, and Android, and a browser extension.
While Ultrareach promotes the Ultrasurf Chrome extension, it is worth noting that there is also an Ultrasurf extension available for Microsoft Edge, although it is not mentioned on the Ultrasurf website. For optimal security, it is advisable to use the Chrome extension.
