The Chinese Great Firewall was observed conducting two follow-up probes for each outbound TCP/443 connection: the first with garbage binary data (target unknown) and the second specifically performing an SSL negotiation, an SSL renegotiation, and successfully building a one-hop Tor circuit to confirm the bridge. This reactive probing renders unpublished Tor entry points discoverable even when not listed in any directory.
From 2012-lincoln-bootstrapping — Bootstrapping Communications into an Anti-Censorship System
· §1
· 2012
· Free and Open Communications on the Internet
Implications
Proxies must implement access-control authentication before revealing their identity — any service that completes a standard Tor (or proxy) handshake in response to an unauthenticated probe is fully exposed.
Design gateways to return innocuous cover responses to connections that lack the correct credential sequence, so active probers see only a normal web server.