Leaked source code exposes China's censorship-as-a-service
Circumvention tools · 17.08.2026

The leak of the century happened back in September 2025, but only now have researchers picked it apart brick by brick: 100,000 documents from Geedge Networks — a Chinese DPI company closely tied to the Great Firewall — including source code, over 500 Git repositories, and five years of commit history. This is the first-ever leak of commercial censorship system code, and a team from Michigan, GFW Report, Paderborn, UMass Amherst, and Colorado Boulder didn't hesitate to assemble this Frankenstein locally and run it.

A bit of context that makes you want to sit down: the company was founded in 2018 by Fang Binxing — yes, that Fang Binxing, the man called "the father of the Great Firewall." Apparently he decided one firewall per country wasn't enough, time to scale the business. And scale he did: the TSG (Tiangou Secure Gateway) product was shipped to Kazakhstan, Myanmar, Pakistan, and Ethiopia — with the full turnkey package: integration, operator training, tech support. A straight-up censorship franchise.

What's inside. TSG can block VPNs and obfuscation via JA3/JA4 fingerprints, packet length, and certificates — in the signature log, 21 out of 29 tools are flagged with the maximum risk level 5, including ExpressVPN, NordVPN, Psiphon, and Tor. Yet two out of three traffic-recognition modules are simply borrowed code: the open-source library libprotoident and the proprietary Qosmos ixEngine. So even a state-backed vendor with money didn't bother building DPI from scratch — easier to just grab something ready-made.

Separately, the Jira tickets are a delight. The Myanmar customer complained that Signal with censorship circumvention enabled couldn't be blocked, while Ethiopia was upset that blocking Psiphon also knocked out TikTok, BBC, and CNN — forcing the team to cobble together a "whitelist" of popular domains so as not to be so obviously caught causing collateral damage.

And the cherry on top: cross-referencing the extracted code with real traffic measurements, the authors found an almost perfect match with DNS engineering—

Source: https://www.usenix.org/system/files/usenixsecurity26-ablove.pdf