On Wednesday, China went through what seemed like a digital blackout that lasted about an hour. <\/p>\n
Internet connections between China and the rest of the world were disrupted, and millions of users found themselves unable to reach websites and services outside the country.<\/p>\n
According to a new analysis published by the Great Firewall Report, a monitoring group that tracks internet censorship in China, the outage was linked to unusual activity targeting HTTPS traffic. <\/p>\n
What happened during the outage<\/p>\n
The disruption began at 12:34 AM Beijing time and lasted until 1:48 AM, according to the Great Firewall Report. During this window, researchers observed a large-scale technical interference aimed at TCP port 443, which is the standard port used for HTTPS traffic.<\/p>\n
\u201cSomeone was observed unconditionally injecting forged TCP RST+ACK packets to disrupt all connections on TCP port 443,\u201d the report explained<\/a>. \u201cThis incident caused massive disruption of the Internet connections between China and the rest of the world.\u201d<\/p>\n As a result, users inside China were cut off from most websites hosted abroad. Even domestic services that relied on outside servers could not function properly. In effect, the outage temporarily sealed the country\u2019s internet<\/a> off from external communication.<\/p>\n Why Port 443 was targeted<\/p>\n The Great Firewall has blocked HTTPS communication before, but this case stood out. HTTPS is the protocol that secures communication between devices and web servers, making it harder for outside parties to track or intercept information.<\/p>\n Usually, when China restricts HTTPS, the ban extends beyond a single port. In previous cases, other ports like 22, 80, and 8443 were also blocked. For example, in 2020, HTTPS was restricted across every port from 1 to 65535, a far broader measure.<\/p>\n This time, the interference focused only on port 443, the most commonly used port for secure web traffic. Analysts noted that this was unusual because it effectively cut access to the majority of secure connections while leaving other less common ports untouched. The decision raised speculation about whether this was a deliberate test or a misconfigured block.<\/p>\n The mystery behind the device<\/p>\n Adding to the intrigue, the device responsible for the interference did not match the fingerprints of any known Great Firewall systems. The analysis stated<\/a> that the behavior \u201csuggests that the incident was caused by either a new GFW device or a known device operating in a novel or misconfigured state.\u201d<\/p>\n This finding points to the possibility of China experimenting with new censorship technology or updating its infrastructure. The decentralized nature of the Great Firewall makes it even harder to pinpoint the exact cause. <\/p>\n Unlike a single central system, the firewall is made up of multiple entities that have the ability to block access. That complexity can result in inconsistencies or errors.<\/p>\n Some observers suggested the disruption could have been a trial run for future controls. China has a history of temporarily limiting internet access during politically sensitive events. <\/p>\n However, no such event was taking place at the time of this incident. Others have speculated that it might have been a simple misconfiguration rather than an intentional move.<\/p>\n Unanswered questions remain<\/p>\n For now, the real reason behind the outage remains uncertain. The timing and scope of the disruption left experts puzzled, especially since it affected such a critical part of global internet traffic.<\/p>\n